China DVR/NVR Backdoor Discovered, Huawei Refutes

A backdoor was found in Chinese-produced DVRs and NVRs that secretly allowed access to the recorders. While it was first attributed to Huawei (HiSilicon), Huawei subsequently refuted their involvement.

Inside this report, we explain:

• How the backdoor works
• Who the backdoor impacts and who it does not
• Why it is a concern
• But why it is unlikely to be widely exploited
• How Huawei refuted it
• The claimed source of the backdoor
• Risks for other recorders to be exploited

How the Backdoor Works

The backdoor uses port knocking via the management port of vulnerable equipment. A series of commands are sent to the device via the management port, TCP 9530, which in turn opens telnet. When telnet is enabled the attacker can use one of six hardcoded root credentials to gain full control of the vulnerable device.

The skill level needed to exploit this is low and similar to the skill level needed to exploit the Dahua Wiretapping Vulnerability from last year, requiring a limited working knowledge of python. A proof of concept is available here, which is used to:

• Send a command to open Telnet on the target device (OpenTelnet:OpenOnce)
• Use a pre-shared key for access (2wj9fsa2)
• Receive an 8 character number / respond with that number + PSK
• Open a Telnet session with the device
• Login with 1 of 6 hardcoded root accounts

Major Chinese Manufacturer Impact Unlikely

Major China manufacturers like Dahua, Hikvision, Uniview are not impacted, from everything we have seen. We executed the proof of concept code from the disclosure on multiple devices and were unable to gain access using the backdoor.

Who The Backdoor Impacts - Mostly Small OEM Manufacturer

The backdoor primarily impacts devices using HiSilicon SOC with Xiongmai software, which is dozens of small OEM manufacturers, using minimally modified OEM firmware, Open Source OS and drivers, and enabling telnet on port 9530.

Why It Is A Concern

There is no doubt that whoever put this in did this on purpose since such an obscure series of steps leading to gain control of the device could not be placed on accident, which is a significant trust issue.

Backdoor access allows the devices to be compromised and used within botnets, which is what was seen with Mirai. These vulnerable devices may cause severe disruption to not only specific targets but entire regions or even nations.

Unlikely Widely Exploited

However, the backdoor requires equipment using a Hisilicon SoC, Xiongmai firmware, and port 9530 open. This configuration is less likely to accidentally happen because those ports are not required for external viewing of cameras.

IPVM spoke with the researcher, Vladislov Yarmak, who told us that there are likely hundreds of thousands but less than a million affected devices publicly available online adding that it will be difficult to locate these using sites like shodan.

How Huawei Refuted It

Huawei issued a detailed refutation: Security Notice - Technical Analysis Report on the Suspected Security Issue of HiSilicon Video Surveillance Chips Reported by Some Media

In the release, Huawei says that the vulnerability source is not their chips or SDK, explaining the while their SDK contains Telnet interfaces, they are disabled by default (as of 2017) and they advise SDK developers to delete Telnet unless needed:

SDK versions contains development and debugging interfaces commonly used in the industry, for example, the serial port, Telnet, and JTAG interfaces,... ....Telnet is disabled by default, and there is no default user password. In addition, HiSilicon provides the Cyber Security Precautions for Secondary Development to equipment vendors along with the software package. The Cyber Security Precautions for Secondary Development strongly advises customers to delete the Telnet function and other functions concerning risky services..

Additionally, Huawei declared that they will never place backdoors, or allow anyone else to:

Huawei (and its affiliates worldwide, including HiSilicon) has long committed that it has not and will never place backdoors nor allow anyone else to do so.

Claimed Source Of The Backdoor

The claimed source is XiongMai, also known as XM. XM is famous for the 2017 Mirai botnet attacks and has a very poor track record:

• Chinese Company Xiongmai Threatens Legal Action Against Western Accusers
• The Xiongmai Botnet 'Recall' Will Not Work
• Unfixed Critical Vulnerability In Millions of XiongMai Devices Disclosed

Despite this poor track record, XiongMai is not banned in the US, and has a long list of (generally smaller, lower-end) OEM customers:

However, most companies are not commonly sold in Western commercial installations, and this will directly impact the lowest of low budget consumers.

Risks For Others

Still many recorders require the opening of a control port for remote viewing / operation. Other manufacturers could implement similar backdoors unbeknownst to users.

While companies like Bosch, Genetec, and Milestone self-disclose and patch vulnerabilities it is uncommon for Chinese manufacturers to do so. Some even deny the vulnerabilities or try to explain away hardcoded backdoors. Unless security researchers discover and disclose other manufacturers' backdoors equipment will remain vulnerable.

To see how other vulnerabilities have affected the security industry check out IPVM's Directory of Video Surveillance Cybersecurity Vulnerabilities and Exploits.