Axis Hides Exploit Danger

Author: John Honovich, Published on Aug 09, 2016

Axis is hiding the severity and danger of the 'remote string format' vulnerability.

We ask Axis to fully communicate the risks of the released 'Hack Axis' program to Axis users and urge everyone with Axis devices to upgrade them immediately. 

Exploit Danger

The danger is that a working 'Hack Axis' program was released 3 weeks ago. This programs allows:

  • Root access to Axis devices, without having to know or figure out the password (regardless of how hard the password is).
  • Changing the Axis web password, with a simple additional command, to get full control of video and configuration
  • Turning Axis devices into botnets to attack computers throughout the world.
  • Hijacking Axis devices that continues even after they are upgraded to 'fix' the exploit and even after a factory reset, allowing continued malicious access and control. This was tested with a researcher who did this to an IPVM Axis device, which we verified. 

Axis stresses the main 'limitation' is that one needs network access to the camera, which is true, but undermines that mistakes can occur that allow devices to be remotely accessible and that many contractors, including competitors, often have access to internal systems. And, of course, the tens of thousands of Axis devices made publicly available are extremely at risk.

Axis Communications Failure

Axis has never communicated that a working 'Hack Axis' program has been released and shared across Internet hacking sites. It is now 3 weeks since this was done and Axis has done nothing to communicate that or correct their existing erroneous communications.

(1) The Axis FAQ on this issue declares:

[Update Aug 12th: Axis has edited the FAQ to remove this claim.]

Get Video Surveillance News In Your Inbox
Get Video Surveillance News In Your Inbox

But the vulnerability has been disclosed and is widely known and available on many cybersecurity / hacking sites, including the Exploit Database.

(2) The Axis corporate press release states:

 

Unfortunately for Axis users, Axis has not updated that release nor issued any subsequent release making it clear that not only it is disclosed but the working program allowing for exploitation is released.

(3) Axis has a CVE report which at least mentions the appropriate term exploit:

Three weeks after it was disclosed, Axis still has not updated this.

[Update Aug 12th: 24 days after the disclosure Axis has issued a new CVE report where they acknowledge the full exploit and the available Python script.]

In sum, Axis, after initial limited announcement and no communication about a full working program being released, is now completely ignoring the issue. We emailed Axis management multiple times about these concerns in addition to previous posts that raised them, without any action from Axis.

Axis Take Responsibility

Axis, please immediately fix all of your documentation and then issue a new release and email blasts explaining that a working Hack Axis program does exist and is widely available for hackers and your competitors to take advantage.

Exploits happen to everyone. We agree with Axis engineering team that this was a very hard / obscure exploit to find. That it happened should not be a black eye for Axis.

Axis is great at communication... when they want to. But how Axis has (not) communicated this is inappropriate, leaving Axis partners and customers at significant risk. Axis certainly wants to be a leader in cybersecurity. This exploit should not undermine that. But failing to properly inform your users of the full risk absolutely should.

2 reports cite this report:

History of Video Surveillance on Sep 22, 2016
This is a concise history of video surveillance covering the past decade.  The goal is to help professionals newer to the industry understand...
Dahua Distributor Angered "Always Give Good News About Hikvision" on Aug 11, 2016
A Dahua distributor is angry that "IPVM always give good news about HIKvision while destroys Dahua." I can understand the frustration, not of...
Comments (7): PRO Members only. Login. or Join.

Most Recent Industry Reports

Reseting IP Cameras - 30 Manufacturer Directory on Sep 22, 2017
Every camera has a reset button (well, almost) but it is not always clear what these buttons do, how long they need to be held, what settings they...
80+ OEMs Verified Vulnerable To Hikvision Backdoor on Sep 22, 2017
Over 80 Hikvision OEM partners, including ADI, Interlogix, LTS, and Northern Video, have been verified as having products vulnerable to the...
Genetec Launches Cloud Access Control (Synergis SaaS) on Sep 21, 2017
Genetec's cloud everything expansion continues, with their announcement of Synergis SaaS edition, joining their cloud video offering Stratocast,...
Genetec CEO Warns Against Insider Threats on Sep 21, 2017
With Dahua and Hikvision cybersecurity issues becoming indisputable, a new counter has emerged. Just put them behind a firewall, buy cheap...
New IPVM Calculator V3 Released on Sep 20, 2017
The New IPVM Calculator V3 is released. An entirely new architecture delivers the following benefits: Turbo The calculator is now ~50% faster in...
Automatic Door Operators For Access Tutorial on Sep 20, 2017
Opening and closing doors might sound simple, but it takes a high-tech piece of door hardware to pull it off. Integrating automatic door operators...
'Clowns' Allege Ubiquiti 'Completely Fraudulent' on Sep 20, 2017
A short seller has alleged Ubiquiti is 'completely fraudulent'. Ubiquiti's CEO has responded calling them 'clowns'. Here is the short...
Avigilon 'Blue' Cloud Entry Examined on Sep 19, 2017
Avigilon is moving to the cloud. The company announced their Avigilon Blue platform, designed to be a web-managed surveillance system, utilizing...
HID Buys Mercury Security on Sep 19, 2017
One of the biggest access control deals in years. Mercury Security, the most widely used access hardware OEM, and partner to 20+ manufacturers,...
Hikvision Backdoor Exploit on Sep 18, 2017
Full disclosure to the Hikvision backdoor has been released, allowing easy exploit of vulnerable Hikvision IP cameras. As the researcher, Monte...

The world's leading video surveillance information source, IPVM provides the best reporting, testing and training for 10,000+ members globally. Dedicated to independent and objective information, we uniquely refuse any and all advertisements, sponsorship and consulting from manufacturers.

About | FAQ | Contact