Sony Gen 5 IP Cameras Critical Vulnerabilities

Since virtually every manufacturer has had vulnerabilities

Though none with the frequency and severity of Hikvision and Dahua.

AFAIK, Mobotix is the only brand that has never been hacked

I get it that “critical vulnerabilities” sells papers

And if we did not report on this, then you and other Hikvision dealers would attack us for only reporting on Dahua and Hikvision's vulnerabilities.

Secondly, we linked to the full disclosure report in the free / publication, so we are hardly going to sell anything with this.

only occurs when one exposes these devices to a public network. Who does this?

Jeffrey, lots of people - either by design or by mistake. Mirai botnets and Dahua massive hack attacks would not happen if no one did this.

And even if you are on a 'closed private network', better to upgrade devices lest at some future point, network changes (by design or mistake) make them accessible.

UD 1, that is a false statement. 

Please elaborate. Which manufacturer has had more vulnerabilities and exploits than Hikvision (or Dahua)? Which manufacturer, or vulnerability, has had vulnerabilities with more severity than Hikvision's magic string, or Dahua's built-for-botnets flaws?

Mr Hinkley, what mess you speak of. Our GDP is at record high as is my investment returns. Our business is at five months backlog......I am enjoying this mess.

In this discussion, an article was written about a product (which by the way, had a vulnerabilty which the manufacturer corrected via firmware update) with the 2nd comment including (which by the way, was deleted by IPVM) a remark about Hikvision/Dahua vulnerabilities (by a undisclosed contributor).

No comment was deleted here. I get emails for every comment posted on every thread and I just cross-checked that to what is posted here and all comments remain, none were deleted.

Indeed, the 2nd comment about Hikvision/Dahua vulnerabilities is still right there, I'll screencap it for you to make it clear:

I'd appreciate if you acknowledge you made a mistake.

It stinks that IPVM have scared away all of the manufacturers from making comments 

What are you talking about?

• Dahua just gave us a statement today about the head of the overseas business unit being removed.
• Axis commented to us earlier this week responding to integrator IPVM members about their product shortage.
• Various Hanwha employees have responded this week to a discussion posted by a federal agency.

As for:

I expect that this post will be soon edited

No, I am happy to leave it as is, errors and all.

I guess my point is that none of the manufacturers is immune to security vulnerabilities if you put their products with all ports open on a public IP. 

Where has someone claimed another manufacturer is immune? I saw a comment about Mobotix having no reported vulnerabilities so far (I have not spent any time determining if that is correct or not, just to be clear). However, I do not recall seeing claims of vulnerability immunity.

On smaller systems (single site) dual NICS with one for the cameras (no Gateway) and one to customers data network eliminate any form of vulnerability.

This is patently false. It may eliminate vulnerabilities from outside attack, but it will not eliminate "any form of vulnerability". Inside threats are real. And, if you have a Hikvision camera that comes setup by default to connect to a given Wifi SSID, then you have a potential gateway into that "secure" network, then into the recorder, then into the rest of the LAN that you thought was protected. Not saying it is common, or easy, but don't fool yourself into thinking you've built a scenario where you have eliminated "any form of vulnerability".

I am not going to name any manufacturers (to show bias) but you have to realize that the others have similar amount if not more vulnerabilties. 

If you're going to make claims like this, you are going to be called out to back them up. Nobody will take it as "bias" if you manage to show how some other manufacturer has been shown to be even less secure than Hikua. Making statements like that and then pretending to ride some high horse to prevent you from backing up your claim seriously diminishes your credibility.

with the 2nd comment including (which by the way, was deleted by IPVM) a remark about Hikvision/Dahua vulnerabilities

Well, that was because the FIRST comment was some utter rubbish commonly spewed by Hik apologists who have either not bothered to look past the surface, or simply don't understand cyber security vulnerabilities with any depth (you know, the kinds of folks who think you can "eliminate any form of vulnerability" with a segmented network).

(by a undisclosed contributor)

Validity of my comments is unaffected by disclosure of my name. Try disputing my claims and comments with specific facts and data inside of offhand comments about what name is, or is not, attributed to the comment. I am probably making it easier for you to sway opinion against my posts by NOT signing them.

I am a decendant of Governor Thomas Hinckley, Plymouth Colony, so I would hope you can get my name correct.

Separately, I'm not sure if you are really a funny guy, or if you and Jeff Zwirm would likely be best pals.

I am a decendant of Governor Thomas Hinckley, Plymouth Colony, so I would hope you can get my name correct.

Internet Rule #3A:  Any post calling someone out for spelling must NOT under any circumstances, itself contain a speling eror.

As a matter of fact, so far Mobotix had only two vulnerabilities discovered, in 2006 and 2016, both cross-site, basically, stealing login credentials, which makes them pretty much "immune" to any untargeted attack.

I am ... Governor Thomas Hinckley, Plymouth Colony, so I would hope you can get my name correct.

Said the Governor to his wife Mrs. Hinkley.

Besides the fact that no damage has been done

Dear Sony employee, this is an incredibly naive and irresponsible response. Do you think hackers announce publicly when they use vulnerabilities? Of course not.

That these vulnerabilities existed for many years is a big problem, just like Sony backdoor found 2 years ago.

With these vulnerabilities, who knows how many more are out there, being used by hackers, and not reported by white hats?

HTTPS are preferred as it gives some privacy ;)

Yes, working with both HTTP/HTTPS.