China Hacks Video Servers Causing Uproar

Author: IPVM Team, Published on Oct 05, 2018

An incident causing an international uproar is hitting home in the video surveillance industry as a Bloomberg report, "The Big Hack: How China Used a Tiny Chip to Infiltrate U.S. Companies", uncovers how hacks, attributed to the Chinese government's People’s Liberation Army, targeted numerous US companies. Bloomberg describes how the hacks were discovered from an impacted video streaming server:

Elemental’s main product: the expensive servers that customers installed in their networks to handle the video compression. These servers were assembled for Elemental by Super Micro Computer Inc., a San Jose-based company

Nested on the servers’ motherboards, the testers found a tiny microchip, not much bigger than a grain of rice, that wasn’t part of the boards’ original design.

investigators determined that the chips allowed the attackers to create a stealth doorway into any network that included the altered machines. Multiple people familiar with the matter say investigators found that the chips had been inserted at factories run by manufacturing subcontractors in China.

the servers have been used inside Department of Defense data centers to process drone and surveillance-camera footage, on Navy warships to transmit feeds of airborne missions, and inside government buildings to enable secure videoconferencing. NASA, both houses of Congress, and the Department of Homeland Security have also been customers. TThis ha

This reaction to this report, especially in the US, has been significant and severe with it further undermining trust with China and Chinese manufacturing.

Inside this note, we examine:

  • Video surveillance significance
  • Dahua and Hikvision impact
  • Chinese manufacturing impact - shift supply chain out of China
  • Huawei / Hisilicon impact
  • The risk for video surveillance users
  • US Government opposition to the PRC

Video Surveillance Significant

Within the industry, some dismiss hacking risks. The joke, often stated, "Hey, if the Chinese government wants to see me in my underwear, go for it!" This hack underscores that video is not that target but is a useful entry point. The video was irrelevant, they cared that the device would be put on-site and therefore be used as a means to access data from other devices (laptops, servers, etc.) inside those networks. And for those who respond with the airgap counter (which most customers do not want), even doing that, this emphasizes that any mistake or any future configuration change exposes them to such hacks.

Get Video Surveillance News In Your Inbox
Get Video Surveillance News In Your Inbox

Dahua and Hikvision Impact

On the positive side for Dahua and Hikvision, recently banned for US government usage, the hacks did not include their products. Indeed, it impacted an American / Taiwanese company, who was manufacturing their products inside of China. To that end, Dahua and Hikvision can argue that not only does the Chinese government not need to hack (or backdoor) their products, they can simply and better do that to US companies that manufacturer inside of China.

On the negative side for Dahua and Hikvision, there may very well be similar hardware or software hacks included inside their products that simply have not been either found or disclosed. For example, last year's backdoors found in both manufacturer's products were brushed aside by the companies as coding errors but, in the light of this new information, it is reasonable to imagine why they would be more than that. Indeed, even if Dahua and Hikvision somehow did not want to 'cooperate', they would have no feasible way to overrule the Chinese army inside an authoritarian government.

Chinese Manufacturing Impact - Shift Supply Chain Out of China

The impact of Western companies manufacturing in China will likely be severe, further incenting moving supply chains out of China. This hack hit various government and private companies, even when those organizations were not buying from Chinese manufacturers.

The combination of tariffs and now this issue makes manufacturing in China both more expensive and far more risky for US buyers. Given the attention this has drawn, we expect significantly greater attention paid to not only whether the manufacturer is from China but what, if anything, for those products have been made or assembled inside of China.

Huawei / Hisilcon Impact

Not implicated in this hack but likely to emerge as a major issue soon is that the core hardware / software in most of world's IP cameras are designed, controlled and supplied by a division of Huawei, Hisilicon. This chip is an ideal place to embed a backdoor as it is so widely used and so minimally examined. As users more carefully examine sourcing, this may become a key concern.

Risk For Video Surveillance Users

Specifically for this hack, it impacts products using SuperMicro motherboards. Unfortunately, for video surveillance, SuperMicro is widely used in video surveillance recorders, almost always undisclosed. While the company's overall brand recognition (until now) has been minimal, it has long specialized in being a key low-cost supplier for buyers wanting cheaper servers.

IPVM is looking to assemble a list of products that use SuperMicro and will update as we determine. Anyone with information, please share in the comments or email us at info@ipvm.com

US Government Opposition To The PRC

With this news comes increasing US government opposition to the PRC, with the US Vice President stating:

The American people deserve to know that, as we speak, Beijing is employing a whole-of-government approach, using political, economic, and military tools, as well as propaganda, to advance its influence and benefit its interests in the United States.

This is consistent with what the US FBI and Counterintelligence heads have said this year.

Similarly, the US head of the National Security Council stated:

The Chinese efforts to threaten us in cyberspace and across the information technology spectrum are a very high priority for us -- countering them, establishing structures of deterrence to prevent China from even thinking about doing it, touches on the offensive cyber operations that the president has authorized

Denials and Counters

A number of companies have denied or at least criticized Bloomberg's findings. The Chinese government did not deny this hack happened but emphasized that they too were victims, declaring:

Supply chain safety in cyberspace is an issue of common concern, and China is also a victim.

Bloomber, however, explained its thorough sourcing:

The companies’ denials are countered by six current and former senior national security officials, who—in conversations that began during the Obama administration and continued under the Trump administration—detailed the discovery of the chips and the government’s investigation. One of those officials and two people inside AWS provided extensive information on how the attack played out at Elemental and Amazon; the official and one of the insiders also described Amazon’s cooperation with the government investigation. In addition to the three Apple insiders, four of the six U.S. officials confirmed that Apple was a victim. In all, 17 people confirmed the manipulation of Supermicro’s hardware and other elements of the attacks. The sources were granted anonymity because of the sensitive, and in some cases classified, nature of the information.

Update 1: US DHS Responds

The US Department of Homeland Security has posted a response:

at this time we have no reason to doubt the statements from the companies named in the story.

Though it qualifies with 'at this time', it is currently endorsing the denials from Amazon, Apple, and Supermicro. The DHS statement goes on to defend its own track record noting:

Information and communications technology supply chain security is core to DHS’s cybersecurity mission and we are committed to the security and integrity of the technology on which Americans and others around the world increasingly rely.

Update 2: Bloomberg Responds to US DHS

Now, Bloomberg has released an article about the US DHS statement, retorting:

DHS may not be involved in such inquiries, several people familiar with them said.

Bloomberg did not identify who those 'people familiar' with 'such inquiries' were.

Comments (131) : PRO Members only. Login. or Join.

Related Reports

From The Basement To Buried Behind Chinatown: ISC West Emerging Technology Zone on Feb 22, 2019
What does ISC West think about 'Emerging Technology'? Well, last year, they put those companies in the basement. This year, they moved them up to...
First US State, Vermont, Bans Dahua and Hikvision on Feb 21, 2019
The first US state, Vermont, has issued a ban on a number of Chinese and Russian manufacturers including the world's 2 largest video surveillance...
Massive Leak Of Chinese VMS Provider Exposes Xinjiang Surveillance on Feb 20, 2019
A subsidiary of China’s claimed largest VMS provider is tracking the precise location and ethnicity of millions in China’s Xinjiang region,...
Hikvision 2018 Revenue Tops $7 Billion USD But Growth Slows To Low on Feb 15, 2019
Hikvision's annual revenue topped $7 billion for the first time in 2018, although growth slowed sharply. In this post, we analyze the latest...
Hikvision Chairman Praises United Front on Feb 14, 2019
Hikvision’s controlling shareholder held a meeting last month praising the United Front, a Communist Party organization known for its secretive...
US Senator Calls Hikvision and Dahua “Puppets of the Chinese Communist Party”, Urges Sanctions on Feb 07, 2019
Tom Cotton, Republican senator from Arkansas, has publicly called Hikvision and Dahua “puppets of the Chinese Communist Party and the People’s...
3 UK MPs Call For Investigating Hikvision Over Xinjiang on Feb 04, 2019
3 UK members of Parliament, including 2 with direct comments to IPVM, have called for the UK government to investigate Hikvision's Xinjiang...
Hanwha Techwin Favorability Results 2019 on Jan 31, 2019
Hanwha Techwin's favorability results surged, in IPVM's 2019 study, going from barely neutral in 2016 to strongly net positive, as the results...
Dahua China Significant Job Cuts on Jan 28, 2019
Dahua China has cut a significant number of jobs in the past few months, according to numerous sources. This is a significant shift from Dahua's...
Genetec Favorability Report 2019 on Jan 25, 2019
Genetec's favorability moderately strengthed, in new IPVM integrator statistics over their results from 2017, with 2019 results showing solid, but...

Most Recent Industry Reports

From The Basement To Buried Behind Chinatown: ISC West Emerging Technology Zone on Feb 22, 2019
What does ISC West think about 'Emerging Technology'? Well, last year, they put those companies in the basement. This year, they moved them up to...
Private School IT Manager Surveillance Interview on Feb 22, 2019
This IT manager describes himself as the "oft-maligned IT person" whose "opinions may not always be appreciated by the integrator crowd." But he is...
Outdoor Camera Mounting Hardware Guide on Feb 21, 2019
Mounting cameras outdoors can be challenging, requiring understanding different types of equipment and methods. In this guide, we teach this...
HID Favorability Results 2019 on Feb 21, 2019
HID favorability results were strong, in the 2019 IPVM integrator study of 200+ integrators, with a net +62% and low negativity as the table below...
First US State, Vermont, Bans Dahua and Hikvision on Feb 21, 2019
The first US state, Vermont, has issued a ban on a number of Chinese and Russian manufacturers including the world's 2 largest video surveillance...
ADI 'SAVE BIG' On FLIR And Hikvision Examined on Feb 20, 2019
One is a major US defense supplier. The other is owned by the Chinese government. But you can "SAVE BIG" on both at ADI. In this note, we...
BluB0x Company Profile on Feb 20, 2019
BluB0x has doubled in revenue every year since its founding in 2013, according to CEO Patrick Barry. We originally reported on them in 2015. At the...
Massive Leak Of Chinese VMS Provider Exposes Xinjiang Surveillance on Feb 20, 2019
A subsidiary of China’s claimed largest VMS provider is tracking the precise location and ethnicity of millions in China’s Xinjiang region,...
Security Installation Tools Guide - 22 Tools Listed on Feb 19, 2019
In this guide, we cover 22 tools that security installers frequently use. This is one part of our upcoming Video Surveillance...
Sales Cuts At Rasilient on Feb 19, 2019
Over the past 2 years, video surveillance storage specialist Rasilient has expanded its workforce significantly, aiming to build its own branded...

The world's leading video surveillance information source, IPVM provides the best reporting, testing and training for 10,000+ members globally. Dedicated to independent and objective information, we uniquely refuse any and all advertisements, sponsorship and consulting from manufacturers.

About | FAQ | Contact