ADI Finally Fixes Hikvision OEM'd Security Risk

Author: John Honovich, Published on Jun 09, 2016

After refusing for months to fix the obvious security risks, ADI has given in and fixed it.

Two important lessons here:

  • ADI knows little about technology or information security
  • Speaking up publicly about problems is key to getting them fixed

ADI Refuses at First

Not only did ADI refuse to fix it, their justification was shockingly incompetent.

Even though we alerted them to this in September 2015, when we followed up in March, it took them days and, according to them, "working with multiple engineering groups to confirm [their] response."

Their response was bizarre, emphasizing a 'patch':

If the patch had been installed in your camera, and your password configured as the patch recommends, the camera would reflect strong security.

Obviously Not Strong

The problem was the patch was simply an ignorable pop-up, not an actual fix to the underlying issues, like their supplier Hikvision did and the other OEMs implemented.

Obviously, an ignorable pop-up is not the 'strong security' that they claimed, something that Hikvision even made clear to them.

Get Video Surveillance News In Your Inbox
Get Video Surveillance News In Your Inbox

Now that ADI is a 'manufacturer', you would hope they could understand such basics. Unfortunately not.

Speaking Up / Fixing It

Our March 2016 article, ADI Refuses to Fix Their OEM'd Hikvision Security Risks, evidently was enough to push them to make the change. Between the thousands that read it on IPVM and the tens of thousands who received it in our newsletter, the word was out.

In May 2016, ADI finally rolled out the fix, and in their instructions, changing their position and admitting that with the new version:

The system will check the password strength; “Risky” passwords will not be accepted.

Their previous 'patched' version was clearly not 'strong', like they had claimed, and the risk remained. This new version at least brings ADI up to the level of current Hikvision.

It is all to easy for mega corporations like ADI to ignore private complaints but when concerns are raised publicly, the exposure helps raise enough attention and inquires that companies need to review their approaches and do better.

1 report cite this report:

Honeywell Dahua Backdoor Statement on Mar 14, 2017
Honeywell OEMs Dahua video surveillance products and has been affected by the Dahua backdoor, confirmed by Honeywell and IPVM testing. Here is...
Comments (1): PRO Members only. Login. or Join.

Most Recent Industry Reports

Avigilon CEO Attacks Asian Companies Cyber Insecurity on Aug 18, 2017
Avigilon CEO is taking aim at their Asian competitors. And he is going directly after these company's cyber security issues. In this note, we...
Sony Next Gen HD Dome Camera Tested (SNC-EM642R) on Aug 18, 2017
Sony has released their latest generation, claiming improved WDR and low light, increased IR range, and more. We tested the SNC-EM642R outdoor IR...
IP Networking Course September 2017 on Aug 17, 2017
This is the only networking course designed specifically for video surveillance professionals plus it includes live training, personal help and...
Knightscope Raises $10 Million With $3,320 Average Per Investor on Aug 17, 2017
Congrats to Knightscope. And condolences to their legion of little investors. Knightscope has disclosed they have raised $10+ million from their...
Axis and Arecont Legal Conflict Over Multi-Imager Cameras on Aug 17, 2017
Arecont threatened Axis. Axis has responded by moving to invalidate an Arecont patent. It is an important contest. Multi-imagers are Arecont's...
Directory Of Consumer Security Cameras on Aug 16, 2017
The consumer camera segment continues to grow, with new startups and models from existing players released seemingly every month. In this report we...
Cat 5e vs Cat 6 vs Cat 6a Network Cable Usage Statistics on Aug 16, 2017
Cat 5e? Cat 6? Cat 6a? What do integrators use in practice, today? 140+ integrators told IPVM. Here are the results: For those who want to...
Hikvision Responds To Cracked Security Codes on Aug 15, 2017
Hikvision has responded to IPVM's report on Hikvision's security code being cracked, both with a 2 page update to dealers and communication...
Stolen Video NVR / DVR Statistics on Aug 15, 2017
"But what happens if someone steals my recorder?" Anyone who has done more than a handful of jobs has probably heard this question several times....
Hikvision Europe Cutting Out Unauthorized End User Sales on Aug 15, 2017
The days of anyone buying Hikvision from anywhere off the Internet are numbered, at least in Europe, if Hikvision's plan comes to fruition. In...

The world's leading video surveillance information source, IPVM provides the best reporting, testing and training for 10,000+ members globally. Dedicated to independent and objective information, we uniquely refuse any and all advertisements, sponsorship and consulting from manufacturers.

About | FAQ | Contact