IP Camera Passwords - Axis, Dahua, Samsung

By: Ethan Ace, Published on Oct 15, 2014

IP cameras are famous / infamous for weak default passwords that can lead to major problems. See our IP Cameras Default Passwords Directory for examples.

However, in the last few years that is starting to change.

In this note, we look at password procedures for Axis, Dahua and Samsung, explaining why and which are strong, moderate or weak.

** ******* *** ****** / ******** *** **** default ********* **** *** lead ** ***** ********. See *** ** ******* ******* ********* Directory *** ********.

*******, ** *** **** few ***** **** ** starting ** ******.

** **** ****, ** look ** ******** ********** for ****,******** *******, ********** *** and ***** *** ******, moderate ** ****.

[***************]

Strong: *******

** ***** **** ****** firmware *******, ******* *** done *** ****** ** improve ******** ********:

  • *****, ***** **** ****** a ******** **** *** camera ** ***** ****** or ******** ** ** factory *********. ***** ** no ******* ********.
  • ******, *** ***** ******** must ** ** ***** 8 ********** *** ****** two ******* *****, ** seen ** *** ***** below. ***** ***** ** not ***** *******'* ******* default ******** ("****") ** be ****.

********* **** ***** *** find ***** ***** ******* and **** *** ***** password ********* ** ********, but **** ** *** more ****** **** ****** defaulting ** "****."

Moderate: ****

**** ******* *** ***** the **** ** ****** a ******** **** ***** login. *******, "****" ** still ********, *** ***** functions ** * ******* password, **** ***** **** to ******* ** *** camera ****** *** ******** creation ***** ** ********. This ***** ** **** likely **** **** ***** simply ***** "****" ******* thought, *** ** *** change ** *****.

Bosch: ********

******** ** *.** ********, Bosch ******* ***** ** set * ********, **** this ***** ********* **** connecting ** *** ******'* web *********. **** **** no ******** ** *** by ******* *** **** is ********, ****** ******* or *********, ***** ***** users ** *** ***.

******** ** ***** ***** to *** ******** ***** page, **** * ***** showing ******** "********." **** that *** ******** ** this ******* *** * characters **** *** ******** uppercase *** ********* *******, numbers, *** * ******* character, *** *** ***** only ******** ** "******." Strong ********* ******* ** characters *** * *** of ***** *****.

****:***** (*** *********)

************ ******* ** *****/*****, poor ******** ** ******, but ************* *** ** all ******** ***** ** cameras. ** ******** ********, Dahua ******* (*** ****) included *** ******** ***** could *** ** *******, named  ****** (**** ***** ******) and ****** (**** ****). However, ** ***** ******** (Q2/Q3 ****), ***** ******** no ****** *****, **** admin *** **** ******* by *******.

***** **** *** **** users ** ****** *** password ****** *** ***** login, *** ******** ******** strength ***************, **** *****. However, ********* *** **** contain ******* *** ********, no ******* **********, ******* users ** ******** ****** to ****** * ****** password.

************, ***** ******* **** ** option ** ****** ***** if ******** ****** ***** attempts *** ****, **** below. **** ** ******** in ** *******, **** very *** ****** ** repeated ********. **** ** least ******** **** ******** against ******** ******, ******** intruders ** *** **** the ******* *********.


******

*** **** ******** ** manufacturers ***** *** ******* passwords ******* ******* ***** to ****** **** ** login, *** **** **** we **** **** ******* ******* rules ** ******* ****. The **** ****** *********** remains *****/*****.

***** *** **** * few ******** ** ************ and *********** ** ******** security **'** **** ** our ****** *****. *******, feel **** ** *** others ** *** ******** below.

****

**** ** ***** ******** our** ******* ******* ********* Directory, ****** **% ** ***** said **** ** ***** sometimes *** ******* ********* in * ********** **********:

**** **** ** ****, what ** *** ***** manufacturers ****** ** (** anything) ** **** ** camera ********* **** ******?

Comments (19)

Regarding Dahua's 6 and 8 passwords, those numbers are considered especially lucky in Chinese. It's a lucky password....

I'll be sure to let the Costco and Sam's Club crowd know that.

Just as an addendum here, I added one point to Dahua: they do allow for notification if someone attempts to login in one or more times with the wrong password:

That's moderately useful for basic intrusion detection (assuming you've changed the passwords from default, and intruders do not have them), and not a common feature in cameras.

I do not agree with Samsung's complex rules for passwords. I understand the concept of creating a difficult to hack pass word but having to create a complex, hard to remember additional password for Samung is somewhat of a problem.

I agree more with the track taken by Axis, forcing users to create a password but letting you set your own desired level of complexity. Cameras do not store credit card numbers or other financial data which must be protected. The worst thing that can happen is that a hacker would change your camera settings.

You cannot pay most people to simply view surviellance video, so why would a hacker want to just log in and look at the live view ?

The level of complexity should be in line with the value of what you are protecting.

I am aware of the problems with some inexpensivee systems which have default passwords and I agree that all systems should require a new password with initial login to protect the unwary. But Samsung goes overboard requiring a level of difficulty which is not warranted by the downside to someone hacking your password. By the way, why on earth would a hacker put in the effort to crack even a simple password to gain access to a video camera ? If you feel your video is so valuable to need high level of protection then you should be able to implement it but is should not be required.

I have used Samsung cameras and found the password a real pain since all my other cameras used something simpler.

On the flip side, though, look at it from a manufacturer's perspective: There are sites out there dedicated to showing open IP cameras on the internet, and a search engine that lets you easily find them.

If there is even a small chance that an unskilled user will drop one of these in a private area and leave it open to the internet (and that's a realistic scenario), there's also a chance someone will find it and view it. The fallout from these events can be a PR nightmare and a waste of resources. Forcing users to create a password and not using a default one can likely avoid the vast majority of these issues, as most won't go through the trouble of hacking it. They'll just try passwords and when they fail, move on to the next sucker.

Even in typical commercial install scenarios, why is having a complex admin password necessarily a bad thing? How often do users need to access the camera via that password? It seems like as long as it's documented, it should not be a problem.

All IPVM Samsung camera's passwords are now "dereK1scool!"

To play devil's advocate, sure, assuming its documented and assuming one can instantly get to that document, which is often not the case.

Forcing people to create their own password on a device is good. There are far too many 'open' devices on the internet because people couldn't bother to change the password.

I once hijacked a printer at my old school because they couldn't be bothered to change the default password.

However, telling me that my standard password isn't up to their standards, is just nonesense. I already hate those damn websites who tell you how your password should look like with all those capitols/symbols etc. Let me choose my own level of protection!

Also, obligatory XKCD

Foscam has a 12-character limit which precludes correcthorsebatterystaple.

I see many applications with password length limits that will virtually assure many insecure passwords among their users.

I'm going to go out on a limb and suggest that allowing arbitrary password lengths would probably do a great deal more for device security than enforcing bizzare and unmemorable contortions within artificially restricted password lengths.

A typical response to wacky and unmemorable rules is to standardize on some formula that is used across multiple applications.

This is great until passwords from multiple hacked sites are available to someone who cares to attempt pattern analysis. Also, data mining capabilities are becoming increasingly sophisticated, bringing such analysis within the reach of script kiddies even when they don't care to apply that much effort.

All told, I just wish applications would give me enough room to make a memorable and secure password. <-- (that sentence would be a decent password)

This Black Hat 2013 presentation suggests that remote code execution on a compromised camera could lead to a compromise of the network. Many surveillance cameras are not isolated from a facility's data networks. I agree; the level of complexity should be in line with the value of what you are protecting.

On a separate but related note, some systems severely limit the number of characters allowed in a password. As noted in an earlier IPVM discussion, longer passwords can be more easily remembered while still being secure. Cameras which store and stream high volumes of data are clearly capable of managing reasonably long passwords; could anyone suggest another possible motivation for password length restrictions?

I'm not sure about their new offerings, but Dahua is known for having a backdoor password by the day and a telnet password I believe that cannot be changed. I was able to login using root:vizxv and reboot the camera as that was the only command I knew.

I believe that the camera should never be allowed to be directly accessed but only through a VMS or access through a secure channel into the server. They should also be on a VLAN isolated from the rest of the network. It would be good if the physical network were also secured.

On a positive note, the latest Dahua cameras received allowed one to change the passwords for Onvif. On prior firmware/models, this was not possible and any computer on the network could access the feeds using Onvif.

Hi

Coming from a relative newcmer to the field of security Cameras (IP integrator is our other/main hat). When you are dealing with 200 cameras how do you go about the 200 different cameras passwords you would have? You now must finda way to manage those 200 passwords... and that securely.

I believe that security shoud lstart from the network itself. That is not an easy thing to accomplish but this seems to be the way IMO to deal with the Device Management / Device Security conflicting requirements.

A, I added a new discussion on this here - How Do You Handle Password Assignment Of 200 Cameras?

Update: Dahua now asks users (but doesn't force them) to change password on first login, and gives password strength recommendations.

They've also removed the 888888 and 666666 backdoor accounts from cameras.

We've confirmed this on multiple cameras, but don't have a new DVR to check with. We'll update if we do.

Thanks for the update. I haven't seen this in the IP cameras but I have seen the password request in the CVI DVRs. It asked me to change the password and I noticed I could have a password longer than 6 characters. The 6 and 8 accounts were still there, but I removed them which I know you used to not be able to on the IP cameras which makes it take longer to set passwords.

Have you tested if the Onvif password could be changed? I know that I could change the passwords on the cameras, but then simply use Onvif manager to completely alter settings without a password or using admin admin.

I didn't check the ONVIF password. I'll check it out tomorrow. I do recall seeing a checkbox for ONVIF authentication I don't recall being there, but I didn't try it out.

Yes, I noticed that too when it first got added. I thought, wow this is great. That was until I changed the passwords on the camera and it didn't change the ONVIF password. It was still admin/admin with authentication turned on (no password turned off). I tried to change the password with ONVIF manager, but that didn't work which is why I'm hoping newer firmware addresses this issue.

Here is an update to Dahua and Onvif security. So the latest Dahua firmware (one that has admin with no other accounts) has the ability to change the Onvif password. However, Onvif authentication must be on and you can't change the password from the web browser. You must change the Onvif admin password using Onvif Device Manager.

In addition to that, almost all Dahua cameras have newer firmware that can be installed on all existing cameras. All the ones we updated had auto zoom/focus. The upgrade reset the zoom/focus back to default and then made it out of focus. After the firmware update, we could delete the 8's and 6's accounts and then login to Onfiv Device Manager and change all the passwords. No more admin/admin Onfif backdoor.

No more admin/admin Onfif backdoor.

Good work, Kyle!

Jon D. owes you a beer. ;)

Update: we added a section on Bosch, who famously included no password by default. In new firmwares, they prompt the user to create a password, but don't require a strong one.

They also turned of SSH and telnet by default, which used to be on, and with no password required, either.

Login to read this IPVM report.
Why do I need to log in?
IPVM conducts unique testing and research funded by member's payments enabling us to offer the most independent, accurate and in-depth information.

Related Reports

Hikvision Global News Reports Directory on Oct 17, 2019
Hikvision has received the most global news reporting of any video surveillance company, ever, ranging from the WSJ, the Financial Times, Reuters,...
Last Chance - Register Now - October 2019 IP Networking Course on Oct 10, 2019
Last Chance - Register Now - Fall 2019 IP Networking Course. The course starts next week. This is the only networking course designed...
Directory of 70 Video Surveillance Startups on Sep 18, 2019
This directory provides a list of video surveillance startups to help you see and research what companies are new or not yet broadly known. 2019...
US Army Base To Buy Banned Honeywell Surveillance on Sep 17, 2019
The U.S. Army's Fort Gordon, home to their Cyber Center of Excellence, has issued a solicitation to purchase Honeywell products that are US...
Uniview OEM Directory on Sep 11, 2019
This directory lists 20+ companies that OEM products from Uniview, with a graphic and links to company websites below. It does not cover all...
Genetec Stratocast VSaaS Tested on Sep 05, 2019
The VSaaS market is rapidly expanding in 2019, with Verkada, Meraki, Eagle Eye, Avigilon and numerous startups growing their market share. When we...
Critical Vulnerability Across 18+ Network Switch Vendors: Cisco, Netgear, More on Aug 26, 2019
Cisco, Netgear and more than a dozen other brands, including small Asian ones, have been found to share the same critical vulnerability, discovered...
Dahua OEM Directory on Aug 16, 2019
US Government banned Dahua OEMs for dozens of companies. The following directory includes 40+ of those companies with a graphic and links to...
Hikvision OEM Directory on Aug 13, 2019
The Chinese government-owned and US-government banned Hikvision has become the world's largest video surveillance manufacturer and generally hidden...
Dahua Wiretapping Vulnerability on Aug 02, 2019
IPVM has validated, with testing, and from Dahua, that many Dahua cameras have a wiretapping vulnerability. Even if the camera's audio has been...

Most Recent Industry Reports

Hikvision Global News Reports Directory on Oct 17, 2019
Hikvision has received the most global news reporting of any video surveillance company, ever, ranging from the WSJ, the Financial Times, Reuters,...
Camera Calculator V3.1 Release Improves User Experience on Oct 17, 2019
IPVM has released a new version of our Camera Calculator, V3.1, with significant user experience improvements, a new development plan, and an...
Securing Access Control Installations Tutorial on Oct 17, 2019
The physical security of access control components is critical to ensuring that a facility is truly secure. Otherwise, the entire system can be...
Access Control Course Fall 2019 - Last Chance on Oct 17, 2019
Register Now - Fall 2019 Access Control Course. Thursday, October 17th is the last day to register. IPVM offers the most comprehensive access...
US DoD Comments on Huawei, Hikvision, Dahua Cyber Security Concerns on Oct 16, 2019
A senior DoD official said the US is "concerned" with the cybersecurity of Hikvision, Dahua, and Huawei due to "CCP" (China Communist Party)...
Pelco Sarix Pro3 Camera Tested on Oct 16, 2019
Pelco has released their Sarix Professional Series 3 cameras, claiming "more security detail in challenging scenes with excellent low light and...
IPVM Camera Calculator User Manual / Guide on Oct 16, 2019
Learn how to use the IPVM Camera Calculator. The guide below includes instructions, images, gifs, and videos demonstrating and explaining the...
Altronix Claims Tango 'Eliminates Electricians' on Oct 15, 2019
Power supply provider Altronix claims its new Tango power supply 'eliminates the need for an electrician, dedicated conduit and wire runs'. In...
Pelco CEO Out, New CEO Found on Oct 15, 2019
Just 2 months after Pelco was sold, Pelco's CEO is out, with Pelco bringing in an outside President and searching for a new CEO from the industry,...