China DVR/NVR Backdoor Discovered, Huawei Refutes

By: Sean Patton and John Scanlan, Published on Feb 07, 2020

A backdoor was found in Chinese-produced DVRs and NVRs that secretly allowed access to the recorders. While it was first attributed to Huawei (HiSilicon), Huawei subsequently refuted their involvement.

Inside this report, we explain:

  • How the backdoor works
  • Who the backdoor impacts and who it does not
  • Why it is a concern
  • But why it is unlikely to be widely exploited
  • How Huawei refuted it
  • The claimed source of the backdoor
  • Risks for other recorders to be exploited

How the Backdoor Works

The backdoor uses port knocking via the management port of vulnerable equipment. A series of commands are sent to the device via the management port, TCP 9530, which in turn opens telnet. When telnet is enabled the attacker can use one of six hardcoded root credentials to gain full control of the vulnerable device.

The skill level needed to exploit this is low and similar to the skill level needed to exploit the Dahua Wiretapping Vulnerability from last year, requiring a limited working knowledge of python. A proof of concept is available here, which is used to:

  • Send a command to open Telnet on the target device (OpenTelnet:OpenOnce)
  • Use a pre-shared key for access (2wj9fsa2)
  • Receive an 8 character number / respond with that number + PSK
  • Open a Telnet session with the device
  • Login with 1 of 6 hardcoded root accounts

Major Chinese Manufacturer Impact Unlikely

Major China manufacturers like Dahua, Hikvision, Uniview are not impacted, from everything we have seen. We executed the proof of concept code from the disclosure on multiple devices and were unable to gain access using the backdoor.

Who The Backdoor Impacts - Mostly Small OEM Manufacturer

The backdoor primarily impacts devices using HiSilicon SOC with Xiongmai software, which is dozens of small OEM manufacturers, using minimally modified OEM firmware, Open Source OS and drivers, and enabling telnet on port 9530.

Get Notified of Video Surveillance Breaking News
Get Notified of Video Surveillance Breaking News

Why It Is A Concern

There is no doubt that whoever put this in did this on purpose since such an obscure series of steps leading to gain control of the device could not be placed on accident, which is a significant trust issue.

Backdoor access allows the devices to be compromised and used within botnets, which is what was seen with Mirai. These vulnerable devices may cause severe disruption to not only specific targets but entire regions or even nations.

Unlikely Widely Exploited

However, the backdoor requires equipment using a Hisilicon SoC, Xiongmai firmware, and port 9530 open. This configuration is less likely to accidentally happen because those ports are not required for external viewing of cameras.

IPVM spoke with the researcher, Vladislov Yarmak, who told us that there are likely hundreds of thousands but less than a million affected devices publicly available online adding that it will be difficult to locate these using sites like shodan.

How Huawei Refuted It

Huawei issued a detailed refutation: Security Notice - Technical Analysis Report on the Suspected Security Issue of HiSilicon Video Surveillance Chips Reported by Some Media

In the release, Huawei says that the vulnerability source is not their chips or SDK, explaining the while their SDK contains Telnet interfaces, they are disabled by default (as of 2017) and they advise SDK developers to delete Telnet unless needed:

SDK versions contains development and debugging interfaces commonly used in the industry, for example, the serial port, Telnet, and JTAG interfaces,... ....Telnet is disabled by default, and there is no default user password. In addition, HiSilicon provides the Cyber Security Precautions for Secondary Development to equipment vendors along with the software package. The Cyber Security Precautions for Secondary Development strongly advises customers to delete the Telnet function and other functions concerning risky services..

Additionally, Huawei declared that they will never place backdoors, or allow anyone else to:

Huawei (and its affiliates worldwide, including HiSilicon) has long committed that it has not and will never place backdoors nor allow anyone else to do so.

Claimed Source Of The Backdoor

The claimed source is XiongMai, also known as XM. XM is famous for the 2017 Mirai botnet attacks and has a very poor track record:

Despite this poor track record, XiongMai is not banned in the US, and has a long list of (generally smaller, lower-end) OEM customers:

However, most companies are not commonly sold in Western commercial installations, and this will directly impact the lowest of low budget consumers.

Risks For Others

Still many recorders require the opening of a control port for remote viewing / operation. Other manufacturers could implement similar backdoors unbeknownst to users.

While companies like Bosch, Genetec, and Milestone self-disclose and patch vulnerabilities it is uncommon for Chinese manufacturers to do so. Some even deny the vulnerabilities or try to explain away hardcoded backdoors. Unless security researchers discover and disclose other manufacturers' backdoors equipment will remain vulnerable.

To see how other vulnerabilities have affected the security industry check out IPVM's Directory of Video Surveillance Cybersecurity Vulnerabilities and Exploits.

2 reports cite this report:

Remote Network Access for Video Surveillance Guide on Jul 27, 2020
Remotely accessing surveillance systems is key in 2020, with more and more...
Directory of Video Surveillance Cybersecurity Vulnerabilities and Exploits on May 02, 2018
This list compiles reported exploits for security products, and is updated...
Comments (15) : Members only. Login. or Join.

Related Reports

Panasonic i-PRO Hid Huawei, Does Damage Control on Aug 21, 2020
Panasonic i-PRO hid their usage of Huawei from the public, continues to...
NDAA Compliant Video Surveillance Whitelist on Aug 10, 2020
This report aggregates video surveillance products that manufacturers have...
Forced Door Alarms For Access Control Tutorial on Aug 17, 2020
One of the most important access control alarms is also often ignored....
Drain Wire For Access Control Reader Tutorial on Sep 23, 2020
An easy-to-miss cabling specification plays a key role in access control, yet...
Honeywell Warns of Huawei, Advocates Futureproofing on Aug 31, 2020
For years, Honeywell has profited from OEMing Dahua and using Huawei...
Keypads For Access Control Tutorial on Jul 28, 2020
Keypad readers present huge risks to even the best access systems. If...
HID Releases VertX Replacement Aero on Aug 10, 2020
HID is replacing two established and broadly supported types of access...
False: Verkada: "If You Want To Remote View Your Cameras You Need To Punch Holes In Your Firewall" on Jul 31, 2020
Verkada falsely declared to “3,000+ customers”, “300 school districts”, and...
Dahua Critical Cloud Vulnerabilities on May 12, 2020
Dahua has acknowledged a series of cloud vulnerabilities that researcher...
The Insecure Verkada Access Control System on Jun 25, 2020
While Verkada touts the security of its system and that how their new door...
Verkada Falsely Claims "First Native Cloud-based Access Control and Video Security Solution" on Jun 18, 2020
Verkada's false claims continue, this time to be the first native cloud-based...
Exit Devices For Access Control Tutorial on Aug 25, 2020
Exit Devices, also called 'Panic Bars' or 'Crash Bars' are required by safety...
AHJ / Authority Having Jurisdiction Tutorial on Aug 06, 2020
One of the most powerful yet often underappreciated characters in all...
Face Masks Increase Face Recognition Errors Says NIST on Aug 04, 2020
COVID-19 has led to widespread facemask use, which as IPVM testing has shown...
Huawei HiSilicon Production Shut Down on Sep 17, 2020
Huawei HiSilicon chips are no longer being manufactured or supplied to...

Recent Reports

OnTech Smart Services Partners With Google and Amazon To Compete With Integrators on Sep 25, 2020
A pain point for many homeowners to use consumer security and surveillance is...
The Future of Metalens For Video Surveillance Cameras - MIT / UMass / Immervision on Sep 25, 2020
Panoramic cameras using 'fisheye' lens have become commonplace in video...
Hikvision Sues Over Brazilian Airport Loss on Sep 24, 2020
Hikvision was excluded from a Brazilian airport project because it is owned...
China General Chamber of Commerce Calls Out US Politics on Sep 24, 2020
While US-China relations at an all-time low, optimism about relations...
Verkada Disruptive Embedded Live Help on Sep 24, 2020
Call up your integrator? Have someone come by the next day? Verkada is...
IP Networking Course Fall 2020 - Last Chance - Register Now on Sep 23, 2020
Today is the last chance to register for the only IP networking course...
Drain Wire For Access Control Reader Tutorial on Sep 23, 2020
An easy-to-miss cabling specification plays a key role in access control, yet...
Norway Council of Ethics Finds Hikvision Human Rights Abuses "Ongoing" on Sep 23, 2020
Hikvision's involvement in "serious human rights abuse" in Xinjiang is...
IPVM Camera Calculator User Manual / Guide on Sep 23, 2020
Learn how to use the IPVM Camera Calculator (updated for Version 3.1). The...
Installation Course Fall 2020 - Save $50 - Last Chance on Sep 22, 2020
This is a unique installation course in a market where little practical...
SimpliSafe Business Security Launched Examined on Sep 22, 2020
SimpliSafe has launched "SimpliSafe Business Security" that the company...
FLIR CEO: Many New Fever Entrants "Making Claims That The Science Just Won't Support" on Sep 22, 2020
FLIR's CEO joins a growing number calling out risks with fever / screening...
China Bems Temperature Measurement Terminal Tested on Sep 22, 2020
Guangzhou Bems (brand Benshi) is the manufacturer behind temperature...
Axis Exports To China Police Criticized By Amnesty International on Sep 21, 2020
Axis Communications and other EU surveillance providers are under fire from...
Milestone XProtect on AWS Tested on Sep 21, 2020
Milestone finally launched multiple cloud solutions in 2020, taking a...