Subscriber Discussion

IP Cameras Hacked "Hikvision Best In Class?"

Avatar
Even Nygård
Jul 17, 2017

A website hacked over 70.000 security cameras, list shows very few to none hikvision products for the first 50pages of cameras viewed. Is hikvision security really a problem for private companies? I see a lot of axis Bosch and other big brands but little Hikvision products? 

Avatar
Brian Karas
Jul 17, 2017
IPVM

Do you have a link the website?

Avatar
Even Nygård
Jul 17, 2017
Avatar
Brian Karas
Jul 17, 2017
IPVM

Where does it say that Insecam "hacked" these cameras? The website says it is a listing of cameras that allow live public viewing, and specifically says they are not "hacked":

It also states that the list is curated by the administrator, and that private cameras are removed, as are any cameras that they get an email about asking to be removed.

The Insecam site is not representative of security risk and does not make Hikvision "best in class" in that regard.

(2)
Avatar
Even Nygård
Jul 17, 2017

I undestand this, if you watch the cameras there is a lot of private cameras and store surveillance and so on. It's no problem to understand that they haven't been hacked if you see the word "hacked" as an intrusion of a protected device. But in fact I see this as a security problem for the manufacturers that do allow standardized credentials for log in.

Hikvision does not allow standard passwords longer but prompts you to make a new upon activating the device(s). This again is as we all know the most basic step to protect your equipment from intrusion. 

As an example Axis states as it reads in this article: 

http://www.aftonbladet.se/nyheter/a/XVn0o/hundratals-svenska-kameror-hackade--sander-live-pa-natet

"It is not our responsibility to tell the users to secure their equipment"

But Hik has thought about this and implemented steps to secure their customers therefore "best in class" by taking responsibility for their customers! And as I stated for "private" I did not say anything about government or high security use as this is a whole other scene! But you do according to some articles I've read military owned cameras that's insecure because of default passwords. Example from this article:

 https://www.google.no/amp/www.csoonline.com/article/2844283/microsoft-subnet/peeping-into-73-000-unsecured-security-cameras-thanks-to-default-passwords.amp.html

(1)
(1)
Avatar
Brian Karas
Jul 17, 2017
IPVM

Setting strong/non-default passwords is possible on pretty much every security camera. I agree that it is good that Hikvision enforces this, and I would recommend other security manufacturers do the same.

However, passwords are only part of cyber security, and broader-scale, Hikvision is still not best in class (e.g.: Hikvision Hardening Guide Recommends Port ForwardingHow To Hack Your Company's Hikvision Recorder as two recent examples).

New discussion

Ask questions and get answers to your physical security questions from IPVM team members and fellow subscribers.

Newest discussions