China DVR/NVR Backdoor Discovered, Huawei Refutes

By: Sean Patton and John Scanlan, Published on Feb 07, 2020

A backdoor was found in Chinese-produced DVRs and NVRs that secretly allowed access to the recorders. While it was first attributed to Huawei (HiSilicon), Huawei subsequently refuted their involvement.

Inside this report, we explain:

  • How the backdoor works
  • Who the backdoor impacts and who it does not
  • Why it is a concern
  • But why it is unlikely to be widely exploited
  • How Huawei refuted it
  • The claimed source of the backdoor
  • Risks for other recorders to be exploited

How the Backdoor Works

The backdoor uses port knocking via the management port of vulnerable equipment. A series of commands are sent to the device via the management port, TCP 9530, which in turn opens telnet. When telnet is enabled the attacker can use one of six hardcoded root credentials to gain full control of the vulnerable device.

The skill level needed to exploit this is low and similar to the skill level needed to exploit the Dahua Wiretapping Vulnerability from last year, requiring a limited working knowledge of python. A proof of concept is available here, which is used to:

  • Send a command to open Telnet on the target device (OpenTelnet:OpenOnce)
  • Use a pre-shared key for access (2wj9fsa2)
  • Receive an 8 character number / respond with that number + PSK
  • Open a Telnet session with the device
  • Login with 1 of 6 hardcoded root accounts

Major Chinese Manufacturer Impact Unlikely

Major China manufacturers like Dahua, Hikvision, Uniview are not impacted, from everything we have seen. We executed the proof of concept code from the disclosure on multiple devices and were unable to gain access using the backdoor.

Who The Backdoor Impacts - Mostly Small OEM Manufacturer

The backdoor primarily impacts devices using HiSilicon SOC with Xiongmai software, which is dozens of small OEM manufacturers, using minimally modified OEM firmware, Open Source OS and drivers, and enabling telnet on port 9530.

Get Notified of Video Surveillance Breaking News
Get Notified of Video Surveillance Breaking News

Why It Is A Concern

There is no doubt that whoever put this in did this on purpose since such an obscure series of steps leading to gain control of the device could not be placed on accident, which is a significant trust issue.

Backdoor access allows the devices to be compromised and used within botnets, which is what was seen with Mirai. These vulnerable devices may cause severe disruption to not only specific targets but entire regions or even nations.

Unlikely Widely Exploited

However, the backdoor requires equipment using a Hisilicon SoC, Xiongmai firmware, and port 9530 open. This configuration is less likely to accidentally happen because those ports are not required for external viewing of cameras.

IPVM spoke with the researcher, Vladislov Yarmak, who told us that there are likely hundreds of thousands but less than a million affected devices publicly available online adding that it will be difficult to locate these using sites like shodan.

How Huawei Refuted It

Huawei issued a detailed refutation: Security Notice - Technical Analysis Report on the Suspected Security Issue of HiSilicon Video Surveillance Chips Reported by Some Media

In the release, Huawei says that the vulnerability source is not their chips or SDK, explaining the while their SDK contains Telnet interfaces, they are disabled by default (as of 2017) and they advise SDK developers to delete Telnet unless needed:

SDK versions contains development and debugging interfaces commonly used in the industry, for example, the serial port, Telnet, and JTAG interfaces,... ....Telnet is disabled by default, and there is no default user password. In addition, HiSilicon provides the Cyber Security Precautions for Secondary Development to equipment vendors along with the software package. The Cyber Security Precautions for Secondary Development strongly advises customers to delete the Telnet function and other functions concerning risky services..

Additionally, Huawei declared that they will never place backdoors, or allow anyone else to:

Huawei (and its affiliates worldwide, including HiSilicon) has long committed that it has not and will never place backdoors nor allow anyone else to do so.

Claimed Source Of The Backdoor

The claimed source is XiongMai, also known as XM. XM is famous for the 2017 Mirai botnet attacks and has a very poor track record:

Despite this poor track record, XiongMai is not banned in the US, and has a long list of (generally smaller, lower-end) OEM customers:

However, most companies are not commonly sold in Western commercial installations, and this will directly impact the lowest of low budget consumers.

Risks For Others

Still many recorders require the opening of a control port for remote viewing / operation. Other manufacturers could implement similar backdoors unbeknownst to users.

While companies like Bosch, Genetec, and Milestone self-disclose and patch vulnerabilities it is uncommon for Chinese manufacturers to do so. Some even deny the vulnerabilities or try to explain away hardcoded backdoors. Unless security researchers discover and disclose other manufacturers' backdoors equipment will remain vulnerable.

To see how other vulnerabilities have affected the security industry check out IPVM's Directory of Video Surveillance Cybersecurity Vulnerabilities and Exploits.

1 report cite this report:

Directory of Video Surveillance Cybersecurity Vulnerabilities and Exploits on May 02, 2018
This list compiles reported exploits for security products, and is updated regularly. We have summarized exploits by date and by manufacturer,...
Comments (14) : Members only. Login. or Join.

Most Recent Industry Reports

Masks Cause Major Facial Recognition Problems on Feb 24, 2020
Coronavirus is spurring an increase in the use of medical masks, which new IPVM test results show cause major problems for facial recognition...
Every VMS Will Become a VSaaS on Feb 21, 2020
VMS is ending. Soon every VMS will be a VSaaS. Competitive dynamics will be redrawn. What does this mean? VMS Historically...
Video Surveillance 101 Course - Last Chance on Feb 20, 2020
This is the last chance to join IPVM's first Video Surveillance 101 course, designed to help those new to the industry to quickly understand the...
Vulnerability Directory For Access Credentials on Feb 20, 2020
Knowing which access credentials are insecure can be difficult to see, especially because most look and feel the same. Even insecure 125 kHz...
AI/Smart Camera Tutorial on Feb 20, 2020
Cameras with video analytics, sometimes called 'Smart' camera or 'AI' cameras, etc. are one of the most promising growth areas of video...
China Manufacturer Suffers Coronavirus Scare on Feb 20, 2020
Uniview suffered a significant health scare last week after one of its employees reported a fever and initially tested positive for coronavirus....
Cheap Camera Problems at Night on Feb 19, 2020
Cheap cameras generally have problems at night, despite the common perception that integrated IR makes cameras mostly the same, according to new...
Milestone Launches Multiple Cloud Solutions on Feb 18, 2020
Milestone is going to the cloud, becoming one of the last prominent VMSes to do so. Milestone is clearly late but how competitive do these new...
Video Surveillance Architecture 101 on Feb 18, 2020
Video surveillance can be designed and deployed in a number of ways. This 101 examines the most common options and architectures used in...
UK Stands Behind Hikvision But Controversy Continues on Feb 18, 2020
Hikvision is exhibiting at a UK government conference for law enforcement, provoking controversy from the press, politicians, and activists due to...