Axis Cybersecurity Hardening Guide Examined

Author: Ethan Ace, Published on Nov 19, 2015

In most IT areas, 'hardening' guides are commonplace, providing best practices for improving the cybersecurity of network products (e.g., see this Cisco hardening guide).

However, cybersecurity is generally an after thought in the physical security industry, despite an increasing number of hacking incidents.

In a rare proactive move, Axis has released a cybersecurity hardening guide, walking users through recommendations on how to close common security holes and better secure their networks.

In this note, we review this guide, provide a video showing where these settings may be found in the camera, and give our analysis of their practical impact.

** **** ** *****, '*********' ****** *** ***********, ********* **** ********* for ********* *** ************* ** ******* ******** (*.*., *** ********* ********* *****).

*******, ************* ** ********* ** ***** ******* ** *** ******** security ********, ******* ************ *************** *********.

** * **** ********* ****, ******* ******** * ************* ********* *****, ******* ***** ******* *************** ** *** ** ***** ****** security ***** *** ****** ****** ***** ********.

** **** ****, ** ****** **** *****, ******* * ***** showing ***** ***** ******** *** ** ***** ** *** ******, and **** *** ******** ** ***** ********* ******.

[***************]

Protection ******

*** **** ********* ***** ******* **** ****** ** ********** ******** at ******* ******** *** ********** ** ******** (*** **********).

***** ****** *** ***** ** *************** **** ******* ****************** *** ******** ********, ***** ********* ******** ******** ********. **** *** *********** ****** **** ***** ****** ********* **** steps ***** ***** ** ** ***** ********. 

Video ***********

*** * ****** ***** ***** ***** ******* *** ****** *** key ******** *** ****** ** ****** *** **** *******:

Default, ***** *

**** ******* ***** * ** "**** *********** *** **** ******** and **** *********":

**** ***** ** ******* ** ** ******, ***** ******* ****** settings. **** ***** *** ****** ************ ***** *** ******* ****/**** ***********, allows ********* ******* *** *** *******, *** ****** *** ** address ** ** ******* *** *** **** *** *******, *** insecure *********. ** ** **** ******* *** **********, *** ** these *** *** ********* *** *** **** ****** ****** ****** in ***** ********.

*** *** ***** ** ******* *********** ****** ********* - ****, *****, *******, *** ******* ******** *** ** ***** ************ *** **** ***********.

Standard, ***** *

***** * ** ******* ** "******* *********** ***** ** **********. This ***** ** ******** *** ***** ******** ** ****** ************* where, *********, *** ******** ** **** *** *************."

**** ******** ******* ****** ***** ******** *********:

  • *********:**** ***** **** **** ** ******** ****** *********, *** ********** "** ***** * **********, ********** ***** * password *********."
  • ******* ********* ******: **** ********* ****** *******, ****** **** *** *** ******* ** *** camera *** ****** **** ***** *** *** ********. ** ******* *********, anonymous ****** ** ******** ** *******. ***** ****** ****** ***** settings **** *** ******* ************* ** ************ (***** **** ********).
  • *** ****/****:*** ***** ********** ******** ******** ** ******** ******* *** **** and ****. **** ** *** ******** *** ***** *******, ******* proper ****/**** *** *** ****, *** ***** ****** **** ******, and ************ ** ********** ****** **** ** *****.

**** ***** ******* ** ***** ** *** *** ******** ** Level *, ****** ******** ** ** * ************** ** **** detail *****, ** ***** *.

Enterprise, ***** *

***** * ** "*********** ******** *** ************ **** **** * dedicated ****** *************."

***** * ********** **** ******** ********, *** **** ** ***** involve turning ** ***** *** *** *** *********/***** ****, ** **** as ********* ****** ***** *** ********* (***, *******, ****, ***.). 

*****

*** *** ************** **** ***** **** ***** **** *** ** unfamiliar **** ** ******** ********** (*****). ** *******, ********* *** passwords *** **** ** *** ****** ** ***** **** ***** may ** ****** *********** *** ********* ** ***** ****** ********. ******** **** option ******** ********* ******* ****** *** ****** ** **** *** not ** ****** ********. 

** ***** ** ****** *****, ***** *** ****** * ****-****** certificate, ***** ** *** ******** ** *** *********** ******* ********* and ********* *** ******** ** ***** ******, ** ****** * request ** **** ** * *********** ********* ** ****** * signed ***********.

*********** ***** ****** ********* ** *** ******, ********, *** ********** ********/******** included, though ********* ***** * *** ******* *** ***********. **** ******* offer ********* ***** *** ******* ******* ******* *** ****, ***** may ** **** ** ***** ***** *********** ******* ** ****** per ******.

**** **** **** ** ***** ** ***** *** **** ***/**** video *** *** ********* ** *******, *** ***** ******** ***** only ** **** ******* ******* *** *** ******.***** ********* ****** ** ******* **** *** ***, ***** ** *** *********. ***** and ******** ** *** ******* ***** *** *****, *** *******, while ********* *** ******* **.

***** ***************

**** *********** **** *** ***** ********* *** ***** *********** ** ** video ********:

  • ****** ***** *******:**** ********** ******** * ****** ***** ******* **** * ********* password **** *** ******* *******, ** ***** *** ***** *** in ****** ****** ******* ****** ***********. **** ** ****** ** ** systems, *** ****** **** ** ******** ********. **** ***** **** use *** ******* ***** ******* ** *******.
  • ******/*** *******:************, **** ********* ******** * **** ** *** ****** *** the ***/*** *****, ******** **** *** ***** *******(*). **** ******* the ******** ** *** ***** *******. *******, **** ***** *** require ************** ********** *** ****** ********* (****** * ******** ***** account *** *** ********** ** ***** **** ********).
  • ** ******* *********:*******, **** ********** ******** **** *** ******* *** ***** ******* to ****** ******* ********, *** ** ******* *********. **** ** a ******, *** ***** ********** ***** ** ******** ****** ** cameras, ***** *** ******* **** **** ** **** **** *** authorized ********. **** ***** **** * ********** *** *** **** these *********** ******** ** ****** ********, ***** **** *** **** annoying.

Managed **********, ***** *

*******, ***** * ** ********* ** "***** ******* ************** **** ** IT/IS **********. *** ************ ***** ******* *** **** ** ** integrated **** ** ********** ******* **************."

***.**

** **** *****, **** ********** ***** ***.**, ***** ******** ******* ** be ************* ** * ****** ****** ***** ******* ** ******* to *** *******. ******* ******* *********** ****** ** *** ****. ***.** ** typically ********** ** *** ******* ******.

***.** ** ********* *********** ** ***** ********** ********, ** ** adds *********** ********** *** ************** ** *** *******. ** ** very ******, *** ****** *** ************ ** **** *****, *** likely ******** *** **** ************ *************.

**** **********

**** ********** ***** **** ********** ** *** *******. ******* **** ******* offer ******* ******** ******** *****, ********* "************** ******" ************, ** notify ************** ** ****** ******, ** **** ** ******* ****** tampering ******.

** **** ***.**, **** ** ********* **** ** **** **** sophisticated ** *************, ** ** ******** **** ******* ***** *** knowledge. *******, **** **** ** *** **** ******* ********** ********* becoming **** ******, ***** ********** *** ** ********* ** **** small ******** ** ******* **** ********** ******* *** ********* ** the ****** ** **** *** ***.

*** *** ******* ********** / **** *** ***** ************ ***** *** **** *********** *** *********, ********* *********** ** ****' ******** SNMP **************.

****** ****** ***

****** ******* ******* * ******* ******** *** ******** ******* ** dump *** ***** **. ******* ** **** **********, *** ********* by **** ** *** **** ******* ********** *****, ****** ***** log ****** ** **** **** ** *** ******, ***** **** checks ****** *** *** ****** ************** ** ******. **** ** these ****** *** ** ********* ** **** ** ******* ** use, ****** ****** **** ******, ********** ** ************.

Overall ****** ***************

*** **** ********* *****, ** ******** ** **** ******** ***********, provides ******* ********* *************** *** ********* ******** ** ** ***** networks. ***** **** *****, ***** ******** ********** ************* **** *** cost *** *** ****** *** ***********, *** *************** ** ****** 1 *** * ****** **** **** * *** ******* ** implement, **** ** *********** ******* ** ****. 

**** ******* *** ***** **** *** ********** ** *****, ***** we ****** **** ***** **** *** *********, ***** ***** *************** do **** ** ******* ****** ****** ****** ** ******** ********.

Other ************* *** *********

** *** *** ***** ** *** ***** ** ****** ************* with ********* ******. ***** *********'* ***** ******, ** ********** ******* with **** **** **** * **** *** *** **** *** received * ******** *** ******* **** ** *** **** ***.

Comments (12)

In current firmwares, anonymous access is disabled by default.

I'm not sure what Axis define as anonymous access, but I as far as I can tell ONVIF access with full rights are enabled by default with no user name or password needed, not even root pass.

Do Axis Cameras Default To No Password Required?

It is indeed available by default, but it's disabled as soon as you assign a root password.

Anonymous access refers to viewing/PTZ control via the web interface without login.

It is indeed available by default, but it's disabled as soon as you assign a root password.

Which you need never do, if using a VMS.

Sure, that's true, but it's unlikely.

First off, most VMSes include direct Axis drivers and cameras are discovered as such. The vast majority of people spending money on Axis instead of cheaper alternatives are going to know this and use the right driver, which requires creating the password.

Second, if you never enter the web interface, you likely will not be able to configure several things. Basic things like detailed CODEC settings may not be exposed, the date and time are rarely set via VMS, text overlays/titles, autofocus, etc., etc. As well as advanced features which people tend to buy Axis for, like Zipstream, ACAP applications, all that. You can't update firmware without setting the password, either, since it's done via the web or Axis Camera Management client.

The vast majority of people spending money on Axis instead of cheaper alternatives are going to know this and use the right driver, which requires creating the password.

Are you sure that adding a defaulted Axis camera w/Axis driver requires creating a new root password?

What happens when you try to add thru the VMS before you have created it? Does it just fail?

Maybe it has changed again, but when I looked at it a few months ago it seemed to match what the guide said:

The first time a user access the device using the web interface a password for the default root as is illustrated...

Once the root user has a password the device only accepts access according to the access permissions...

However, if the device is first accessed using the VAPIX API (i.e. not the GUI) there is no hard requirement from the device to enter users with proper credentials. Instead, as this is the normal way a camera is plugged into a VMS, the client application is trusted to add proper users to the device to control the access as described above. - Axis Authentication Guide

I tried it earlier with Exacq, and yes, failed. Firmware 5.80.1.2

Here's exactly what I am talking about, shown in this video.

  • 0:00 - Live View - Feedback FOV
  • 0:05 - Latest Firmware shown - 5.7.2
  • 0:13 - Reset All Parameters to Factory Default
  • 0:17 - 01:41 Nothing - (My submission for Bootup shootout)
  • 1:42 - Begin attempt home page retrieval
  • 2:23 - Home page retrieved - requests creation of root password
  • 2:24 - Request Ignored
  • 2:25 - VLC open network stream rtsp://root:pass@192.168.200.10:554/axis-media/media.amp
  • 2:35 Stream opened with default root:pass credential

Maybe 5.8.x is key?

I tried mine with Exacq as well and it also failed with a Camera Connect error 10061.

VLC, on the other hand, still continues to work with root:pass (and only root:pass).

Actually, Exacq wasn't a total failure, even though there is no video (thru Exacq), it lets me add the camera and then lets me see random things like the resolution and the frame rate. Wireshark shows it failing on some VAPIX commands and succeding on others.

So anonymous viewing by default, at least.

Not sure what other VMSes would do, but it doesn't seem likely that this is Axis' intended behavior, would you agree?

Isn't there issues with turning on HTTPS and connecting the camera to a VMS?

Good question, and yes. If the VMS doesn't support login via HTTPS, it will fail to connect. I just forced an Axis Q camera to HTTPS for login and Exacq fails to connect.

Excellent article. We primarily use Axis cameras in our environment so this is very useful information.

Update: Bosch now has a 'data security' / hardening guide out.

Login to read this IPVM report.
Why do I need to log in?
IPVM conducts unique testing and research funded by member's payments enabling us to offer the most independent, accurate and in-depth information.

Related Reports

French Government Threatens School with $1.7M Fine For “Excessive Video Surveillance” on Nov 14, 2018
The French government has notified a high-profile Paris coding academy that it risks a fine of up to 1.5 million euros (about $1.7m) if it...
Magos Radar Company Profile on Nov 12, 2018
Magos America General Manager Yaron Zussman admits when he first came across Magos, he asked himself: "What's innovative about radar?" Be that as...
Axis 2N Intercom Tested on Nov 08, 2018
Axis expanded its video intercom business buying Czech-based 2N in 2016. Despite competing against owner Axis' intercoms, 2N recently registered as...
Dahua Dual Imager Dome Camera Tested (HDBW4231FN-E2-M) on Nov 07, 2018
Dahua has introduced a dual-imager dome model, the HDBW4231FN-E2-M, with two independently positionable sensors including integrated IR, not found...
Avigilon Opens Up Analytics And Cameras on Nov 06, 2018
Avigilon is opening up. The company historically famous for advocating its own end-to-end solutions and making it harder for 3rd parties to...
Winter 2019 IP Networking Course on Nov 05, 2018
This is the only networking course designed specifically for video surveillance professionals.  Lots of network training exists but none of it...
HID: Stop Selling Cracked 125 kHz Credentials on Nov 05, 2018
HID should stop selling cracked 125 kHz access control credentials, that have been long cracked and can easily be copied by cheap cloners sold on...
Worst Products on Nov 03, 2018
Security integrators periodically report on their favorite and worst products to IPVM. These are known integrators who IPVM pays to answer surveys....
Solar-Powered, Smart-Phone-Based Access Kit (VIZPin) Examined on Nov 02, 2018
Cloud-based access control company VIZPin is releasing a solar-powered and smart phone based access control system for gates and other remote...
Video Surveillance Hard Drive Failure Statistics 2018 on Nov 02, 2018
Hard drive failures can be significant service problems but how common of an issue are they in video surveillance? How long do drives last when...

Most Recent Industry Reports

'Sticker' Surveillance Camera Developed (CSEM Witness) on Nov 16, 2018
The Swiss Center for Electronics and Microtechnology (CSEM) has announced what it calls the: world’s first fully autonomous camera that can be...
ISC East 2018 Mini-Show Final Report on Nov 16, 2018
This is our second (updated) and final show report from ISC East. ISC East, by its own admission, is not a national or international show, billed...
Facial Detection Tested on Nov 16, 2018
Facial detection and recognition are increasingly offered by video surveillance manufacturers. Facial detection detects faces in an image/video...
Throughtek P2P/Cloud Solution Profile on Nov 15, 2018
Many IoT manufacturers either do not have the capabilities or the interest to develop their own cloud management software for their devices....
ASIS Offering Custom Research For Manufacturers on Nov 15, 2018
Manufacturers often want to know what industry people think about trends and, in particular, the segments and product they offer.  ASIS and its...
Hikvision Silent on "Bad Architectural Practices" Cybersecurity Report on Nov 14, 2018
A 'significant vulnerability was found in Hikvision cameras' by VDOO, a startup cybersecurity specialist. Hikvision has fixed the specific...
French Government Threatens School with $1.7M Fine For “Excessive Video Surveillance” on Nov 14, 2018
The French government has notified a high-profile Paris coding academy that it risks a fine of up to 1.5 million euros (about $1.7m) if it...
Integrator Credit Card Alternative Divvy on Nov 13, 2018
Most security integrators are small businesses but large enough that they have various employees that need to be able to expense various charges as...
Directory of Video Intercoms on Nov 13, 2018
Video Intercoms, also known as Video Door-Phones or Video Entry Systems, have been growing in the past decade as more and more IP camera...
Beware Amazon Go Store Hype (Tested) on Nov 13, 2018
IPVM's trip to and testing of Amazon Go's San Francisco store shows a number of significant operational and economic issues that undermine the...

The world's leading video surveillance information source, IPVM provides the best reporting, testing and training for 10,000+ members globally. Dedicated to independent and objective information, we uniquely refuse any and all advertisements, sponsorship and consulting from manufacturers.

About | FAQ | Contact