Axis Camera Vulnerabilities From Google Researcher Analyzed
By: Brian Karas, Published on Mar 23, 2017
Login to read this IPVM report.
Why do I need to log in?
IPVM conducts unique testing and research funded by member's payments enabling us to offer the most independent, accurate and in-depth information.
Related Reports on VMS
Axis Perimeter Defender Improves, Yet Worse Than Dahua and Wyze
on Sep 19, 2019
While Axis Perimeter Defender analytics improved from our 2018 testing, the market has improved much faster, with much less expensive offerings...
Directory of 68 Video Surveillance Startups
on Sep 18, 2019
This directory provides a list of video surveillance startups to help you see and research what companies are new or not yet broadly known.
2019...
Vivotek "Neural Network-Powered Detection Engine" Analytics Tested
on Sep 17, 2019
Vivotek has released "a neural network-powered detection engine", named Smart Motion Detection, claiming that "swaying vegetation, vehicles passing...
Panasonic 4K Camera Tested (WV-S2570L)
on Sep 13, 2019
Panasonic has released their latest generation 4K dome, the WV-S2570L, claiming "Extreme image quality allows evidence to be captured even under...
Genetec Stratocast VSaaS Tested
on Sep 05, 2019
The VSaaS market is rapidly expanding in 2019, with Verkada, Meraki, Eagle Eye, Avigilon and numerous startups growing their market share. When we...
Scylla AI Video Analytics Company Profile
on Aug 29, 2019
Scylla, an AI analytics startup, says they are targeting 1 Billion dollar valuation in 5 years and it "is not rocket science" to detect weapons and...
Uniview Pro 4K Camera Tested (IPC3238ER3-DVZ)
on Aug 29, 2019
In our 8MP / 4K Fixed Lens Camera Shootout, Uniview's low end 8MP was firmly in the middle of the pack.
Does their higher end Pro Series 4K camera...
Warning: Windows 7 Update Crashing NVRs
on Aug 26, 2019
Windows 7 updates are causing VMS servers to fail to boot.
After running the update, impacted systems do not boot as normal, instead display this...
Anyvision Facial Recognition Tested
on Aug 21, 2019
Anyvision is aiming for $1 billion in revenue by 2022, backed by $74 million in funding.
But does their performance live up to the hype they have...
Dahua 4K Camera Shootout
on Aug 20, 2019
Dahua's new Pro Series 4K N85CL5Z claims to "deliver superior images in all lighting and environmental conditions", but how does this compare to...
Most Recent Industry Reports
Open Access Controller Guide (Axis, HID, Isonas, Mercury)
on Sep 19, 2019
In the access control market, there are many software platforms, but only a few companies that make non-proprietary door controllers.
Recently,...
Axis Perimeter Defender Improves, Yet Worse Than Dahua and Wyze
on Sep 19, 2019
While Axis Perimeter Defender analytics improved from our 2018 testing, the market has improved much faster, with much less expensive offerings...
Directory of 68 Video Surveillance Startups
on Sep 18, 2019
This directory provides a list of video surveillance startups to help you see and research what companies are new or not yet broadly known.
2019...
Uniview Prime Series 4K Camera Tested
on Sep 18, 2019
Is the new Uniview 'Prime' better than the more expensive existing Uniview 'Pro'?
In August, IPVM tested Uniview 4K 'Pro' but members advocated...
US Army Base To Buy Banned Honeywell Surveillance
on Sep 17, 2019
The U.S. Army's Fort Gordon, home to their Cyber Center of Excellence, has issued a solicitation to purchase Honeywell products that are US...
Vivotek "Neural Network-Powered Detection Engine" Analytics Tested
on Sep 17, 2019
Vivotek has released "a neural network-powered detection engine", named Smart Motion Detection, claiming that "swaying vegetation, vehicles passing...
Schmode is Back, Aims To Turn Boulder AI Into Giant
on Sep 16, 2019
One of the most influential and controversial executives in the past decade is back. Bryan Schmode ascended and drove the hypergrowth of Avigilon...
Manufacturers Unhappy With Weak ASIS GSX 2019 And 2020 Shift
on Sep 16, 2019
Manufacturers were generally unhappy with ASIS GSX, both for weak 2019 booth traffic and a scheduling shift for the 2020 show, according to a new...
How Cobalt Robotics May Disrupt Security
on Sep 13, 2019
While security robots have largely become a joke over the last few years, one organization, Cobalt Robotics, has raised $50+ million from top US...
Panasonic 4K Camera Tested (WV-S2570L)
on Sep 13, 2019
Panasonic has released their latest generation 4K dome, the WV-S2570L, claiming "Extreme image quality allows evidence to be captured even under...
Comments (19)
Undisclosed Integrator #1
Interesting. Does Google do these tests randomly or is this a researcher doing this as a side project? Is this possibly related to the Arecont to Axis switch from last year?
Create New Topic
Michael Gonzalez
Excellent information and article, thanks. So if I'm reading this correctly, is it safe to assume this type of exploit is rendered even more unlikely when the camera network is logically segregated from the internet/internet connected devices?
Create New Topic
Jon Dillabaugh
Can't believe people still sell these vulnerable devices.
Create New Topic
Undisclosed Manufacturer #3
A vulnerability is a vulnerability. Any and all devices on the network whether that network is "isolated" or not, can become a source of a network attack.
We as the "good guys" must protect our network from any and all possible intrusions. For the "bad guys" they only need to find one weakness to exploit, so the advantage will always be with the bad guys.
Your presumption that certain vulnerabilities are worse than others (a scale of 1 to 10) presumes that all exploitable vulnerabilities will result in the same impact to the system. A vulnerability of "1" (your scale not mine) can be severe if it is on a mission critical system where more aggressive attacks from more determined hackers are being launched and the success of the attack will have a severe and significant impact on the system or operations of an organization which may reach beyond just the camera system.
We as an industry need to take information security more seriously. There are some manufacturers who are knowingly allowing common vulnerabilities and exposures either because they don't want to invest the money in properly hardening their devices or they are responding to customer requests to exchange convenience for security. I have unfortunately encountered integrators and end users who complain about the challenges of implementing very robust IT security in their network. In addition, a highly secure network requires constant maintenance and upkeep as new CVE's are discovered not only with the devices but with the computing and network systems that they are attached to.
We have not heard the last of these vulnerabilities and they will continue to plague our industry. The real questions for those who appreciate and desire strong IT security are, is how pro-active your vendor is being with their information security and how quickly do they react when a vulnerability is discovered?
Keep up the good work in reporting this information as awareness is the first step to providing a more secure system, but unfortunately, the bad guys are always looking for ways in and sooner or later they will probably find one.
Create New Topic
Undisclosed Manufacturer #3
My point is that both matter if they are exploited. I guess my concern is the attitude that "well it is hard for someone to exploit so it is no big deal." Perhaps I am reading something into this that wasn't meant. As an IT security professional, the risk of a CVE isn't judged based on "how hard" it is to exploit it is judged on what damage can be done by exploiting it. My concern is the disconnect between our industry and network security professionals. I guess I am objecting to the premise of the question. if we want to rate a vulnerability we need to do so based on what damage can be done. For example, if a vulnerability allows someone with special expertise to change the date/time of a camera, that might be considered a low risk. if the vulnerability can be used to launch a more serious attack on the network, delete data or launch a DoS attack for example, that is a more serious exposure regardless of how hard it is for someone to do.
Create New Topic
Wade Pinnell
Agree!
John, you are correct to focus on the vulnerabilities of hardware. Any responsible End-User will base their overall cyber-security programs on a Risk Management approach. It is the only practical way to administrate security.
Risk is a factor of the Threat (who is attacking), the Vulnerabilities in the system and the Consequence of an attack. While a bit simplified, this is the general equation. Some Risk methodologies are volumes long and mathematically complex processes.
Customers rarely provide enough details on Consequences to their business or the Threats they need, or are willing to, protect against. Add to this equation, that most integrators don't possess the qualified consultative assets to conduct a comprehensive Risk Management Study
So in the end, your premise is correct. Lowering the vulnerability in hardware may be the only practical step an integrator can unilaterally deliver to a customer.
Create New Topic