Hikvision: Was There Ever Definitive Evidence That The Backdoor Was Intentional? (YES)

There was 100% proof that Hikvision cameras contained a hard-coded mechanism that let you bypass standard authentication if you knew a secret text string. This is a basic definition of a backdoor.

You can debate how and why the firmware had this hard-coded bypass string, was it for automated testing, support use, Chinese government attack plan, etc. But you can't debate that it did in fact exist.

You also can not debate that it was not "intentional", as this was not a simple coding error, typo, or other factor that could be viewed as accidental or unintentional. It would take at least a few lines of code to implement this kind of hard-coded auth bypass, making it very intentionally included.

What is backdoor (computing)? - Definition from WhatIs.com

https://searchsecurity.techtarget.com/definition/back-door

1. A backdoor is a means to access a computer system or encrypted data that bypasses the system's customary security mechanisms. A developer may create a backdoor so that an application or operating system can be accessed for troubleshooting or other purposes.

What do you consider evidence? 

It is unlikely that Hikvision will ever say "yes, we put that there intentionally".  

The issue they had was denying the "backdoor" in the first place. The fact that such a thing existed in any internet connected device is just frightening. I just tell people that it doesn't matter whether or not you think they are/were out to infiltrate the US and spy on us, it should be more important that they were dishonest and had a feature like that built into equipment they know people connect to the internet.

Here is the IPVM video that demonstrated and explained the backdoor:

Hikvision called this video Hikvision declared that video "The Most Outrageous Behavior I Have Seen In My 27 Years In The Global Security Industry."

Hikvision hurt their credibility by pretending there was no backdoor. It's obvious that it was intentionally put in. They would have been much better off admitting to it but arguing that it was mistakenly released publically and was just supposed to be for internal testing / QA.

Flat denying it (and the resultant 10.0 worst vulnerability score) helped with their less sophisticated customers but made things far worse with others.