Axis Camera Vulnerabilities From Google Researcher Analyzed
By: Brian Karas, Published on Mar 23, 2017
Login to read this IPVM report.
Why do I need to log in?
IPVM conducts unique testing and research funded by member's payments enabling us to offer the most independent, accurate and in-depth information.
Related Reports on VMS
Sighthound Transforms Into Enterprise AI Provider
on Jun 14, 2019
Sighthound is now rapidly expanding its R&D team, building an enterprise AI service. This may come as a surprise given their origins 6 years...
Embattled $400 Million China Funded Philippines Surveillance System Proceeds
on Jun 13, 2019
An embattled 12,000 camera surveillance system project that will cost ~$400 million will proceed.
The project contract was awarded, had its...
Carnegie Mellon AI Startup Zensors Profile
on Jun 11, 2019
Zensors is a startup formed by Carnegie Mellon graduates from a Carnegie Mellon research project, offering customized models per camera that they...
Avigilon 32MP and 12MP H4 Multisensor Cameras Tested
on Jun 11, 2019
Avigilon has released their H4 Multi-Sensor line of cameras claiming "broad scene coverage and high image detail"
We bought and tested the...
Directory of 30+ VSaaS / Cloud Video Surveillance Providers
on Jun 07, 2019
This directory provides a list of VSaaS / cloud video surveillance providers to help you see and research what options are available.
2019 State...
OpenALPR Doubles Prices
on Jun 06, 2019
There is no 'race to the bottom' in cloud / AI video surveillance. In May, Verkada increased their prices. Now, OpenALPR is doing the same with a...
"New" Arecont Fixes Failures "Without A Fight"
on Jun 05, 2019
The "old" Arecont was infamous not only for its camera failures but for making their "partners" fight to get them fixed. IPVM drew the ire of...
Startup Rhombus Systems Says Twice the Features, Half the Price of Verkada
on Jun 04, 2019
Closed cloud systems may be the fastest growing segment of video surveillance with Meraki and Verkada. Now another California company is joining...
Smart CODEC Usage Statistics 2019
on Jun 03, 2019
Smart codecs are now nearly a standard feature in IP cameras, but our statistics show integrator adoption has not increased at the same rate.
In...
Panasonic Sells Off / Spins Out Security Business
on Jun 02, 2019
Panasonic has sold off its security systems business to a private equity firm, after suffering years of challenges.
The new company, which will...
Most Recent Industry Reports
Sighthound Transforms Into Enterprise AI Provider
on Jun 14, 2019
Sighthound is now rapidly expanding its R&D team, building an enterprise AI service. This may come as a surprise given their origins 6 years...
ADT Eliminating Acquired Brands, Unifying Under 'Commercial' Brand
on Jun 14, 2019
ADT is eliminating the brands of the many integrators it has acquired over the past few years, including Red Hawk, Aronson Security Group (ASG),...
NSA Director Keynoting Dahua and Hikvision Sponsored Cybersecurity Conference
on Jun 13, 2019
The technical director for the NSA’s Cybersecurity Threat Operations Center will be keynoting a physical security cybersecurity conference that is...
Farpointe Data Conekt Mobile Access Reader Tested
on Jun 13, 2019
California based Farpointe Data has been a significant OEM supplier of conventional access readers for years to companies including DMP, RS2, DSX,...
Embattled $400 Million China Funded Philippines Surveillance System Proceeds
on Jun 13, 2019
An embattled 12,000 camera surveillance system project that will cost ~$400 million will proceed.
The project contract was awarded, had its...
False Verkada 'Unrivaled' Low Light Performance Claim Removed
on Jun 12, 2019
Verkada falsely claimed that it delivered 'UNRIVALED LOW LIGHT PERFORMANCE' until IPVM questioned. In fact, Verkada's low light performance is...
Manufacturer Favorability Guide 2019
on Jun 12, 2019
The 259 page PDF guide may be downloaded inside by all IPVM members.
It includes our manufacturer favorability rankings and individual...
Camera Course Summer 2019 - Register Now
on Jun 12, 2019
Register for the Summer 2019 Camera Course.
This is the only independent surveillance camera course, based on in-depth product and technology...
Favorite Wireless Manufacturers 2019
on Jun 12, 2019
Many wireless options exist for video surveillance but how are integrator's overall favorites?
170 integrators answered the question:
What is...
Carnegie Mellon AI Startup Zensors Profile
on Jun 11, 2019
Zensors is a startup formed by Carnegie Mellon graduates from a Carnegie Mellon research project, offering customized models per camera that they...
The world's leading video surveillance information source, IPVM provides the best reporting, testing and training for 10,000+ members globally. Dedicated to independent and objective information, we uniquely refuse any and all advertisements, sponsorship and consulting from manufacturers.
Comments (19)
Undisclosed Integrator #1
Interesting. Does Google do these tests randomly or is this a researcher doing this as a side project? Is this possibly related to the Arecont to Axis switch from last year?
Create New Topic
Michael Gonzalez
Excellent information and article, thanks. So if I'm reading this correctly, is it safe to assume this type of exploit is rendered even more unlikely when the camera network is logically segregated from the internet/internet connected devices?
Create New Topic
Jon Dillabaugh
Can't believe people still sell these vulnerable devices.
Create New Topic
Undisclosed Manufacturer #3
A vulnerability is a vulnerability. Any and all devices on the network whether that network is "isolated" or not, can become a source of a network attack.
We as the "good guys" must protect our network from any and all possible intrusions. For the "bad guys" they only need to find one weakness to exploit, so the advantage will always be with the bad guys.
Your presumption that certain vulnerabilities are worse than others (a scale of 1 to 10) presumes that all exploitable vulnerabilities will result in the same impact to the system. A vulnerability of "1" (your scale not mine) can be severe if it is on a mission critical system where more aggressive attacks from more determined hackers are being launched and the success of the attack will have a severe and significant impact on the system or operations of an organization which may reach beyond just the camera system.
We as an industry need to take information security more seriously. There are some manufacturers who are knowingly allowing common vulnerabilities and exposures either because they don't want to invest the money in properly hardening their devices or they are responding to customer requests to exchange convenience for security. I have unfortunately encountered integrators and end users who complain about the challenges of implementing very robust IT security in their network. In addition, a highly secure network requires constant maintenance and upkeep as new CVE's are discovered not only with the devices but with the computing and network systems that they are attached to.
We have not heard the last of these vulnerabilities and they will continue to plague our industry. The real questions for those who appreciate and desire strong IT security are, is how pro-active your vendor is being with their information security and how quickly do they react when a vulnerability is discovered?
Keep up the good work in reporting this information as awareness is the first step to providing a more secure system, but unfortunately, the bad guys are always looking for ways in and sooner or later they will probably find one.
Create New Topic
Undisclosed Manufacturer #3
My point is that both matter if they are exploited. I guess my concern is the attitude that "well it is hard for someone to exploit so it is no big deal." Perhaps I am reading something into this that wasn't meant. As an IT security professional, the risk of a CVE isn't judged based on "how hard" it is to exploit it is judged on what damage can be done by exploiting it. My concern is the disconnect between our industry and network security professionals. I guess I am objecting to the premise of the question. if we want to rate a vulnerability we need to do so based on what damage can be done. For example, if a vulnerability allows someone with special expertise to change the date/time of a camera, that might be considered a low risk. if the vulnerability can be used to launch a more serious attack on the network, delete data or launch a DoS attack for example, that is a more serious exposure regardless of how hard it is for someone to do.
Create New Topic
Wade Pinnell
Agree!
John, you are correct to focus on the vulnerabilities of hardware. Any responsible End-User will base their overall cyber-security programs on a Risk Management approach. It is the only practical way to administrate security.
Risk is a factor of the Threat (who is attacking), the Vulnerabilities in the system and the Consequence of an attack. While a bit simplified, this is the general equation. Some Risk methodologies are volumes long and mathematically complex processes.
Customers rarely provide enough details on Consequences to their business or the Threats they need, or are willing to, protect against. Add to this equation, that most integrators don't possess the qualified consultative assets to conduct a comprehensive Risk Management Study
So in the end, your premise is correct. Lowering the vulnerability in hardware may be the only practical step an integrator can unilaterally deliver to a customer.
Create New Topic