China Hacks Video Servers Causing Uproar

By: IPVM Team, Published on Oct 05, 2018

An incident causing an international uproar is hitting home in the video surveillance industry as a Bloomberg report, "The Big Hack: How China Used a Tiny Chip to Infiltrate U.S. Companies", uncovers how hacks, attributed to the Chinese government's People’s Liberation Army, targeted numerous US companies. Bloomberg describes how the hacks were discovered from an impacted video streaming server: 

Elemental’s main product: the expensive servers that customers installed in their networks to handle the video compression. These servers were assembled for Elemental by Super Micro Computer Inc., a San Jose-based company

Nested on the servers’ motherboards, the testers found a tiny microchip, not much bigger than a grain of rice, that wasn’t part of the boards’ original design. 

investigators determined that the chips allowed the attackers to create a stealth doorway into any network that included the altered machines. Multiple people familiar with the matter say investigators found that the chips had been inserted at factories run by manufacturing subcontractors in China.

the servers have been used inside Department of Defense data centers to process drone and surveillance-camera footage, on Navy warships to transmit feeds of airborne missions, and inside government buildings to enable secure videoconferencing. NASA, both houses of Congress, and the Department of Homeland Security have also been customers. TThis ha

This reaction to this report, especially in the US, has been significant and severe with it further undermining trust with China and Chinese manufacturing. 

Inside this note, we examine:

  • Video surveillance significance
  • Dahua and Hikvision impact
  • Chinese manufacturing impact - shift supply chain out of China
  • Huawei / Hisilicon impact
  • The risk for video surveillance users
  • US Government opposition to the PRC

Video Surveillance Significant

Within the industry, some dismiss hacking risks. The joke, often stated, "Hey, if the Chinese government wants to see me in my underwear, go for it!" This hack underscores that video is not that target but is a useful entry point. The video was irrelevant, they cared that the device would be put on-site and therefore be used as a means to access data from other devices (laptops, servers, etc.) inside those networks. And for those who respond with the airgap counter (which most customers do not want), even doing that, this emphasizes that any mistake or any future configuration change exposes them to such hacks.

Get Notified of Video Surveillance Breaking News
Get Notified of Video Surveillance Breaking News

Dahua and Hikvision Impact

On the positive side for Dahua and Hikvision, recently banned for US government usage, the hacks did not include their products. Indeed, it impacted an American / Taiwanese company, who was manufacturing their products inside of China. To that end, Dahua and Hikvision can argue that not only does the Chinese government not need to hack (or backdoor) their products, they can simply and better do that to US companies that manufacturer inside of China.

On the negative side for Dahua and Hikvision, there may very well be similar hardware or software hacks included inside their products that simply have not been either found or disclosed. For example, last year's backdoors found in both manufacturer's products were brushed aside by the companies as coding errors but, in the light of this new information, it is reasonable to imagine why they would be more than that. Indeed, even if Dahua and Hikvision somehow did not want to 'cooperate', they would have no feasible way to overrule the Chinese army inside an authoritarian government.

Chinese Manufacturing Impact - Shift Supply Chain Out of China

The impact of Western companies manufacturing in China will likely be severe, further incenting moving supply chains out of China. This hack hit various government and private companies, even when those organizations were not buying from Chinese manufacturers.

The combination of tariffs and now this issue makes manufacturing in China both more expensive and far more risky for US buyers. Given the attention this has drawn, we expect significantly greater attention paid to not only whether the manufacturer is from China but what, if anything, for those products have been made or assembled inside of China.

Huawei / Hisilcon Impact

Not implicated in this hack but likely to emerge as a major issue soon is that the core hardware / software in most of world's IP cameras are designed, controlled and supplied by a division of Huawei, Hisilicon. This chip is an ideal place to embed a backdoor as it is so widely used and so minimally examined. As users more carefully examine sourcing, this may become a key concern.

Risk For Video Surveillance Users

Specifically for this hack, it impacts products using SuperMicro motherboards. Unfortunately, for video surveillance, SuperMicro is widely used in video surveillance recorders, almost always undisclosed. While the company's overall brand recognition (until now) has been minimal, it has long specialized in being a key low-cost supplier for buyers wanting cheaper servers.

IPVM is looking to assemble a list of products that use SuperMicro and will update as we determine. Anyone with information, please share in the comments or email us at info@ipvm.com

US Government Opposition To The PRC

With this news comes increasing US government opposition to the PRC, with the US Vice President stating:

The American people deserve to know that, as we speak, Beijing is employing a whole-of-government approach, using political, economic, and military tools, as well as propaganda, to advance its influence and benefit its interests in the United States.

This is consistent with what the US FBI and Counterintelligence heads have said this year.

Similarly, the US head of the National Security Council stated:

The Chinese efforts to threaten us in cyberspace and across the information technology spectrum are a very high priority for us -- countering them, establishing structures of deterrence to prevent China from even thinking about doing it, touches on the offensive cyber operations that the president has authorized

Denials and Counters

A number of companies have denied or at least criticized Bloomberg's findings. The Chinese government did not deny this hack happened but emphasized that they too were victims, declaring:

Supply chain safety in cyberspace is an issue of common concern, and China is also a victim.

Bloomber, however, explained its thorough sourcing:

The companies’ denials are countered by six current and former senior national security officials, who—in conversations that began during the Obama administration and continued under the Trump administration—detailed the discovery of the chips and the government’s investigation. One of those officials and two people inside AWS provided extensive information on how the attack played out at Elemental and Amazon; the official and one of the insiders also described Amazon’s cooperation with the government investigation. In addition to the three Apple insiders, four of the six U.S. officials confirmed that Apple was a victim. In all, 17 people confirmed the manipulation of Supermicro’s hardware and other elements of the attacks. The sources were granted anonymity because of the sensitive, and in some cases classified, nature of the information.

Update 1: US DHS Responds

The US Department of Homeland Security has posted a response:

at this time we have no reason to doubt the statements from the companies named in the story.

Though it qualifies with 'at this time', it is currently endorsing the denials from Amazon, Apple, and Supermicro. The DHS statement goes on to defend its own track record noting:

Information and communications technology supply chain security is core to DHS’s cybersecurity mission and we are committed to the security and integrity of the technology on which Americans and others around the world increasingly rely.

Update 2: Bloomberg Responds to US DHS

Now, Bloomberg has released an article about the US DHS statement, retorting:

DHS may not be involved in such inquiries, several people familiar with them said.

Bloomberg did not identify who those 'people familiar' with 'such inquiries' were.

1 report cite this report:

BCDVideo Expansion And Switch From HP To Dell Examined on Mar 11, 2019
BCDVideo says they have more than tripled revenue in the past 5 years and...
Comments (136) : Members only. Login. or Join.

Related Reports

PRC Warns Against China Video Surveillance Hacks, Hikvision Targeted on Feb 14, 2020
Hackers are targeting China video surveillance manufacturers and systems,...
China Surveillance Vulnerabilities Being Used To Attack China, Says China on Apr 07, 2020
While China video surveillance vulnerabilities have been much debated in the...
NetApp Presents Hybrid Cloud Video Archive on May 11, 2020
NetApp presented its hybrid S3 cloud video archive at the April 2020 IPVM New...
Cisco Video Surveillance Is Dead, Long Live Cisco Meraki Video Surveillance on Feb 11, 2020
A dozen years ago much of the industry thought that Cisco was destined to...
VSaaS 101 on Mar 25, 2020
Video Surveillance as a Service (VSaaS) is the common industry term for cloud...
Deep Sentinel Presents Crime Response For Business on Jun 11, 2020
Deep Sentinel presented its anti-intrusion and live response for home and...
Uniview Deep Learning Camera Tested on Jul 14, 2020
Uniview's intrusion analytics have performed poorly in our shootouts. Now,...
Video Surveillance History on May 06, 2020
The video surveillance market has changed significantly since 2000, going...
Last Chance - Spring 2020 IP Networking Course - Register Now on May 06, 2020
This is the last chance to register for the only networking course designed...
SenseB4 Presents Cloud Network Device Monitoring on Jun 09, 2020
SenseB4 presented its cybersecurity and network health monitoring products at...
Proxy Raises $42 Million on Mar 17, 2020
Startup Proxy has raised $42 million, an astounding amount for the access...
Camio Presents Coronavirus Social Distancing Analytics on Apr 20, 2020
Camio presented its social distancing analytics for responding to coronavirus...
Density Presents Occupancy Monitoring For Coronavirus Protection on May 22, 2020
Density presented its cloud-based occupancy sensor to deal with Coronavirus...
Surveillance Storage 101 on Mar 23, 2020
This guide teaches the fundamentals of video surveillance...
NetApp Video Surveillance Profile on Mar 09, 2020
NetApp is increasing its efforts in video surveillance and told IPVM...

Recent Reports

SIA Coaches Sellers on NDAA 889B Blacklist Workarounds on Aug 05, 2020
Last month SIA demanded that NDAA 899B "must be delayed". Now that they have...
ADI Returns To Growth, Back To 'Pre-COVID Levels' on Aug 05, 2020
While ADI was hit hard in April, with revenue declining 21%, the company's...
Exposing Fever Tablet Suppliers and 40+ Relabelers on Aug 05, 2020
IPVM has found 40+ USA and EU companies relabeling fever tablets designed,...
Indian Government Restricts PRC Manufacturers From Public Projects on Aug 04, 2020
In a move that mirrors the U.S. government’s ban on Dahua and Hikvision...
Directory of 200 "Fever" Camera Suppliers on Aug 04, 2020
This directory provides a list of "Fever" scanning thermal camera providers...
Face Masks Increase Face Recognition Errors Says NIST on Aug 04, 2020
COVID-19 has led to widespread facemask use, which as IPVM testing has shown...
Dahua Loses Australian Medical Device Approval on Aug 04, 2020
Dahua has cancelled its medical device registration after "discussions" with...
Google Invests in ADT, ADT Stock Soars on Aug 03, 2020
Google has announced a $450 million investment in the Florida-based security...
US Startup Fever Inspect Examined on Aug 03, 2020
Undoubtedly late to fever cameras, this US company, Fever Inspect, led by a...
Motorola Solutions Acquires Pelco on Aug 03, 2020
Motorola Solutions has acquired Pelco, pledging to bring blue back and make...
False: Verkada: "If You Want To Remote View Your Cameras You Need To Punch Holes In Your Firewall" on Jul 31, 2020
Verkada falsely declared to “3,000+ customers”, “300 school districts”, and...
US GSA Explains NDAA 889 Part B Blacklisting on Jul 31, 2020
With the 'Blacklist Clause' going into effect August 13 that bans the US...
Access Control Online Show July 2020 - On-Demand Recording of 45+ Manufacturers Presentations on Jul 30, 2020
The show featured 48 Access Control presentations, all now recorded and...
Face Detection Shootout - Dahua, Hanwha, Hikvision, Uniview, Vivotek on Jul 30, 2020
Face detection analytics are available from a number of manufactures...
Sunell is The First China Manufacturer to Market NDAA Compliance on Jul 30, 2020
Most China manufacturers are going to be impacted by the NDAA 'Blacklist...