IP Camera Passwords - Axis, Dahua, Samsung

Author: Ethan Ace, Published on Oct 15, 2014

IP cameras are famous / infamous for weak default passwords that can lead to major problems. See our IP Cameras Default Passwords Directory for examples.

However, in the last few years that is starting to change.

In this note, we look at password procedures for Axis, Dahua and Samsung, explaining why and which are strong, moderate or weak.

** ******* *** ****** / ******** *** **** ******* ********* that *** **** ** ***** ********. *** *** ** ******* ******* ********* ********* *** ********.

*******, ** *** **** *** ***** **** ** ******** ** change.

** **** ****, ** **** ** ******** ********** *** ****,******** *******, ********** *** *** ***** *** ******, ******** ** weak.

[***************]

Strong: *******

** ***** **** ****** ******** *******, ******* *** **** *** things ** ******* ******** ********:

  • *****, ***** **** ****** * ******** **** *** ****** ** first ****** ** ******** ** ** ******* *********. ***** ** no ******* ********.
  • ******, *** ***** ******** **** ** ** ***** * ********** and ****** *** ******* *****, ** **** ** *** ***** below. ***** ***** ** *** ***** *******'* ******* ******* ******** ("4321") ** ** ****.

********* **** ***** *** **** ***** ***** ******* *** **** the ***** ******** ********* ** ********, *** **** ** *** more ****** **** ****** ********** ** "****."

Moderate: ****

**** ******* *** ***** *** **** ** ****** * ******** upon ***** *****. *******, "****" ** ***** ********, *** ***** functions ** * ******* ********, **** ***** **** ** ******* to *** ****** ****** *** ******** ******** ***** ** ********. This ***** ** **** ****** **** **** ***** ****** ***** "pass" ******* *******, *** ** *** ****** ** *****.

Bosch: ********

******** ** *.** ********, ***** ******* ***** ** *** * password, **** **** ***** ********* **** ********** ** *** ******'* web *********. **** **** ** ******** ** *** ** ******* and **** ** ********, ****** ******* ** *********, ***** ***** users ** *** ***.

******** ** ***** ***** ** *** ******** ***** ****, **** a ***** ******* ******** "********." **** **** *** ******** ** this ******* *** * ********** **** *** ******** ********* *** lowercase *******, *******, *** * ******* *********, *** *** ***** only ******** ** "******." ****** ********* ******* ** ********** *** a *** ** ***** *****.

****:***** (*** *********)

************ ******* ** *****/*****, **** ******** ** ******, *** ************* not ** *** ******** ***** ** *******. ** ******** ********, Dahua ******* (*** ****) ******** *** ******** ***** ***** *** be *******, *****  ****** (**** ***** ******) *** ****** (**** ****). *******, ** newer ******** (**/** ****), ***** ******** ** ****** *****, **** admin *** **** ******* ** *******.

***** **** *** **** ***** ** ****** *** ******** ****** the ***** *****, *** ******** ******** ******** ***************, **** *****. However, ********* *** **** ******* ******* *** ********, ** ******* characters, ******* ***** ** ******** ****** ** ****** * ****** password.

************, ***** ******* **** ** ****** ** ****** ***** ** ******** failed ***** ******** *** ****, **** *****. **** ** ******** in ** *******, **** **** *** ****** ** ******** ********. This ** ***** ******** **** ******** ******* ******** ******, ******** intruders ** *** **** *** ******* *********.


******

*** **** ******** ** ************* ***** *** ******* ********* ******* forcing ***** ** ****** **** ** *****, *** **** **** we **** **** ******* ******* ***** ** ******* ****. *** **** common *********** ******* *****/*****.

***** *** **** * *** ******** ** ************ *** *********** in ******** ******** **'** **** ** *** ****** *****. *******, feel **** ** *** ****** ** *** ******** *****.

****

**** ** ***** ******** ***** ******* ******* ********* *********, ****** **% ** ***** **** **** ** ***** ********* *** default ********* ** * ********** **********:

**** **** ** ****, **** ** *** ***** ************* ****** do (** ********) ** **** ** ****** ********* **** ******?

Comments (19)

Regarding Dahua's 6 and 8 passwords, those numbers are considered especially lucky in Chinese. It's a lucky password....

I'll be sure to let the Costco and Sam's Club crowd know that.

Just as an addendum here, I added one point to Dahua: they do allow for notification if someone attempts to login in one or more times with the wrong password:

That's moderately useful for basic intrusion detection (assuming you've changed the passwords from default, and intruders do not have them), and not a common feature in cameras.

I do not agree with Samsung's complex rules for passwords. I understand the concept of creating a difficult to hack pass word but having to create a complex, hard to remember additional password for Samung is somewhat of a problem.

I agree more with the track taken by Axis, forcing users to create a password but letting you set your own desired level of complexity. Cameras do not store credit card numbers or other financial data which must be protected. The worst thing that can happen is that a hacker would change your camera settings.

You cannot pay most people to simply view surviellance video, so why would a hacker want to just log in and look at the live view ?

The level of complexity should be in line with the value of what you are protecting.

I am aware of the problems with some inexpensivee systems which have default passwords and I agree that all systems should require a new password with initial login to protect the unwary. But Samsung goes overboard requiring a level of difficulty which is not warranted by the downside to someone hacking your password. By the way, why on earth would a hacker put in the effort to crack even a simple password to gain access to a video camera ? If you feel your video is so valuable to need high level of protection then you should be able to implement it but is should not be required.

I have used Samsung cameras and found the password a real pain since all my other cameras used something simpler.

On the flip side, though, look at it from a manufacturer's perspective: There are sites out there dedicated to showing open IP cameras on the internet, and a search engine that lets you easily find them.

If there is even a small chance that an unskilled user will drop one of these in a private area and leave it open to the internet (and that's a realistic scenario), there's also a chance someone will find it and view it. The fallout from these events can be a PR nightmare and a waste of resources. Forcing users to create a password and not using a default one can likely avoid the vast majority of these issues, as most won't go through the trouble of hacking it. They'll just try passwords and when they fail, move on to the next sucker.

Even in typical commercial install scenarios, why is having a complex admin password necessarily a bad thing? How often do users need to access the camera via that password? It seems like as long as it's documented, it should not be a problem.

All IPVM Samsung camera's passwords are now "dereK1scool!"

To play devil's advocate, sure, assuming its documented and assuming one can instantly get to that document, which is often not the case.

Forcing people to create their own password on a device is good. There are far too many 'open' devices on the internet because people couldn't bother to change the password.

I once hijacked a printer at my old school because they couldn't be bothered to change the default password.

However, telling me that my standard password isn't up to their standards, is just nonesense. I already hate those damn websites who tell you how your password should look like with all those capitols/symbols etc. Let me choose my own level of protection!

Also, obligatory XKCD

Foscam has a 12-character limit which precludes correcthorsebatterystaple.

I see many applications with password length limits that will virtually assure many insecure passwords among their users.

I'm going to go out on a limb and suggest that allowing arbitrary password lengths would probably do a great deal more for device security than enforcing bizzare and unmemorable contortions within artificially restricted password lengths.

A typical response to wacky and unmemorable rules is to standardize on some formula that is used across multiple applications.

This is great until passwords from multiple hacked sites are available to someone who cares to attempt pattern analysis. Also, data mining capabilities are becoming increasingly sophisticated, bringing such analysis within the reach of script kiddies even when they don't care to apply that much effort.

All told, I just wish applications would give me enough room to make a memorable and secure password. <-- (that sentence would be a decent password)

This Black Hat 2013 presentation suggests that remote code execution on a compromised camera could lead to a compromise of the network. Many surveillance cameras are not isolated from a facility's data networks. I agree; the level of complexity should be in line with the value of what you are protecting.

On a separate but related note, some systems severely limit the number of characters allowed in a password. As noted in an earlier IPVM discussion, longer passwords can be more easily remembered while still being secure. Cameras which store and stream high volumes of data are clearly capable of managing reasonably long passwords; could anyone suggest another possible motivation for password length restrictions?

I'm not sure about their new offerings, but Dahua is known for having a backdoor password by the day and a telnet password I believe that cannot be changed. I was able to login using root:vizxv and reboot the camera as that was the only command I knew.

I believe that the camera should never be allowed to be directly accessed but only through a VMS or access through a secure channel into the server. They should also be on a VLAN isolated from the rest of the network. It would be good if the physical network were also secured.

On a positive note, the latest Dahua cameras received allowed one to change the passwords for Onvif. On prior firmware/models, this was not possible and any computer on the network could access the feeds using Onvif.

Hi

Coming from a relative newcmer to the field of security Cameras (IP integrator is our other/main hat). When you are dealing with 200 cameras how do you go about the 200 different cameras passwords you would have? You now must finda way to manage those 200 passwords... and that securely.

I believe that security shoud lstart from the network itself. That is not an easy thing to accomplish but this seems to be the way IMO to deal with the Device Management / Device Security conflicting requirements.

A, I added a new discussion on this here - How Do You Handle Password Assignment Of 200 Cameras?

Update: Dahua now asks users (but doesn't force them) to change password on first login, and gives password strength recommendations.

They've also removed the 888888 and 666666 backdoor accounts from cameras.

We've confirmed this on multiple cameras, but don't have a new DVR to check with. We'll update if we do.

Thanks for the update. I haven't seen this in the IP cameras but I have seen the password request in the CVI DVRs. It asked me to change the password and I noticed I could have a password longer than 6 characters. The 6 and 8 accounts were still there, but I removed them which I know you used to not be able to on the IP cameras which makes it take longer to set passwords.

Have you tested if the Onvif password could be changed? I know that I could change the passwords on the cameras, but then simply use Onvif manager to completely alter settings without a password or using admin admin.

I didn't check the ONVIF password. I'll check it out tomorrow. I do recall seeing a checkbox for ONVIF authentication I don't recall being there, but I didn't try it out.

Yes, I noticed that too when it first got added. I thought, wow this is great. That was until I changed the passwords on the camera and it didn't change the ONVIF password. It was still admin/admin with authentication turned on (no password turned off). I tried to change the password with ONVIF manager, but that didn't work which is why I'm hoping newer firmware addresses this issue.

Here is an update to Dahua and Onvif security. So the latest Dahua firmware (one that has admin with no other accounts) has the ability to change the Onvif password. However, Onvif authentication must be on and you can't change the password from the web browser. You must change the Onvif admin password using Onvif Device Manager.

In addition to that, almost all Dahua cameras have newer firmware that can be installed on all existing cameras. All the ones we updated had auto zoom/focus. The upgrade reset the zoom/focus back to default and then made it out of focus. After the firmware update, we could delete the 8's and 6's accounts and then login to Onfiv Device Manager and change all the passwords. No more admin/admin Onfif backdoor.

No more admin/admin Onfif backdoor.

Good work, Kyle!

Jon D. owes you a beer. ;)

Update: we added a section on Bosch, who famously included no password by default. In new firmwares, they prompt the user to create a password, but don't require a strong one.

They also turned of SSH and telnet by default, which used to be on, and with no password required, either.

Login to read this IPVM report.
Why do I need to log in?
IPVM conducts unique testing and research funded by member's payments enabling us to offer the most independent, accurate and in-depth information.

Related Reports

Directory of Video Intercoms on Nov 13, 2018
Video Intercoms, also known as Video Door-Phones or Video Entry Systems, have been growing in the past decade as more and more IP camera...
Directory Of Video Doorbells on Nov 06, 2018
Video doorbells are one of the fastest growing categories in video surveillance, especially among residences. The optimal placement of these...
Winter 2019 IP Networking Course on Nov 05, 2018
This is the only networking course designed specifically for video surveillance professionals.  Lots of network training exists but none of it...
HID: Stop Selling Cracked 125 kHz Credentials on Nov 05, 2018
HID should stop selling cracked 125 kHz access control credentials, that have been long cracked and can easily be copied by cheap cloners sold on...
Directory of Access Control and Intrusion Startups on Oct 30, 2018
This directory catalogs access control and intrusion detection startups IPVM has found noteworthy. The directory is provided for your review to...
"New Zealand Govt Uses Chinese Cameras Banned In US", Considers Security Audit on Oct 12, 2018
Newsroom NZ has issued a report: "NZ Govt uses Chinese cameras banned in US": This comes after the US federal government banned purchases of...
Honeywell Hides Selling US Gov Banned Chinese Video Surveillance on Oct 10, 2018
Honeywell hides selling US government banned Chinese video surveillance as their own 'Honeywell' products, deceiving buyers and putting US security...
Default Passwords Outlawed in California, US To Follow on Oct 09, 2018
UPDATES A new California bill aimed at improving security for connected devices has been signed into law. The law takes aim especially at...
China Hacks Video Servers Causing Uproar on Oct 05, 2018
An incident causing an international uproar is hitting home in the video surveillance industry as a Bloomberg report, "The Big Hack: How China...
Fall 2018 New Products Directory on Oct 03, 2018
Fall 2018 New Products Directory We have compiled a directory of new products released fall 2018, or at least since our Spring 2018 Directory. The...

Most Recent Industry Reports

'Sticker' Surveillance Camera Developed (CSEM Witness) on Nov 16, 2018
The Swiss Center for Electronics and Microtechnology (CSEM) has announced what it calls the: world’s first fully autonomous camera that can be...
ISC East 2018 Mini-Show Final Report on Nov 16, 2018
This is our second (updated) and final show report from ISC East. ISC East, by its own admission, is not a national or international show, billed...
Facial Detection Tested on Nov 16, 2018
Facial detection and recognition are increasingly offered by video surveillance manufacturers. Facial detection detects faces in an image/video...
Throughtek P2P/Cloud Solution Profile on Nov 15, 2018
Many IoT manufacturers either do not have the capabilities or the interest to develop their own cloud management software for their devices....
ASIS Offering Custom Research For Manufacturers on Nov 15, 2018
Manufacturers often want to know what industry people think about trends and, in particular, the segments and product they offer.  ASIS and its...
Hikvision Silent on "Bad Architectural Practices" Cybersecurity Report on Nov 14, 2018
A 'significant vulnerability was found in Hikvision cameras' by VDOO, a startup cybersecurity specialist. Hikvision has fixed the specific...
French Government Threatens School with $1.7M Fine For “Excessive Video Surveillance” on Nov 14, 2018
The French government has notified a high-profile Paris coding academy that it risks a fine of up to 1.5 million euros (about $1.7m) if it...
Integrator Credit Card Alternative Divvy on Nov 13, 2018
Most security integrators are small businesses but large enough that they have various employees that need to be able to expense various charges as...
Directory of Video Intercoms on Nov 13, 2018
Video Intercoms, also known as Video Door-Phones or Video Entry Systems, have been growing in the past decade as more and more IP camera...
Beware Amazon Go Store Hype (Tested) on Nov 13, 2018
IPVM's trip to and testing of Amazon Go's San Francisco store shows a number of significant operational and economic issues that undermine the...

The world's leading video surveillance information source, IPVM provides the best reporting, testing and training for 10,000+ members globally. Dedicated to independent and objective information, we uniquely refuse any and all advertisements, sponsorship and consulting from manufacturers.

About | FAQ | Contact