VMSes Adding 2 Factor Authentication (2FA)

By: IPVM Team, Published on Feb 01, 2017

2 Factor Authentication (2FA) support is growing across the Internet to improve the security of critical web services. For example, banks frequently use 2FA to mitigate against a user's password being stolen / hacked.

Now, VMS manufacturers are starting to add two factor authentication (2FA) support to their products.

In this report we outline how 2FA works, what problems it solves, who is using it (including BCD, Eagle Eye, Genetec, Milestone, OpenEye) and what vulnerabilities it still leaves open.

Two Factor Authentication Overview

Two factor authentication (sometimes also called two step verification) uses two components to verify a users identity. The first component is typically a traditional password, and the second component is a code or PIN that is only usable 1 time, or for a short duration of time.

The code for the second factor is often delivered via SMS or email to the accounts registered to the user when they are trying to login. A standard approach is for the user to enter their username/password, and then be presented with a set of options for where they would like the 1-time code to be delivered. In some cases the special code is generated by an app like Authy.

No matter how the code is received by the user, the key components are that the code is only valid for a short duration of time, and typically only for a single login. This reduces the chance that stolen passwords can be used to login to user accounts.

The primary downside to requiring 2FA is additional burden on the user when logging in, though this is typically minimal unless the user is suddenly without access to their phone, email account, or method used to receive the 1-time code.

VMSes Supporting 2FA

Currently, the following companies support some form of 2FA login, generally in their latest releases only:

Get Notified of Video Surveillance Breaking News
Get Notified of Video Surveillance Breaking News

  • EagleEye - First login on unknown or untrusted device requires 2FA, code delivered via email or SMS.
  • Genetec Stratocast - uses Google, Microsoft or Yahoo logins, which can be independently set for 2FA.
  • Milestone Corporate / Expert - Every login requires 2FA when enabled, code delivered via email or SMS, customer must configure SMS gateway.
  • OpenEye - Every login requires 2FA when enabled, code delivered via SMS.

Additionally, server builder BCDVideo has added 2FA support [link no longer available] for an admin app on their servers, this does not add 2FA to hosted VMSes, but prevents remote login to the server control panel without the two-step process.

Problems Solved By 2FA For VMSes

2FA primarily prevents users from sharing passwords, or using stolen passwords to login to another persons account. It also prevents hackers that retrieve a list of username/password combinations from a database dump or similar from using those credentials to masquerade as a valid user and login to the server. It can be particularly useful for accounts that have admin-level, or other advanced privileges, to prevent unauthorized use of those accounts.

What 2FA Does Not Solve

Two factor authentication will not prevent the kinds of exploits that have been common in security devices recently - attacks leveraging weaknesses in the software itself to gain access to backdoors, consoles, command prompts, etc. A server with 2FA login requirements, that has an exploitable script as part of a web/mobile gateway would still be vulnerable to hack attempts.

More Applicable To VMSes Than Cameras

While there is nothing technically preventing a 2FA implementation on a camera or similar device, it is typically only implemented on servers or devices that humans regularly login to directly. Implementing 2FA on a camera would also mean that the VMS would need some way to respond to the prompts for the second factor authentication, which would make setup and administration cumbersome.

Good Move For Industry

Though 2FA does not make a VMS secure from all forms of remote exploit, it can prevent account misuse and prevent malicious users from attempting to access admin accounts to change settings, delete bookmarks, or perform other unauthorized functions. Banks, and even email providers like Google and Yahoo routinely offer the option to use 2FA verification, and given the sensitivity of some VMS uses, it is a good ides for manufacturers to offer users the ability to increase security around user verification.

Interest In 2FA?

7 reports cite this report:

Verkada Cloud VMS/Cameras Tested on May 02, 2019
Verkada is arguably the most ambitious video surveillance startup in many years. The company is developing their own cameras, their own VMS, their...
Cisco Meraki Cloud VMS/Cameras Tested on Feb 13, 2019
Cisco Meraki says their cameras "bring Meraki magic to the enterprise video security world". According to Meraki, their magic is their management...
Eagle Eye Networks Cloud VMS Tested on Jul 26, 2018
Eagle Eye has become one of the most significant players in the industry in the past few years: Eagle Eye's Owner Acquired Brivo Eagle Eye...
Genetec Now Detects Insecure Camera Firmware on Nov 29, 2017
Genetec is heavily emphasizing cyber security and cyber resilience. From initiatives like CHAVE to 2 Factor Authentication to Expelling...
Verkada, Silicon Valley VSaaS Startup, Targets Enterprise on Oct 19, 2017
Verkada says they are building an enterprise-class VSaaS offering, calling it "The new platform for video security". This is a departure from the...
Surveillance Systems Remote Access Usage Statistics on Oct 11, 2017
Remote access is a major benefit and risk for video surveillance. It is a benefit because it allows users to manage security or review...
OpenEye Takes Aim At Exacq on Mar 23, 2017
First Milestone targeted Exacq with a takeover offer, and now OpenEye is gunning for them with an offer to swap out Exacq for their cloud-managed...
Comments (6) : Members only. Login. or Join.

Related Reports

China DVR/NVR Backdoor Discovered, Huawei Refutes on Feb 07, 2020
A backdoor was found in Chinese-produced DVRs and NVRs that secretly allowed access to the recorders. While it was first attributed to Huawei...
Remote Access (DDNS vs P2P vs VPN) Usage Statistics 2019 on Oct 25, 2019
Remote access can make systems more usable but also more vulnerable. How are integrators delivring remote access in 2019? How many are using...
ONVIF Exposure To "Devastating DDoS Attacks" Examined on Sep 06, 2019
ZDnet reported "Protocol used by 630,000 devices can be abused for devastating DDoS attacks", citing exposure of ONVIF devices. And after an...
Warning: Windows 7 Update Crashing NVRs on Aug 26, 2019
Windows 7 updates are causing VMS servers to fail to boot. After running the update, impacted systems do not boot as normal, instead display this...
Critical Vulnerability Across 18+ Network Switch Vendors: Cisco, Netgear, More on Aug 26, 2019
Cisco, Netgear and more than a dozen other brands, including small Asian ones, have been found to share the same critical vulnerability, discovered...
CheckMySystems Company Profile on Aug 14, 2019
CheckMySystems says that too many users respond, "I get an email when something is wrong" when talking about their video system maintenance plan,...
Dahua Wiretapping Vulnerability on Aug 02, 2019
IPVM has validated, with testing, and from Dahua, that many Dahua cameras have a wiretapping vulnerability. Even if the camera's audio has been...
Vivotek Trend Micro Cyber Security Camera App Tested on Jul 22, 2019
Vivotek and Trend Micro are claiming five million blocked attacks on IP cameras, with their jointly developed app for Vivotek cameras. This new...
LifeSafety Power NetLink Vulnerabilities And Problematic Response on May 20, 2019
'Power supplies' are not devices that many think about when considering vulnerabilities but as more and more devices go 'online', the risks for...
Security Fail: ASISNYC Auto Emails Passwords In Plain Text on May 14, 2019
ASIS NYC automatically emails a user with the password the user just entered, in plain text, when one registers for the site / event, as the...

Most Recent Industry Reports

USA's Feevr Thermal Temperature System Examined on Mar 31, 2020
This US company has burst on to the scene, brashly naming itself 'feevr' and branding itself as a "COVID 19 - AI BASED NON CONTACT THERMAL...
JCI Coronavirus Cuts on Mar 31, 2020
JCI has made coronavirus cuts, the company told employees in an email that IPVM has reviewed. Inside this note, we examine the cuts made, the...
Add Door Operators To Fight Coronavirus on Mar 31, 2020
IPVM recommends that integrators advocate and end-users consider adding door operators to fight the spread of coronavirus. This delivers...
Video Surveillance Business 101 on Mar 30, 2020
This report explains the fundamental elements of the video surveillance business for those new to the industry. This is part of our Video...
FDA Gives Guidance on 'Coronavirus' Thermal Fever Detection Systems on Mar 30, 2020
The US FDA has given IPVM guidance on the use of thermal fever detection systems being marketed for coronavirus, as an explosion of such devices...
Worsen: Integrators Hit Even Harder By Coronavirus on Mar 30, 2020
Integrator's problems have worsened over the past 2 weeks, according to new IPVM survey results. Inside this report, we share statistics and...
Pivot3 Mass Layoffs on Mar 27, 2020
Pivot3 has conducted mass layoffs, the culmination of grand hopes, a quarter of a billion dollars in VC funding, and multiple failures to gain...
Athena CEO Criticizes 'Deplorable' 'Nitpicking', IPVM Refutes on Mar 27, 2020
UPDATE: NBC News Report Cites IPVM On Coronavirus 'Fever Detection' Cameras Athena Security's CEO Lisa Falzone has strongly objected to IPVM's...
Hikvision Admits Sanctions Harming Its Financial Performance on Mar 27, 2020
While Hikvision initially downplayed being sanctioned for human rights abuses, the company is now admitting a significant impact in a new PRC...