China Hacks Video Servers Causing Uproar

By: IPVM Team, Published on Oct 05, 2018

An incident causing an international uproar is hitting home in the video surveillance industry as a Bloomberg report, "The Big Hack: How China Used a Tiny Chip to Infiltrate U.S. Companies", uncovers how hacks, attributed to the Chinese government's People’s Liberation Army, targeted numerous US companies. Bloomberg describes how the hacks were discovered from an impacted video streaming server:

Elemental’s main product: the expensive servers that customers installed in their networks to handle the video compression. These servers were assembled for Elemental by Super Micro Computer Inc., a San Jose-based company

Nested on the servers’ motherboards, the testers found a tiny microchip, not much bigger than a grain of rice, that wasn’t part of the boards’ original design.

investigators determined that the chips allowed the attackers to create a stealth doorway into any network that included the altered machines. Multiple people familiar with the matter say investigators found that the chips had been inserted at factories run by manufacturing subcontractors in China.

the servers have been used inside Department of Defense data centers to process drone and surveillance-camera footage, on Navy warships to transmit feeds of airborne missions, and inside government buildings to enable secure videoconferencing. NASA, both houses of Congress, and the Department of Homeland Security have also been customers. TThis ha

This reaction to this report, especially in the US, has been significant and severe with it further undermining trust with China and Chinese manufacturing.

Inside this note, we examine:

  • Video surveillance significance
  • Dahua and Hikvision impact
  • Chinese manufacturing impact - shift supply chain out of China
  • Huawei / Hisilicon impact
  • The risk for video surveillance users
  • US Government opposition to the PRC

Video Surveillance Significant

Within the industry, some dismiss hacking risks. The joke, often stated, "Hey, if the Chinese government wants to see me in my underwear, go for it!" This hack underscores that video is not that target but is a useful entry point. The video was irrelevant, they cared that the device would be put on-site and therefore be used as a means to access data from other devices (laptops, servers, etc.) inside those networks. And for those who respond with the airgap counter (which most customers do not want), even doing that, this emphasizes that any mistake or any future configuration change exposes them to such hacks.

Get Notified of Video Surveillance Breaking News
Get Notified of Video Surveillance Breaking News

Dahua and Hikvision Impact

On the positive side for Dahua and Hikvision, recently banned for US government usage, the hacks did not include their products. Indeed, it impacted an American / Taiwanese company, who was manufacturing their products inside of China. To that end, Dahua and Hikvision can argue that not only does the Chinese government not need to hack (or backdoor) their products, they can simply and better do that to US companies that manufacturer inside of China.

On the negative side for Dahua and Hikvision, there may very well be similar hardware or software hacks included inside their products that simply have not been either found or disclosed. For example, last year's backdoors found in both manufacturer's products were brushed aside by the companies as coding errors but, in the light of this new information, it is reasonable to imagine why they would be more than that. Indeed, even if Dahua and Hikvision somehow did not want to 'cooperate', they would have no feasible way to overrule the Chinese army inside an authoritarian government.

Chinese Manufacturing Impact - Shift Supply Chain Out of China

The impact of Western companies manufacturing in China will likely be severe, further incenting moving supply chains out of China. This hack hit various government and private companies, even when those organizations were not buying from Chinese manufacturers.

The combination of tariffs and now this issue makes manufacturing in China both more expensive and far more risky for US buyers. Given the attention this has drawn, we expect significantly greater attention paid to not only whether the manufacturer is from China but what, if anything, for those products have been made or assembled inside of China.

Huawei / Hisilcon Impact

Not implicated in this hack but likely to emerge as a major issue soon is that the core hardware / software in most of world's IP cameras are designed, controlled and supplied by a division of Huawei, Hisilicon. This chip is an ideal place to embed a backdoor as it is so widely used and so minimally examined. As users more carefully examine sourcing, this may become a key concern.

Risk For Video Surveillance Users

Specifically for this hack, it impacts products using SuperMicro motherboards. Unfortunately, for video surveillance, SuperMicro is widely used in video surveillance recorders, almost always undisclosed. While the company's overall brand recognition (until now) has been minimal, it has long specialized in being a key low-cost supplier for buyers wanting cheaper servers.

IPVM is looking to assemble a list of products that use SuperMicro and will update as we determine. Anyone with information, please share in the comments or email us at info@ipvm.com

US Government Opposition To The PRC

With this news comes increasing US government opposition to the PRC, with the US Vice President stating:

The American people deserve to know that, as we speak, Beijing is employing a whole-of-government approach, using political, economic, and military tools, as well as propaganda, to advance its influence and benefit its interests in the United States.

This is consistent with what the US FBI and Counterintelligence heads have said this year.

Similarly, the US head of the National Security Council stated:

The Chinese efforts to threaten us in cyberspace and across the information technology spectrum are a very high priority for us -- countering them, establishing structures of deterrence to prevent China from even thinking about doing it, touches on the offensive cyber operations that the president has authorized

Denials and Counters

A number of companies have denied or at least criticized Bloomberg's findings. The Chinese government did not deny this hack happened but emphasized that they too were victims, declaring:

Supply chain safety in cyberspace is an issue of common concern, and China is also a victim.

Bloomber, however, explained its thorough sourcing:

The companies’ denials are countered by six current and former senior national security officials, who—in conversations that began during the Obama administration and continued under the Trump administration—detailed the discovery of the chips and the government’s investigation. One of those officials and two people inside AWS provided extensive information on how the attack played out at Elemental and Amazon; the official and one of the insiders also described Amazon’s cooperation with the government investigation. In addition to the three Apple insiders, four of the six U.S. officials confirmed that Apple was a victim. In all, 17 people confirmed the manipulation of Supermicro’s hardware and other elements of the attacks. The sources were granted anonymity because of the sensitive, and in some cases classified, nature of the information.

Update 1: US DHS Responds

The US Department of Homeland Security has posted a response:

at this time we have no reason to doubt the statements from the companies named in the story.

Though it qualifies with 'at this time', it is currently endorsing the denials from Amazon, Apple, and Supermicro. The DHS statement goes on to defend its own track record noting:

Information and communications technology supply chain security is core to DHS’s cybersecurity mission and we are committed to the security and integrity of the technology on which Americans and others around the world increasingly rely.

Update 2: Bloomberg Responds to US DHS

Now, Bloomberg has released an article about the US DHS statement, retorting:

DHS may not be involved in such inquiries, several people familiar with them said.

Bloomberg did not identify who those 'people familiar' with 'such inquiries' were.

1 report cite this report:

BCDVideo Expansion And Switch From HP To Dell Examined on Mar 11, 2019
BCDVideo says they have more than tripled revenue in the past 5 years and are continuing to grow, powered most recently by switching their lead...
Comments (134) : PRO Members only. Login. or Join.

Related Reports

Hikvision Global News Reports Directory on Jul 15, 2019
Hikvision has received the most global news reporting of any video surveillance company, ever, ranging from the WSJ, the Financial Times, Reuters,...
Hikvision's Government Owner Website Blocked To World on Jul 11, 2019
Hikvision's PRC government owner, CETHIK, has had its website blocked outside of China, hiding a major information source proving Hikvision's...
RaySharp Revealed - Major China OEM For Western Consumer Video Surveillance on Jul 02, 2019
RaySharp is mostly unknown, even among people in the video surveillance industry, though it is a major supplier of OEM surveillance equipment such...
2019 Mid-Year Video Surveillance Guide on Jul 01, 2019
IPVM's new 400+ page Mid-Year Industry Guide brings all of these issues and events together in a single resource to read and review. It can be...
China Subway Facial Recognition System Examined on Jun 24, 2019
A China city of 6+ million people has installed facial recognition-enabled gates in subways, allowing commuters to enter stations by simply showing...
IFSEC 2019 Show Report on Jun 19, 2019
The UK's largest trade show, IFSEC, is underway and IPVM has been examining what is new and happening at the show. Inside, we cover: Huawei...
The Scheme Hikvision and China Importers Use To Avoid Tariffs on Jun 17, 2019
Hikvision and numerous China importers are avoiding 25% tariffs by including an SD card slot in their IP cameras to claim they are 'digital still...
NSA Director Keynoting Dahua and Hikvision Sponsored Cybersecurity Conference [Canceled] on Jun 13, 2019
The technical director for the NSA’s Cybersecurity Threat Operations Center will be keynoting a physical security cybersecurity conference that is...
Embattled $400 Million China Funded Philippines Surveillance System Proceeds on Jun 13, 2019
An embattled 12,000 camera surveillance system project that will cost ~$400 million will proceed.  The project contract was awarded, had its...
Dumber Techs, Bad Box Movers, Says Australian Distributor on Jun 10, 2019
Techs today are "dumber" than they used to be, despite better education and training and that makes a typical day "frustrating" for one...

Most Recent Industry Reports

Mobile Access Usage Statistics 2019 on Jul 18, 2019
The ability to use mobile phones as access credentials is one of the biggest trends in a market that historically has been slow in adopting new...
New GDPR Guidelines for Video Surveillance Examined on Jul 18, 2019
The highest-level EU data protection authority has issued a new series of provisional video surveillance guidelines. While GDPR has been in...
Anyvision Aims For 2022 Revenue of $1 Billion on Jul 17, 2019
Only 3 video surveillance manufacturers do a billion dollars or more in annual revenue - Hikvision, Dahua, and Axis. Now, Anyvision plans to join...
HD Analog vs IP Guide on Jul 16, 2019
For years, HD resolution and single cable signal/power were IP camera advantages, with analog cameras limited to much lower resolution and...
How To Troubleshoot Wiegand Reader Problems - Inverted Wiring on Jul 16, 2019
Wiegand is the dominant method of connecting access readers, but problems can arise for installers. In fact, one of the most difficult reader...
ZeroEyes Gun Detection Startup on Jul 16, 2019
A gun detection video analytics startup, ZeroEyes, is being led by a group of 6 former Navy SEALs, aiming to "save lives" by using AI to assist...
Motorola Acquires Watchguard, Adds to Vigilant And Avigilon on Jul 15, 2019
2 years ago, Motorola had no position nor relevancy to video surveillance. Now, they own major video surveillance, LPR and body camera providers...
Hikvision Global News Reports Directory on Jul 15, 2019
Hikvision has received the most global news reporting of any video surveillance company, ever, ranging from the WSJ, the Financial Times, Reuters,...
Vivotek Trend Micro Cyber Security Camera App Tested on Jul 15, 2019
Vivotek and Trend Micro are claiming five million blocked attacks on IP cameras, with their jointly developed app for Vivotek cameras. This new...

The world's leading video surveillance information source, IPVM provides the best reporting, testing and training for 10,000+ members globally. Dedicated to independent and objective information, we uniquely refuse any and all advertisements, sponsorship and consulting from manufacturers.

About | FAQ | Contact