China Hacks Video Servers Causing Uproar

Author: IPVM Team, Published on Oct 05, 2018

An incident causing an international uproar is hitting home in the video surveillance industry as a Bloomberg report, "The Big Hack: How China Used a Tiny Chip to Infiltrate U.S. Companies", uncovers how hacks, attributed to the Chinese government's People’s Liberation Army, targeted numerous US companies. Bloomberg describes how the hacks were discovered from an impacted video streaming server:

Elemental’s main product: the expensive servers that customers installed in their networks to handle the video compression. These servers were assembled for Elemental by Super Micro Computer Inc., a San Jose-based company

Nested on the servers’ motherboards, the testers found a tiny microchip, not much bigger than a grain of rice, that wasn’t part of the boards’ original design.

investigators determined that the chips allowed the attackers to create a stealth doorway into any network that included the altered machines. Multiple people familiar with the matter say investigators found that the chips had been inserted at factories run by manufacturing subcontractors in China.

the servers have been used inside Department of Defense data centers to process drone and surveillance-camera footage, on Navy warships to transmit feeds of airborne missions, and inside government buildings to enable secure videoconferencing. NASA, both houses of Congress, and the Department of Homeland Security have also been customers. TThis ha

This reaction to this report, especially in the US, has been significant and severe with it further undermining trust with China and Chinese manufacturing.

Inside this note, we examine:

  • Video surveillance significance
  • Dahua and Hikvision impact
  • Chinese manufacturing impact - shift supply chain out of China
  • Huawei / Hisilicon impact
  • The risk for video surveillance users
  • US Government opposition to the PRC

Video Surveillance Significant

Within the industry, some dismiss hacking risks. The joke, often stated, "Hey, if the Chinese government wants to see me in my underwear, go for it!" This hack underscores that video is not that target but is a useful entry point. The video was irrelevant, they cared that the device would be put on-site and therefore be used as a means to access data from other devices (laptops, servers, etc.) inside those networks. And for those who respond with the airgap counter (which most customers do not want), even doing that, this emphasizes that any mistake or any future configuration change exposes them to such hacks.

Get Video Surveillance News In Your Inbox
Get Video Surveillance News In Your Inbox

Dahua and Hikvision Impact

On the positive side for Dahua and Hikvision, recently banned for US government usage, the hacks did not include their products. Indeed, it impacted an American / Taiwanese company, who was manufacturing their products inside of China. To that end, Dahua and Hikvision can argue that not only does the Chinese government not need to hack (or backdoor) their products, they can simply and better do that to US companies that manufacturer inside of China.

On the negative side for Dahua and Hikvision, there may very well be similar hardware or software hacks included inside their products that simply have not been either found or disclosed. For example, last year's backdoors found in both manufacturer's products were brushed aside by the companies as coding errors but, in the light of this new information, it is reasonable to imagine why they would be more than that. Indeed, even if Dahua and Hikvision somehow did not want to 'cooperate', they would have no feasible way to overrule the Chinese army inside an authoritarian government.

Chinese Manufacturing Impact - Shift Supply Chain Out of China

The impact of Western companies manufacturing in China will likely be severe, further incenting moving supply chains out of China. This hack hit various government and private companies, even when those organizations were not buying from Chinese manufacturers.

The combination of tariffs and now this issue makes manufacturing in China both more expensive and far more risky for US buyers. Given the attention this has drawn, we expect significantly greater attention paid to not only whether the manufacturer is from China but what, if anything, for those products have been made or assembled inside of China.

Huawei / Hisilcon Impact

Not implicated in this hack but likely to emerge as a major issue soon is that the core hardware / software in most of world's IP cameras are designed, controlled and supplied by a division of Huawei, Hisilicon. This chip is an ideal place to embed a backdoor as it is so widely used and so minimally examined. As users more carefully examine sourcing, this may become a key concern.

Risk For Video Surveillance Users

Specifically for this hack, it impacts products using SuperMicro motherboards. Unfortunately, for video surveillance, SuperMicro is widely used in video surveillance recorders, almost always undisclosed. While the company's overall brand recognition (until now) has been minimal, it has long specialized in being a key low-cost supplier for buyers wanting cheaper servers.

IPVM is looking to assemble a list of products that use SuperMicro and will update as we determine. Anyone with information, please share in the comments or email us at info@ipvm.com

US Government Opposition To The PRC

With this news comes increasing US government opposition to the PRC, with the US Vice President stating:

The American people deserve to know that, as we speak, Beijing is employing a whole-of-government approach, using political, economic, and military tools, as well as propaganda, to advance its influence and benefit its interests in the United States.

This is consistent with what the US FBI and Counterintelligence heads have said this year.

Similarly, the US head of the National Security Council stated:

The Chinese efforts to threaten us in cyberspace and across the information technology spectrum are a very high priority for us -- countering them, establishing structures of deterrence to prevent China from even thinking about doing it, touches on the offensive cyber operations that the president has authorized

Denials and Counters

A number of companies have denied or at least criticized Bloomberg's findings. The Chinese government did not deny this hack happened but emphasized that they too were victims, declaring:

Supply chain safety in cyberspace is an issue of common concern, and China is also a victim.

Bloomber, however, explained its thorough sourcing:

The companies’ denials are countered by six current and former senior national security officials, who—in conversations that began during the Obama administration and continued under the Trump administration—detailed the discovery of the chips and the government’s investigation. One of those officials and two people inside AWS provided extensive information on how the attack played out at Elemental and Amazon; the official and one of the insiders also described Amazon’s cooperation with the government investigation. In addition to the three Apple insiders, four of the six U.S. officials confirmed that Apple was a victim. In all, 17 people confirmed the manipulation of Supermicro’s hardware and other elements of the attacks. The sources were granted anonymity because of the sensitive, and in some cases classified, nature of the information.

Update 1: US DHS Responds

The US Department of Homeland Security has posted a response:

at this time we have no reason to doubt the statements from the companies named in the story.

Though it qualifies with 'at this time', it is currently endorsing the denials from Amazon, Apple, and Supermicro. The DHS statement goes on to defend its own track record noting:

Information and communications technology supply chain security is core to DHS’s cybersecurity mission and we are committed to the security and integrity of the technology on which Americans and others around the world increasingly rely.

Update 2: Bloomberg Responds to US DHS

Now, Bloomberg has released an article about the US DHS statement, retorting:

DHS may not be involved in such inquiries, several people familiar with them said.

Bloomberg did not identify who those 'people familiar' with 'such inquiries' were.

Comments (126) : PRO Members only. Login. or Join.

Related Reports

Imperial Capital Security Investor Conference 2018 Review - ADT, Resideo, Alarm.com, Arlo, Eagle Eye, ACRE, More on Dec 14, 2018
Imperial Capital Security Investor Conference is an event matching industry executives with financiers that frequently leads to future funding...
Huawei Hisilicon Quietly Powering Tens of Millions of Western IoT Devices on Dec 12, 2018
Huawei Hisilicon chips are powering, at least, tens of millions of Western IoT devices, such as IP cameras and surveillance recorders, a fact that...
Infinova's Xinjiang Business Examined on Dec 07, 2018
As pressure mounts for companies to stop doing business in China’s Xinjiang region amid a severe human rights crisis, IPVM has found Infinova sold...
Dahua Car Startup Raises $290 Million But Questions Abound on Dec 03, 2018
Dahua’s electronic car startup LeapMotor raised $290 million in funding this year, it said in an announcement. However, this news raises questions...
Evidence of Dahua's Involvement In Xinjiang Surveillance on Nov 28, 2018
IPVM adds new details about Dahua’s activities in Xinjiang, a Chinese region where mass surveillance used to facilitate grave human rights...
No GDPR Penalties For UK Swann 'Spying Hack' on Nov 20, 2018
The UK’s data protection agency has closed its investigation into Infinova-owned Swann Security UK, the ICO confirmed to IPVM, deciding to take “no...
Pressure Mounts Against Dahua and Hikvision Xinjiang Business on Nov 19, 2018
Pressure is mounting against Hikvision, Dahua, and other companies operating in Xinjiang as an international outcry brews against the Chinese...
Directory of Video Intercoms on Nov 13, 2018
Video Intercoms, also known as Video Door-Phones or Video Entry Systems, have been growing in the past decade as more and more IP camera...
Chinese Government Increases Hikvision Ownership on Nov 12, 2018
The Chinese government - Hikvision's controlling shareholder - is increasing its ownership of the video surveillance giant amid sharp stock price...
Directory Of Video Doorbells on Nov 06, 2018
Video doorbells are one of the fastest growing categories in video surveillance, especially among residences. The optimal placement of these...

Most Recent Industry Reports

Imperial Capital Security Investor Conference 2018 Review - ADT, Resideo, Alarm.com, Arlo, Eagle Eye, ACRE, More on Dec 14, 2018
Imperial Capital Security Investor Conference is an event matching industry executives with financiers that frequently leads to future funding...
Cisco Meraki New Cameras and AI Analytics on Dec 14, 2018
Meraki has released their second generation of video surveillance with 3 new cameras, AI-based video analytics, and 2 cloud-based storage...
Foolish Strategy: OEMing Facial Recognition on Dec 13, 2018
Almost as 'hot' as face recognition marketing right now is OEMing facial recognition. Last year, they were a who's who of company's with...
DVR Examiner - Video Recovery from Recorder Hard Drives on Dec 13, 2018
Bypassing passwords and long download times on-site, DVR Examiner collects and organizes video evidence directly from a hard drive extracted from...
2019 Access Control Book Released on Dec 12, 2018
This is the best, most comprehensive access control book in the world, based on our unprecedented research and testing has been significantly...
Huawei Hisilicon Quietly Powering Tens of Millions of Western IoT Devices on Dec 12, 2018
Huawei Hisilicon chips are powering, at least, tens of millions of Western IoT devices, such as IP cameras and surveillance recorders, a fact that...
FLIR Launches Body Cameras Unified With VMS (TruWitness) on Dec 11, 2018
While FLIR is best known for their thermal cameras, now they have expanded into body cameras, launching TruWITNESS, a public safety focused body...
Startup Sunflower Labs' Autonomous Drone Security System on Dec 11, 2018
Startup Sunflower Labs is claiming a unique design on a home security system, combining autonomous drones and 'Sunflower' sensors. Imagine an...
The 2019 Video Surveillance Industry Guide on Dec 10, 2018
The 300 page, 2019 Video Surveillance Industry Guide, covers the key events and the future of the video surveillance market, is now available,...
Multi-Factor Access Control Authentication Guide on Dec 10, 2018
Can a stranger use your credentials? One of the oldest problems facing access control is making credentials as easy to use as keys, but restricting...

The world's leading video surveillance information source, IPVM provides the best reporting, testing and training for 10,000+ members globally. Dedicated to independent and objective information, we uniquely refuse any and all advertisements, sponsorship and consulting from manufacturers.

About | FAQ | Contact