IP Camera Passwords - Axis, Dahua, Samsung

Author: Ethan Ace, Published on Oct 15, 2014

IP cameras are famous / infamous for weak default passwords that can lead to major problems. See our IP Cameras Default Passwords Directory for examples.

However, in the last few years that is starting to change.

In this note, we look at password procedures for Axis, Dahua and Samsung, explaining why and which are strong, moderate or weak.

** ******* *** ****** / ******** *** **** ******* ********* that *** **** ** ***** ********. *** *** ** ******* ******* ********* ********* *** ********.

*******, ** *** **** *** ***** **** ** ******** ** change.

** **** ****, ** **** ** ******** ********** *** ****,******** *******, ********** *** *** ***** *** ******, ******** ** weak.

[***************]

Strong: *******

** ***** **** ****** ******** *******, ******* *** **** *** things ** ******* ******** ********:

  • *****, ***** **** ****** * ******** **** *** ****** ** first ****** ** ******** ** ** ******* *********. ***** ** no ******* ********.
  • ******, *** ***** ******** **** ** ** ***** * ********** and ****** *** ******* *****, ** **** ** *** ***** below. ***** ***** ** *** ***** *******'* ******* ******* ******** ("4321") ** ** ****.

********* **** ***** *** **** ***** ***** ******* *** **** the ***** ******** ********* ** ********, *** **** ** *** more ****** **** ****** ********** ** "****."

Moderate: ****

**** ******* *** ***** *** **** ** ****** * ******** upon ***** *****. *******, "****" ** ***** ********, *** ***** functions ** * ******* ********, **** ***** **** ** ******* to *** ****** ****** *** ******** ******** ***** ** ********. This ***** ** **** ****** **** **** ***** ****** ***** "pass" ******* *******, *** ** *** ****** ** *****.

Bosch: ********

******** ** *.** ********, ***** ******* ***** ** *** * password, **** **** ***** ********* **** ********** ** *** ******'* web *********. **** **** ** ******** ** *** ** ******* and **** ** ********, ****** ******* ** *********, ***** ***** users ** *** ***.

******** ** ***** ***** ** *** ******** ***** ****, **** a ***** ******* ******** "********." **** **** *** ******** ** this ******* *** * ********** **** *** ******** ********* *** lowercase *******, *******, *** * ******* *********, *** *** ***** only ******** ** "******." ****** ********* ******* ** ********** *** a *** ** ***** *****.

****:***** (*** *********)

************ ******* ** *****/*****, **** ******** ** ******, *** ************* not ** *** ******** ***** ** *******. ** ******** ********, Dahua ******* (*** ****) ******** *** ******** ***** ***** *** be *******, *****  ****** (**** ***** ******) *** ****** (**** ****). *******, ** newer ******** (**/** ****), ***** ******** ** ****** *****, **** admin *** **** ******* ** *******.

***** **** *** **** ***** ** ****** *** ******** ****** the ***** *****, *** ******** ******** ******** ***************, **** *****. However, ********* *** **** ******* ******* *** ********, ** ******* characters, ******* ***** ** ******** ****** ** ****** * ****** password.

************, ***** ******* **** ** ****** ** ****** ***** ** ******** failed ***** ******** *** ****, **** *****. **** ** ******** in ** *******, **** **** *** ****** ** ******** ********. This ** ***** ******** **** ******** ******* ******** ******, ******** intruders ** *** **** *** ******* *********.


******

*** **** ******** ** ************* ***** *** ******* ********* ******* forcing ***** ** ****** **** ** *****, *** **** **** we **** **** ******* ******* ***** ** ******* ****. *** **** common *********** ******* *****/*****.

***** *** **** * *** ******** ** ************ *** *********** in ******** ******** **'** **** ** *** ****** *****. *******, feel **** ** *** ****** ** *** ******** *****.

****

**** ** ***** ******** ***** ******* ******* ********* *********, ****** **% ** ***** **** **** ** ***** ********* *** default ********* ** * ********** **********:

**** **** ** ****, **** ** *** ***** ************* ****** do (** ********) ** **** ** ****** ********* **** ******?

Comments (19)

Regarding Dahua's 6 and 8 passwords, those numbers are considered especially lucky in Chinese. It's a lucky password....

I'll be sure to let the Costco and Sam's Club crowd know that.

Just as an addendum here, I added one point to Dahua: they do allow for notification if someone attempts to login in one or more times with the wrong password:

That's moderately useful for basic intrusion detection (assuming you've changed the passwords from default, and intruders do not have them), and not a common feature in cameras.

I do not agree with Samsung's complex rules for passwords. I understand the concept of creating a difficult to hack pass word but having to create a complex, hard to remember additional password for Samung is somewhat of a problem.

I agree more with the track taken by Axis, forcing users to create a password but letting you set your own desired level of complexity. Cameras do not store credit card numbers or other financial data which must be protected. The worst thing that can happen is that a hacker would change your camera settings.

You cannot pay most people to simply view surviellance video, so why would a hacker want to just log in and look at the live view ?

The level of complexity should be in line with the value of what you are protecting.

I am aware of the problems with some inexpensivee systems which have default passwords and I agree that all systems should require a new password with initial login to protect the unwary. But Samsung goes overboard requiring a level of difficulty which is not warranted by the downside to someone hacking your password. By the way, why on earth would a hacker put in the effort to crack even a simple password to gain access to a video camera ? If you feel your video is so valuable to need high level of protection then you should be able to implement it but is should not be required.

I have used Samsung cameras and found the password a real pain since all my other cameras used something simpler.

On the flip side, though, look at it from a manufacturer's perspective: There are sites out there dedicated to showing open IP cameras on the internet, and a search engine that lets you easily find them.

If there is even a small chance that an unskilled user will drop one of these in a private area and leave it open to the internet (and that's a realistic scenario), there's also a chance someone will find it and view it. The fallout from these events can be a PR nightmare and a waste of resources. Forcing users to create a password and not using a default one can likely avoid the vast majority of these issues, as most won't go through the trouble of hacking it. They'll just try passwords and when they fail, move on to the next sucker.

Even in typical commercial install scenarios, why is having a complex admin password necessarily a bad thing? How often do users need to access the camera via that password? It seems like as long as it's documented, it should not be a problem.

All IPVM Samsung camera's passwords are now "dereK1scool!"

To play devil's advocate, sure, assuming its documented and assuming one can instantly get to that document, which is often not the case.

Forcing people to create their own password on a device is good. There are far too many 'open' devices on the internet because people couldn't bother to change the password.

I once hijacked a printer at my old school because they couldn't be bothered to change the default password.

However, telling me that my standard password isn't up to their standards, is just nonesense. I already hate those damn websites who tell you how your password should look like with all those capitols/symbols etc. Let me choose my own level of protection!

Also, obligatory XKCD

Foscam has a 12-character limit which precludes correcthorsebatterystaple.

I see many applications with password length limits that will virtually assure many insecure passwords among their users.

I'm going to go out on a limb and suggest that allowing arbitrary password lengths would probably do a great deal more for device security than enforcing bizzare and unmemorable contortions within artificially restricted password lengths.

A typical response to wacky and unmemorable rules is to standardize on some formula that is used across multiple applications.

This is great until passwords from multiple hacked sites are available to someone who cares to attempt pattern analysis. Also, data mining capabilities are becoming increasingly sophisticated, bringing such analysis within the reach of script kiddies even when they don't care to apply that much effort.

All told, I just wish applications would give me enough room to make a memorable and secure password. <-- (that sentence would be a decent password)

This Black Hat 2013 presentation suggests that remote code execution on a compromised camera could lead to a compromise of the network. Many surveillance cameras are not isolated from a facility's data networks. I agree; the level of complexity should be in line with the value of what you are protecting.

On a separate but related note, some systems severely limit the number of characters allowed in a password. As noted in an earlier IPVM discussion, longer passwords can be more easily remembered while still being secure. Cameras which store and stream high volumes of data are clearly capable of managing reasonably long passwords; could anyone suggest another possible motivation for password length restrictions?

I'm not sure about their new offerings, but Dahua is known for having a backdoor password by the day and a telnet password I believe that cannot be changed. I was able to login using root:vizxv and reboot the camera as that was the only command I knew.

I believe that the camera should never be allowed to be directly accessed but only through a VMS or access through a secure channel into the server. They should also be on a VLAN isolated from the rest of the network. It would be good if the physical network were also secured.

On a positive note, the latest Dahua cameras received allowed one to change the passwords for Onvif. On prior firmware/models, this was not possible and any computer on the network could access the feeds using Onvif.

Hi

Coming from a relative newcmer to the field of security Cameras (IP integrator is our other/main hat). When you are dealing with 200 cameras how do you go about the 200 different cameras passwords you would have? You now must finda way to manage those 200 passwords... and that securely.

I believe that security shoud lstart from the network itself. That is not an easy thing to accomplish but this seems to be the way IMO to deal with the Device Management / Device Security conflicting requirements.

A, I added a new discussion on this here - How Do You Handle Password Assignment Of 200 Cameras?

Update: Dahua now asks users (but doesn't force them) to change password on first login, and gives password strength recommendations.

They've also removed the 888888 and 666666 backdoor accounts from cameras.

We've confirmed this on multiple cameras, but don't have a new DVR to check with. We'll update if we do.

Thanks for the update. I haven't seen this in the IP cameras but I have seen the password request in the CVI DVRs. It asked me to change the password and I noticed I could have a password longer than 6 characters. The 6 and 8 accounts were still there, but I removed them which I know you used to not be able to on the IP cameras which makes it take longer to set passwords.

Have you tested if the Onvif password could be changed? I know that I could change the passwords on the cameras, but then simply use Onvif manager to completely alter settings without a password or using admin admin.

I didn't check the ONVIF password. I'll check it out tomorrow. I do recall seeing a checkbox for ONVIF authentication I don't recall being there, but I didn't try it out.

Yes, I noticed that too when it first got added. I thought, wow this is great. That was until I changed the passwords on the camera and it didn't change the ONVIF password. It was still admin/admin with authentication turned on (no password turned off). I tried to change the password with ONVIF manager, but that didn't work which is why I'm hoping newer firmware addresses this issue.

Here is an update to Dahua and Onvif security. So the latest Dahua firmware (one that has admin with no other accounts) has the ability to change the Onvif password. However, Onvif authentication must be on and you can't change the password from the web browser. You must change the Onvif admin password using Onvif Device Manager.

In addition to that, almost all Dahua cameras have newer firmware that can be installed on all existing cameras. All the ones we updated had auto zoom/focus. The upgrade reset the zoom/focus back to default and then made it out of focus. After the firmware update, we could delete the 8's and 6's accounts and then login to Onfiv Device Manager and change all the passwords. No more admin/admin Onfif backdoor.

No more admin/admin Onfif backdoor.

Good work, Kyle!

Jon D. owes you a beer. ;)

Update: we added a section on Bosch, who famously included no password by default. In new firmwares, they prompt the user to create a password, but don't require a strong one.

They also turned of SSH and telnet by default, which used to be on, and with no password required, either.

Login to read this IPVM report.
Why do I need to log in?
IPVM conducts unique testing and research funded by member's payments enabling us to offer the most independent, accurate and in-depth information.

Related Reports

VMS Export Shootout - Avigilon, Dahua, Exacq, Genetec, Hikvision, Milestone on Sep 13, 2018
When crimes, accidents or problems occur, exporting video from one's video surveillance system is critical to proving incidents. But who does it...
Axis Co-Founder: The End of Traditional OEMs In The Way It Has Been on Sep 07, 2018
Big changes are coming, predicts Axis Co-Founder Martin Gren. He contends that the end of traditional OEMs is coming, in the video embedded...
Directory Of 110+ Video Management Software (VMS) Suppliers on Aug 30, 2018
This directory provides a list of Video Management Software providers to help you see and research what options are available. Listing...
Hikvision FIPS 140-2 Cybersecurity Certification Examined on Aug 27, 2018
A week after the US government passed a law banning Hikvision, Hikvision announced it had obtained a FIPS 140-2 certification from the US...
Ban of Dahua and Hikvision Is Now US Gov Law on Aug 13, 2018
The US President has signed the 2019 NDAA into law, banning the use of Dahua and Hikvision (and their OEMs) for the US government, for US...
Sony Gen 5 IP Cameras Critical Vulnerabilities on Jul 26, 2018
Cybersecurity vulnerabilities remain prevalent in video surveillance devices. Now Talos researchers have discovered multiple vulnerabilities in...
Directory of Video Surveillance Startups on Jul 18, 2018
This directory provides a list of video surveillance startups to help you see and research what companies are new or not yet broadly known entity...
July 2018 IP Networking Course on Jul 12, 2018
Registration is closed. This is the only networking course designed specifically for video surveillance professionals.  Lots of network training...
Hikvision Corrects False Cybersecurity Announcement on Jun 18, 2018
Hikvision has corrected a false cybersecurity announcement that claimed a British government-sponsored program endorsed the cybersecurity of...
The Dumb Ones: PSA's Bozeman On Cybersecurity on Jun 15, 2018
The smart ones are the hundred people who flew to Denver and spent $500+ on a 1.5-day conference featuring (now US government banned) Dahua as a...

Most Recent Industry Reports

Alexa Guard Expands Amazon's Security Offerings, Boosts ADT's Stock on Sep 21, 2018
Amazon is expanding their security offerings yet again, this time with Alexa Guard that delivers security audio analytics and a virtual "Fake...
UTC, Owner of Lenel, Acquires S2 on Sep 20, 2018
UTC now owns two of the biggest access control providers, one of integrator's most hated access control platforms, Lenel, and one of their...
BluePoint Aims To Bring Life-Safety Mind-Set To Police Pull Stations on Sep 20, 2018
Fire alarm pull stations are commonplace but police ones are not. A self-funded startup, BluePoint Alert Solutions is aiming to make police pull...
SIA Plays Dumb On OEMs And Hikua Ban on Sep 20, 2018
OEMs widely pretend to be 'manufacturers', deceiving their customers and putting them at risk for cybersecurity attacks and, soon, violation of US...
Axis Vs. Hikvision IR PTZ Shootout on Sep 20, 2018
Hikvision has their high-end dual-sensor DarkfighterX. Axis has their high-end concealed IR Q6125-LE. Which is better? We bought both and tested...
Avigilon Announces AI-Powered H5 Camera Development on Sep 19, 2018
Avigilon will be showcasing "next-generation AI" at next week's ASIS GSX. In an atypical move, the company is not actually releasing these...
Favorite Request-to-Exit (RTE) Manufacturers 2018 on Sep 19, 2018
Request To Exit devices like motion sensors and lock releasing push-buttons are a part of almost every access install, but who makes the equipment...
25% China Tariffs Finalized For 2019, 10% Start Now, Includes Select Video Surveillance on Sep 18, 2018
A surprise move: In July, when the most recent tariff round was first announced, the tariffs were only scheduled for 10%. However, now, the US...
Central Stations Face Off Against NFPA On Fire Monitoring on Sep 18, 2018
Central stations are facing off against the NFPA over what they call anti-competitive language in NFPA 72, the standard that covers fire alarms....
Hikvision USA Starts Layoffs on Sep 18, 2018
Hikvision USA has started layoffs, just weeks after the US government ban was passed into law. Inside this note, we examine: The important...

The world's leading video surveillance information source, IPVM provides the best reporting, testing and training for 10,000+ members globally. Dedicated to independent and objective information, we uniquely refuse any and all advertisements, sponsorship and consulting from manufacturers.

About | FAQ | Contact