Axis Criticizes OEMs: "When You Buy An Axis Camera, An Axis Camera Is What You Get!"

Author: Brian Karas, Published on May 19, 2017

When you buy a Honeywell camera, you likely get a Hikvision, Dahua or some other company's product.

The same goes for easily 100 different 'manufacturers' as we covered in our Dahua OEM directory and Hikvision OEM directory.

Axis is taking aim at this in their cybersecurity training program. Axis highlights the usual weaknesses of default passwords and out of date software, but goes on to describe OEM/ODM products as risky choices for customers concerned about cyber security.

Axis describes their development/manufacturing approach as one where the customer receives a genuine product, implying that products sold under other well-known brands (e.g., Honeywell) may not actually be the engineering effort of those companies:

In this report we analyze Axis' claims of OEM risk.

**** *** *** * ********* ******, *** ****** *** * Hikvision, ***** ** **** ***** *******'* *******.

*** **** **** *** ****** *** ********* '*************' ** ** covered ** ******** *** ********************* *** *********.

**** ** ****** *** ** **** ** ***** ************* ******** program. **** ********** *** ***** ********** ** ******* ********* *** out ** **** ********, *** **** ** ** ******** ***/*** products ** ***** ******* *** ********* ********* ***** ***** ********.

**** ********* ***** ***********/************* ******** ** *** ***** *** ******** receives * ******* *******, ******** **** ******** **** ***** ***** well-known ****** (*.*., *********) *** *** ******** ** *** *********** effort ** ***** *********:

** **** ****** ** ******* ****' ****** ** *** ****.

[***************]

Axis *** ******** **** ******

** **** ** *********** ******** ******* ************* ******(****: ************ ********), **** ********** ********* ***** **** ***/*** *******, where *** ************ ******* *** ******* ***** ***** *** ***** may **** ******* ******* ** ******* ** ******** *****:

**** **** ** ****, *** *******, ***** ******** **** ******************(*** ****** ******) ***** *** ***** ****** ******** ************* *** ********. ***** *********, *** **** ******, ***** ********** ********* ** Dahua ** ****** ******** *** ***** ********, ******* **** ****** to ******* ******** ******** *** ******* ******** *******.

In ***** *********** ********

**** **** ** ** ******* *** ******** ** **-***** ***********, citing **** ******* **** ******* *********** *** ******* ** ******* to ******** ******:

***** ** ** ***** ******** ** **-***** ***********, *** *** least ***** **** * ******* **** ******** *** *** ******** tends ** **********, ** ***** *****, *** ** *** ********. By ********, **** **** **** ****** ** ******* ***** *** software ** '*****' *******, ****** ******** ** ****** *** *** UIs **** / ******* ** *** ****.

No *** ******

*** ********, ******* ********* ********** ** *****, *** **** ***************. Indeed, ********* *** *****, *** '*******' ***** *** ******** **** had ******* ***************, ********* *********. **** *** *** *** ***************, though **** ****** ** *******, *.*.,*** **** **** ******** **************** *** **** ************* ****** ** **** ***************.

Dahua / ********* ******** ****

***** *** ********* ****** ******** ** * *********** ****** ** brands/distributors, ********* ******* ***** ******** ***** (****, *********, **********, *********, among ******)

***** ****:

********* ****:

** **** *****, **** ** ***** ****** **** **** ***** customizations ** ******** ** *** ******* ** ** ********/************. **** can **** ** ********** ****** *** *****/********* **** **** **** a ************* ********* * ******** *****/******, ** ** *** ****** in ******** ******** ****** ******* ** ** ******* *** ******** to ***** *************/************.

Many ***** ******* ****

***** ***** *** ********* ******** ** *** **** ****** ** OEMing, ***** *** ****** ** ***** ************* *** *** ** Western *********, **** ******* **** *** ******** ****** ****** ******* their ********. *** *******, ****** ******* ******* ************ ***'* ****************** ** ********** ***** *** *** *** *** **** **** as **** ** * *** ****** ******.

Benefit *** *** - ***** ****

**** *** *** ***** ***** **** ***** ***** ********* **** what **** *******. *** *******, ******* '*************' *** *** $** or **** *** ***** ***** *** *******, *** **** **** anything ********* **** ****.

**********, ******* **** **** (** ***** ************* ******** ***** *** products **** ** ********, *****, ****, ***.) **** ** ** more ********* *** ********** **************. ****** ********-********* ************* *** ***** be ********* **** *** ***** ******* ** **********, ***** ******* budget-conscious ********* *** ****** ******** ******** *** * ******* **** can ***** * **% ******** *******, ************ ** ** ** from * ********** ***** ****** (***, ****, *********, ***.).

OEM/ODM **** *** ********* ****

****** ******* * ******* ** ***'* **** *** **** ** is ********** ********, ******* *************** **** ***** ** *** "********" product *** ****** ** ** ****** **** ** *** *** versions *** ** **** ********* ** **** ********* *** **** consuming ** *** *****.

Assessing ************* ****

************* ***** *** ********** * ****** ** * ***** *****'* commitment ** *** *****, *** **** * ****** ** *** manufactured *** *******. ********* ** *** **** ********** ** ** "owner-developer" *******, *** *** *** ** *** ***** ************* ***** records. **********, ********* **** ********* **** ********** ** ******* *** OEM/ODM ********, **** ** *** ******* ** ******* ******** **** are ********** **** ** ******** ***************. **** ***** ** *** to ***** ******** ***** **** ******** **** *********, ****** *********** practices, ** * *********** ** ****.

** **** ** ***** ******** ******, **** ******** * **** of ********* ** *** ********* *********:

** *******, ***** *** **** *********, *** *** **** *** of ********* ****** ** ***** ** *** ********* ************/*****, ********** of ******* ******.

Assume ********** ***** ****** *********

** ************ ** ***** ************ ************* *************** *** *************, *************** **** **** ***** ** ******* *****/********* ******, ********* Axis. ***** ****** *** ****** ***** ******** ****** ******* *************** based ****** ** *** ************* ******** ****.

*******, ** ** ***** **** ***** ********, *********, ******** *** risk ** *************** *** ******** ** ********** ** ****.

Comments (46)

"** **** ** ***** ******** ******, **** ******** * **** of ********* ** *** ********* *********:"

** ** **** ******* * ******* **** ****** ***** ********* honestly? ** **** ** ******** *****, ** ***** **** ***** at *** **** ***** ** ***** ** ********* ** *** negative ** **** **** ** ***** ********** * ****.

****, **** ** * **** ********.

** **** *****, **** ****** ***** *********, ** *** ** hard ** ******* * ***** ******, ******* ** ***** ***** be ******* ** *** (*** ******** *** ********) ** **** of *** ****** ***************. *** *** **** **** * ************ that **** *** ********* **** ***** **** ********* ** *** situation, *** * ***** *** ***** ** ****** *** **** never ****** *****.

***** *****, **** *********** **** ******* ****** ** ********* *** reproducible.

** ** **** ******* * ******** **** ****** ***** ********* honestly? ** **** ** ******** *****

** *** **** ********* **** ******* / **********, ***: *** there **** ****** ***-**** ************ **** *******'* ********?

*** ******* **** *** ** ** ********** ** **** **'* hard ** **** ** *** **** *************** ****** *** *** as *** **** ***** *************. ** ** *******, ********* *** changed *** ******* ***** *****/******** ********** **** *** **** ****** of ***** *** *** *** **** **** ******** **** **** which ***** ***** ***** ** ************** *********** *** **'* **** hard ** **** ***** *** ******* **** ***** *** ** particular **** *** ******** ******** ** *************** *****.

** **** *** ***** *** ********* ****** ******** ******, *'* seeing **** **** ***'* **** **** ***** *** ***** *** have *** ** ******* ** ******* *** ******** *** ***** let ***** ********* **** ***** **.

** ***** ** **** ** **** ********* *******, ** *** hand, *** **** ** **** **** **** ** ** **** responsive *** ********* ******* ******** ** ******* **** ***** ** Hikvision ********. *** **** ******** **** ******** ****** *****, **** can **** ***** ** ******** ** ** * ***** **** if ** ***.

********* *** ******* *** ******* ***** *****/******** ********** **** *** past ****** ** ***** *** *** *** **** **** ******** this ****

**** *******. *******:*** ******* ***** ********* ***'* ******** ****

** *** *** **** *** *** ****** **** **** ** unless *** *** ***** ***** ** **** *** *** ****... well **'* ***** **** *** ****....

;)

*** ***** **** **** ** **** ***** ** ***** ******* over *** ***** ******* ************ ******* ** ******* *** *****.

******* ******* ****, **** *** **** ********** *** **** *** obviously ******* *** ******** ** ******* ** *** ***** ************* via ***** ******** ****** ** **** ** ***** ******** **** attempt ** ***** *** **** ******* ** ******* **** ***** manufacturers. **** ***** ** **** **** ******* ***** **** *** losing ****** **** *** ******** **********.

**** *** **** ********* *** ***** ******** **** **** *******?

**** ***'* ******** ********. **** *** ******** *** **** *****, vs **** ** *** ******** ********* **** ***** *** ********* that ****** *****'* ****** ****, ** ** **** ********* ** best.

*** ******* ** **** ******* ** ******* ********** ******** *******. Axis ****** ********** ** * ****** **** ****. ***** *** Hikvision **** ********* ** ****** ******** ***, *** *** ** easily.

** *** ****** **** ** ** * **** *******, ******** makes ** **** ******. **'* *********.

**** ** ***** ***'* ****** **** *** *** ******** ***** 16 ******* *** **** *** *** **** *****. *** **** you ****** ******** ** ***** ** ******* ******, ***** **** this *** *********.

******:)

*'* **** ***, ***** ** ** *** ** ***** *** firmware ** ** *** / ***'* ********* ** *****, **** out ***** ******* *** ***. * **** **** ***** ** hikvision ***** **** ** ***** ***** ******* ******** **** **% of ***** ****.

****'* *** ***% ******* ******. *** *** ***** ***** **** DH ** ******* ******** ** *** ******. ** *****'* ****** who *** *** ** ******. *** *** ***** ** ******** on * **** ** *** **** **.

*** *** ***** ** ******** ** * **** ** *** want **.

**** *** ******** **** ************?

***, ***** ***. ******** ***** ****** ***, *** ***'* ***** of **** ** *** ******. *'** ******* ******* ***-******* *** (General) **** ** ******** ***. *** *** *** **** ***** you **** ** ** ******* **** ** **** ** *** on ******** ******. ** *****'* **** ** **** * **********, maybe ****** *** *** ***** *** ****** ****** ** ** IP ******.

*** ******** **********.

**** ** *** ******** **********?

"*** ***** **** **** ** **** ***** ** ***** ******* over *** ***** ******* ************ ******* ** ******* *** *****." This ** **** **** ** *** *** ******* **** * 'security ******'. ** *** ****** ******** *******, ********** ******** *******, software *** ******* ************, *** ***** *** ******* **** ***** party ******** **** ***** *** **** ***********.

******** **** **** ****** ** ******* *** ********* **** ****.

******** *** *** *****. ******** *** ******* ********* ** *******.

****'* ** **** ****, ****** **** ******* ****** ****** ** undisclosed ***.

*** *** ***?

*** ** ***. **** ***** *** ********** ***** *** * laugh.

******, *'* ******** **** *** *** **** **** ****, ******* name, *** ***** ** **** * **** ******* *** ** never ******** ***** ******** **** ** *** ******!

**** * *****. **** ** **** *** ** ***** ******** with **** ***** ** ** * *********** ********* ** **** or ******** *** ***. * ***** * **** **** *** axis **** **** ********.

******** **** **** ****** ** ******* *** ********* **** ****.

*** *** ***'** ** ****** ** *** ******, *'* ****...

******** *** ******* ********* ** *******.

****'* *** ** **** *** ******. **** **** ** ******** but ******* ******* ****** ** ** ******* *** **************.

**** ******* *** *** ********* **? *** ** *** ******?

* *** ********* *** **** *****. **** *******? *'* ** confused.

********** ** *** *** ******** ******* "*** ***** **** **** is **** ***** ** ***** ******* **** *** ***** ******* manufactured ******* ** ******* *** *****." **** ** ******* *** expulsion. ******* ** * *** *** **** ******* **********.

* *** ******* *** ********* ***** ******** *** ** ***** ethnic ********, *** ** *** ********* **** **** *******.....

**** ****** ******** ******** ** **** ********* ** ******* ***** products. **** ******* *** ******* *********** ** ********, **** ** why ***** ******* ***** **** *** *** **. * ****** several ***** *** ***** ***** *** ****** ** **** *** and ***** ** ******* ** **** *** ** ** ***** and **** ****'* **** ** *********. ** *** **** * years **'** *** **** ********* ** ** *******. ** *** a **** *** ****. ** *** ***** **** **'** ****** with ****** *** ******* ***** *******, ******* ****'** ******* *'** found **** **** **** ********* ** ** *** ******** *** support ** ****** ** *** ********* ** *** ******. * am ** *** ******* ** **** **** ***** ******** ******* a *** ********* ***** *** ******** **** *** ******** ***** own ******* **** ***** ***** **** *********** **** ***** *** normally *****. * ***** ** ******* ***** *** ****'* ** 2 *****.

**** ****** ******** *** **** *** *****. *** *** **** up *** ****** *** ** *** ******** ******?

*'* *** ***** ** ***** *** ***** *** ***** * day ** ******** ** ***** ***** ***** ******* ****. *'** had ****** ** ****** ************* *** *** ********* **** ** our ****** *** ***** ** **** **** **. ** *** time ** **** *** ******* *** * **** ******** **** someone ** ******* ** **** *** ******* **** *** **** us ********** *** ******* ************ ****** *** * *** ***** things, ********* ***** *** ***. ********* * ****** ******* ** Axis ** **** ** ****. **** * ******* ******* ** product ***** * *** ***** ***** ** **** ******.

* ***** **** ** ******** **** *** **** ** ******* for *** ******* **********. * *** ** ***** **** *** Axis ****** ******* ***** * ******** *******. **** ******** *****. I ****** **** ** **** *******, ******** *** ************, *** got * ***** ******* *****. **** **** * ********* ******* of *** ******** *** ******* ********* *** *****. * ********* never **** ******* **** **** *************. **'* ****** **** **** things ** ***** ** ******** **** ** *** ****** **** support *** ****'* **** *** ******** *** **** ** *** a ************'* ******* **. * ***** **** **** *** ********** and ****** **** **** ** *** ****** *'** ***********.

*** **** **** * ***** **** ****** ******* ** ** there ** * *** ******* ** * ****** ******* ******* that *** **** **** ********** ** *** ** ** ***** work *** * ********** ********.

** *** ** ******** ****, * ****** *** ******** **** available.

*'** ***** *** * *** ********** **** **** *******. **** to ***** ** **, *'** *** *** **** *********** **** Axis ******* ** ******* ** ** *****. * ***** **** says *********.

***** *'* ***** ** *** **** **** * **** * relationship **** *** ******* * ** ***** ******** ****. ** hardly **** **** ******* *** *** ** *** ****** ** manufacturers ** *****.

*'* *** ****** **** *****'* **** **** **** ******* (*'** never ****** **), **** **** **** ***** ******* **** ***** companies *** **** ******* ***** ******** *** ******* **** ***** people ** *** ****** ** **** ** *******.

**** *** ********* ** ********, * ****** ** ***** * product ******* ***** ******* **** ******* *****. **** ** **'* a *** *******. * **** ** **** ** *******. *********, Axis *****'* **** **** ** * ***** ***** *****, *** I ***** ******* ** ***** ****'** ****** * *** ** deals ** ********* *** **. * **** ********** **** ********* of ** ******* ***, **** **** ** ** ***** **** Axis. *** **** ** * ******* *** ********* **** ****** up; ***** **** ***** **** ****** **** ********.

* ******* *** ***** ** *** ******* ** **** ** saying **** ***'* ******* ***** *******. ** ***** *** * should **** **** **** ***** ** **** **** ***** ******** allowing ***** ********* ** ******* ***** ******* ** ****'** *** going ** ********** ***** ***** ***** *****. ** ***** ** they *** ** *** *********** ***'* **** ***** ***** ******* they're *** ***** ** **** **.

* ****** ** ***** * ******* ******* ***** ******* **** someone *****. **** ** **'* * *** *******. * **** to **** ** *******.

* ******* ****'* ** ********* *** ****** **** ******** ******* integrators. ** ** **** *** ** *** ****** **** ********* has **** *****. **** **** ***** * *** ** ***** people *** **** **** ********** ** *** **** *** ******* integrators, ** *********** ******.

****, ** ***** ** ******* ** **, ** **** ******* on ****** *********** *** ******* ** ****** *** *****.

** *** **** *** ***** ** **** ************ ** **** enterprise ****. * **** **** **** **** ******* ******** *** our ******* ***** **** ******* ************ **** ******** ** ***** manufacturers. *** *********** *** ***** ******* *** ***** *** ****** all ***** ******* * **** ******. ** ****** **** ** installation, ************* *** ***** ******* *** ***** ******* ***** **** has ******** ************.

***** *** *** ******* ******. *** *** ***** ** **** integrators (**** ** ******) ***** ** *** ** **** ********* ease ** *******, ****, ***. ** ** **** ** **** a ****** ***********.

**** *** **** ********** **** ** ******* *** ** *** Avigilon. **** ******** ***** ****** ************ ************, ***** *** ********* have ****** ** **** * *** ** ***** ***********. * find *** ************ **** ***** *** ************* **** ******** ********** boxes ** **** ** ************. ***** *** *** ***** **** they **** ** ** ****** ********. **** ** ***** ******* KO's *** *** *** **** ** ***** ***** ***** **** 1/2". *** **** ** *** *** ** */*" ********. ********* seems ** *** */*" ** *** ** ***** ********.

* **** ** **** ********* **** * ************ ***** * great ******* *** **** *****'* **** *** ******** ** **** it **** ** ******* ** **** *********.

** ******, ***** *** **** ** ** **** ******* ***** other ************* *** **** ****** ****?

** *** ** * ******** **** **** *** **** ** their ****** **** ********* ************, ** ***** ** *** ****, do **** **** *** *** **** *** ** **** **** hide ** ****** **** ******?

**** **** ********** *********** ******.

**** **** ** *** **** ********************* - *****. * ** *** ***** ** *** ********* product ****** **** ** ***** ******* ** ********* ******** *****.

***.. *** *** ****** **** ********** *********** ** *** *** read *******, *** ************ * ** ********* ** ** * listed ******* ** ****** *** *** *** ****** **** ****** information ** **** ** *** ****** **** + *** ************'* name ** *******. **** ** *** **** *** **** *********, maybe *** *** ****** *********.

*****://************.***/*******/*****/**-%**%**%**%**%**%**(****)-%**%**%**%**%**%**%**%**%**%**%**%**%**%**%**%**%**%**%**%**%**%**%**%**%**%**%**%**%**%**%**%**%**%**%**%**%**%**%**%**%**%**

** ******, ***** **** **** ** *** ** **** **** that ***** ** **** *******, ** **'* *** ******* *** NVR ** ********** ** **** ***** *********** **** *** *** from *** ************, *** ********** * ***'* ******* **....

*********? **** ** **** *** **** ******** *** ************* *********** - *'* *** **** ***** * **** ********** ** ********* above *** ** *** ******** ******* *** ****** ******* ******.

**** **** ** ** ** *** *** ***** ****** **** as ***** *** ****** **** **** ** *** *** ** that ******** **** ***** *** ***** *** ***********.

**** ***********, **** ** ****** *** ********* *** *** ** relabels (**** **** ****** ** *** ********). *** ***** **** camera ******** * ******* ** **** ** ****** ** ********* to. ** ******, **** ** *** **** ********** ** *** camera *** *** ************ ** ****, ****** ***/***, ******* ** how ***** ********** ***** *******. **** **** * **** *** of ****** ********* *** ****** **** *** * **** ************, vs. ***** ******** *************.

***** **** ** * ***** *** * *** **********: **** security ************* **** ***** *** ************* ********** ** **** ****, assemble **********, ******* ******* *******. **** ** ** ******* ** a ******** ******** **** *** **** ******* *** *** *** Brand *, *** **** ****** ****** *** ***** * *** next ***. ** **** * *********** ** ** * *** tier ************, ** **** *** ** ** *** *** ***** order? *** ***** **********/************* ** * ******* ****** ***** *** manufacturing ******** ** ***** ** ******* *****, *******, ***** ** market, ***....???

* ***'* **** **** ***** ** *****, *** ******* **** me **** **** **** ***** ******** ******* *** ************ ** "Asia". ** **** ****? ** ****, ** ** **** * OEM/ODM ** **** ** **** **** **** * ******* *****?

******.

Login to read this IPVM report.
Why do I need to log in?
IPVM conducts unique testing and research funded by member's payments enabling us to offer the most independent, accurate and in-depth information.

Related Reports

Remote Video Monitoring Providers Directory on May 19, 2017
Remote video monitoring can help integrators generate RMR plus end users lower their security costs and/or improve response to critical...
Hackable 125kHz Access Control Migration Guide on May 19, 2017
Despite being one of the most popular credentials, 125 kHz credentials are easily copied and insecure as we showed in our test results, video...
Cisco: Hikvision Hired Us on May 16, 2017
The day after Hikvision's backdoor was confirmed by the US Department of Homeland Security, Hikvision issued a press release about a...
Hikvision Blaming Backdoor On Others, Cannot Hide From DHS on May 11, 2017
Numerous Hikvision employees are blaming their backdoor on others but Hikvision cannot hide from the US Department of Homeland Security. Blaming...
Hikvision Backdoor Confirmed on May 08, 2017
The US Department of Homeland Security's Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) has issued an advisory for...
Hack Your Access Control With This $30 HID 125kHz Card Copier on May 01, 2017
You might have heard the stories or seen the YouTube videos of random people hacking electronic access control systems. The tools that claim to do...
Last Day - IP Networking Course May 2017 on Apr 26, 2017
Today is the last day to register for the May IP Networking Course. This is the only networking course designed specifically for video...
Chinese 'Attacking Us From Every Direction', Says US FBI on Apr 25, 2017
"Chinese eating our lunch. Attacking us from every direction" said the US FBI's Deputy Director Andrew McCabe at the ASIS 2017 CSO Summit. .@FBI...
Hikvision OEM Directory on Apr 17, 2017
Hikvision OEMs for dozens of companies around the world. The following directory includes 50+ companies that OEM some products from Hikvision, with...

Most Recent Industry Reports

Pelco Shutting Down Clovis Line, Laying Off 200 on May 22, 2017
Pelco's Clovis facility once turned out some of the industry's most popular products. Now, the facility is mostly building "obsolete" equipment,...
IP Camera - 15 Year Shootout on May 22, 2017
How far have IP cameras come? We bought and tested 4 cameras across the past 15 years to understand how much and where performance has...
Remote Video Monitoring Providers Directory on May 21, 2017
Remote video monitoring can help integrators generate RMR plus end users lower their security costs and/or improve response to critical...
Axis Criticizes OEMs: "When You Buy An Axis Camera, An Axis Camera Is What You Get!" on May 19, 2017
When you buy a Honeywell camera, you likely get a Hikvision, Dahua or some other company's product. The same goes for easily 100 different...
Hackable 125kHz Access Control Migration Guide on May 19, 2017
Despite being one of the most popular credentials, 125 kHz credentials are easily copied and insecure as we showed in our test results, video...
Forget The Backdoor, "ALL HIKVISION PRODUCTS" On Sale on May 18, 2017
Less than 2 weeks after the Hikvision Backdoor was confirmed, Hikvision has launched a sale "ON ALL HIKVISION PRODUCTS". In this note, we examine...
Amazon Techs Installing IP Cameras Tested on May 18, 2017
In 2015, Amazon started offering video surveillance installation. Now, Amazon has made it a lot easier, with automatic add-on options and...
Hanwha Recorder Vulnerability Analyzed on May 18, 2017
ICS-CERT has released a vulnerability notice for Hanwha SRN-4000 recorders.  Hanwha provided additional information to IPVM about this issue,...
DMP Video Doorbell / Access Reader Examined on May 17, 2017
Consumers increasingly demand video doorbells, with "doorbells selling like hotcakes, everyone wants a doorbell", according to ADT's CEO. At ISC...
ShotSpotter To IPO, Facing Low Revenue and Losses on May 17, 2017
A rare event for North American security manufacturers is upcoming. ShotSpotter is planning to IPO on the NASDAQ, aiming to raise $34.5...

The world's leading video surveillance information source, IPVM provides the best reporting, testing and training for 10,000+ members globally. Dedicated to independent and objective information, we uniquely refuse any and all advertisements, sponsorship and consulting from manufacturers.

About | FAQ | Contact