Axis Hides Exploit Danger

By: John Honovich, Published on Aug 09, 2016

Axis is hiding the severity and danger of the 'remote string format' vulnerability.

We ask Axis to fully communicate the risks of the released 'Hack Axis' program to Axis users and urge everyone with Axis devices to upgrade them immediately. 

Exploit Danger

The danger is that a working 'Hack Axis' program was released 3 weeks ago. This programs allows:

  • Root access to Axis devices, without having to know or figure out the password (regardless of how hard the password is).
  • Changing the Axis web password, with a simple additional command, to get full control of video and configuration
  • Turning Axis devices into botnets to attack computers throughout the world.
  • Hijacking Axis devices that continues even after they are upgraded to 'fix' the exploit and even after a factory reset, allowing continued malicious access and control. This was tested with a researcher who did this to an IPVM Axis device, which we verified. 

Axis stresses the main 'limitation' is that one needs network access to the camera, which is true, but undermines that mistakes can occur that allow devices to be remotely accessible and that many contractors, including competitors, often have access to internal systems. And, of course, the tens of thousands of Axis devices made publicly available are extremely at risk.

Axis Communications Failure

Axis has never communicated that a working 'Hack Axis' program has been released and shared across Internet hacking sites. It is now 3 weeks since this was done and Axis has done nothing to communicate that or correct their existing erroneous communications.

(1) The Axis FAQ on this issue declares:

[Update Aug 12th: Axis has edited the FAQ to remove this claim.]

Get Notified of Video Surveillance Breaking News
Get Notified of Video Surveillance Breaking News

But the vulnerability has been disclosed and is widely known and available on many cybersecurity / hacking sites, including the Exploit Database.

(2) The Axis corporate press release states:

 

Unfortunately for Axis users, Axis has not updated that release nor issued any subsequent release making it clear that not only it is disclosed but the working program allowing for exploitation is released.

(3) Axis has a CVE report which at least mentions the appropriate term exploit:

Three weeks after it was disclosed, Axis still has not updated this.

[Update Aug 12th: 24 days after the disclosure Axis has issued a new CVE report where they acknowledge the full exploit and the available Python script.]

In sum, Axis, after initial limited announcement and no communication about a full working program being released, is now completely ignoring the issue. We emailed Axis management multiple times about these concerns in addition to previous posts that raised them, without any action from Axis.

Axis Take Responsibility

Axis, please immediately fix all of your documentation and then issue a new release and email blasts explaining that a working Hack Axis program does exist and is widely available for hackers and your competitors to take advantage.

Exploits happen to everyone. We agree with Axis engineering team that this was a very hard / obscure exploit to find. That it happened should not be a black eye for Axis.

Axis is great at communication... when they want to. But how Axis has (not) communicated this is inappropriate, leaving Axis partners and customers at significant risk. Axis certainly wants to be a leader in cybersecurity. This exploit should not undermine that. But failing to properly inform your users of the full risk absolutely should.

1 report cite this report:

Dahua Distributor Angered "Always Give Good News About Hikvision" on Aug 11, 2016
A Dahua distributor is angry that "IPVM always give good news about HIKvision while destroys Dahua." I can understand the frustration, not of...
Comments (6) : Members only. Login. or Join.

Related Reports

Breaking Into A Facility Using Canned Air Tested on Jan 28, 2020
Access control is supposed to make doors more secure, but a $5 can of compressed air may defeat it. With no special training, intruders can...
TVT Backdoor Disclosed on Apr 09, 2018
Security researcher Bashis has disclosed a backdoor in TVT video surveillance products, with TVT issuing its own 'Notification of Critical...
Hikvision Happy With Bad Security Unless Hit With Bad Press on Aug 28, 2017
Hikvision is happy to have bad cyber security unless they are hit with bad press, as we detail inside. When you look at the pattern of their...
Hikvision VMS Password Recovery Vulnerability - Emailing Admin Passwords In Plain Text on Aug 28, 2017
Hikvision iVMS-4200 suffers from a vulnerability that allows anyone local, without authentication, to generate a code that Hikvision will respond...
How To Hack Your Company's Hikvision Recorder on May 29, 2017
Here's how easy it is to hack your company's Hikvision recorder: It does not matter how hard or secret the admin password is. Hikvision will...
Milestone Entry Level Mobile Password Vulnerability Disclosed on May 24, 2017
While many manufacturers have only addressed cybersecurity vulnerabilities after public disclosures were made (or threatened), Milestone has...
Axis Camera Vulnerabilities From Google Researcher Analyzed on Mar 23, 2017
A Google security researcher has reported 6 vulnerabilities for Axis cameras, affecting multiple models and firmware versions. In this report, we...
Uniview Weak Local / Strong Remote Password Policy Tested on Mar 14, 2017
With the continuing onslaught of cyber-security breaches (see Dahua backdoor recently discovered, Hikvision defaulted devices getting hacked)...
Axis Releases Access Credentials - Insecure But Convenient on Nov 02, 2016
Axis continues to build out their own end-to-end 'solution'. The company recently announced a series of credential cards, but instead of a...
Axis Exploit Allows Changing Camera Root Password Confirmed on Aug 02, 2016
IPVM has confirmed that using the Axis remote format string vulnerability, an attacker can easily change the root password of the camera, taking...

Most Recent Industry Reports

Hikvision Illicitly Uses Back To The Future In Marketing on Jul 03, 2020
NBCUniversal told IPVM that Hikvision UK's ongoing coronavirus marketing campaign using NBCUniversal's assets was not allowed. Hikvision mass...
Verkada: "IPVM Should Never Be Your Source of News" on Jul 02, 2020
Verkada was unhappy with IPVM's recent coverage declaring that reading IPVM is 'not a good look' and that 'IPVM should never be your source of...
Vintra Presents FulcrumAI Face Recognition on Jul 02, 2020
Vintra presented its FulcrumAI face recognition and mask detection offering at the May 2020 IPVM Startups show. Inside this report: A...
Uniview Wrist Temperature Reader Tested on Jul 02, 2020
Uniview is promoting measuring wrist temperatures whereas most others are just offering forehead or inner canthus measurements. But how well does...
Dahua USA Admits Thermal Solutions "Qualify As Medical Devices" on Jul 02, 2020
Dahua USA has issued a press release admitting a controversial point in the industry but an obvious one to the US FDA, that the thermal temperature...
Access Control Online Show - July 2020 - With 40+ Manufacturers - Register Now on Jul 01, 2020
IPVM is excited to announce our July 2020 Access Control Show. With 40+ companies presenting across 4 days, this is a unique opportunity to hear...
Hanwha Face Mask Detection Tested on Jul 01, 2020
Face mask detection or, more specifically lack-of-face-mask detection, is an expanding offering in the midst of coronavirus. Hanwha in partnership...
UK Government Says Fever Cameras "Unsuitable" on Jul 01, 2020
The UK government's medical device regulator, MHRA, told IPVM that fever-seeking thermal cameras are "unsuitable for this purpose" and recommends...
Camera Course Summer 2020 on Jun 30, 2020
This is the only independent surveillance camera course, based on in-depth product and technology testing. Lots of manufacturer training...
Worst Over But Integrators Still Dealing With Coronavirus Problems (June Statistics) on Jun 30, 2020
While numbers of integrators very impacted by Coronavirus continue to drop, most are still moderately dealing with the pandemic's problems, June...