IP Camera Passwords - Axis, Dahua, Samsung

By: Ethan Ace, Published on Oct 15, 2014

IP cameras are famous / infamous for weak default passwords that can lead to major problems. See our IP Cameras Default Passwords Directory for examples.

However, in the last few years that is starting to change.

In this note, we look at password procedures for Axis, Dahua and Samsung, explaining why and which are strong, moderate or weak.

** ******* *** ****** / ******** *** **** default ********* **** *** lead ** ***** ********. See *** ** ******* ******* ********* Directory *** ********.

*******, ** *** **** few ***** **** ** starting ** ******.

** **** ****, ** look ** ******** ********** for ****,******** *******, ********** *** and ***** *** ******, moderate ** ****.

[***************]

Strong: *******

** ***** **** ****** firmware *******, ******* *** done *** ****** ** improve ******** ********:

  • *****, ***** **** ****** a ******** **** *** camera ** ***** ****** or ******** ** ** factory *********. ***** ** no ******* ********.
  • ******, *** ***** ******** must ** ** ***** 8 ********** *** ****** two ******* *****, ** seen ** *** ***** below. ***** ***** ** not ***** *******'* ******* default ******** ("****") ** be ****.

********* **** ***** *** find ***** ***** ******* and **** *** ***** password ********* ** ********, but **** ** *** more ****** **** ****** defaulting ** "****."

Moderate: ****

**** ******* *** ***** the **** ** ****** a ******** **** ***** login. *******, "****" ** still ********, *** ***** functions ** * ******* password, **** ***** **** to ******* ** *** camera ****** *** ******** creation ***** ** ********. This ***** ** **** likely **** **** ***** simply ***** "****" ******* thought, *** ** *** change ** *****.

Bosch: ********

******** ** *.** ********, Bosch ******* ***** ** set * ********, **** this ***** ********* **** connecting ** *** ******'* web *********. **** **** no ******** ** *** by ******* *** **** is ********, ****** ******* or *********, ***** ***** users ** *** ***.

******** ** ***** ***** to *** ******** ***** page, **** * ***** showing ******** "********." **** that *** ******** ** this ******* *** * characters **** *** ******** uppercase *** ********* *******, numbers, *** * ******* character, *** *** ***** only ******** ** "******." Strong ********* ******* ** characters *** * *** of ***** *****.

****:***** (*** *********)

************ ******* ** *****/*****, poor ******** ** ******, but ************* *** ** all ******** ***** ** cameras. ** ******** ********, Dahua ******* (*** ****) included *** ******** ***** could *** ** *******, named  ****** (**** ***** ******) and ****** (**** ****). However, ** ***** ******** (Q2/Q3 ****), ***** ******** no ****** *****, **** admin *** **** ******* by *******.

***** **** *** **** users ** ****** *** password ****** *** ***** login, *** ******** ******** strength ***************, **** *****. However, ********* *** **** contain ******* *** ********, no ******* **********, ******* users ** ******** ****** to ****** * ****** password.

************, ***** ******* **** ** option ** ****** ***** if ******** ****** ***** attempts *** ****, **** below. **** ** ******** in ** *******, **** very *** ****** ** repeated ********. **** ** least ******** **** ******** against ******** ******, ******** intruders ** *** **** the ******* *********.


******

*** **** ******** ** manufacturers ***** *** ******* passwords ******* ******* ***** to ****** **** ** login, *** **** **** we **** **** ******* ******* rules ** ******* ****. The **** ****** *********** remains *****/*****.

***** *** **** * few ******** ** ************ and *********** ** ******** security **'** **** ** our ****** *****. *******, feel **** ** *** others ** *** ******** below.

****

**** ** ***** ******** our** ******* ******* ********* Directory, ****** **% ** ***** said **** ** ***** sometimes *** ******* ********* in * ********** **********:

**** **** ** ****, what ** *** ***** manufacturers ****** ** (** anything) ** **** ** camera ********* **** ******?

Comments (19)

Regarding Dahua's 6 and 8 passwords, those numbers are considered especially lucky in Chinese. It's a lucky password....

I'll be sure to let the Costco and Sam's Club crowd know that.

Just as an addendum here, I added one point to Dahua: they do allow for notification if someone attempts to login in one or more times with the wrong password:

That's moderately useful for basic intrusion detection (assuming you've changed the passwords from default, and intruders do not have them), and not a common feature in cameras.

I do not agree with Samsung's complex rules for passwords. I understand the concept of creating a difficult to hack pass word but having to create a complex, hard to remember additional password for Samung is somewhat of a problem.

I agree more with the track taken by Axis, forcing users to create a password but letting you set your own desired level of complexity. Cameras do not store credit card numbers or other financial data which must be protected. The worst thing that can happen is that a hacker would change your camera settings.

You cannot pay most people to simply view surviellance video, so why would a hacker want to just log in and look at the live view ?

The level of complexity should be in line with the value of what you are protecting.

I am aware of the problems with some inexpensivee systems which have default passwords and I agree that all systems should require a new password with initial login to protect the unwary. But Samsung goes overboard requiring a level of difficulty which is not warranted by the downside to someone hacking your password. By the way, why on earth would a hacker put in the effort to crack even a simple password to gain access to a video camera ? If you feel your video is so valuable to need high level of protection then you should be able to implement it but is should not be required.

I have used Samsung cameras and found the password a real pain since all my other cameras used something simpler.

On the flip side, though, look at it from a manufacturer's perspective: There are sites out there dedicated to showing open IP cameras on the internet, and a search engine that lets you easily find them.

If there is even a small chance that an unskilled user will drop one of these in a private area and leave it open to the internet (and that's a realistic scenario), there's also a chance someone will find it and view it. The fallout from these events can be a PR nightmare and a waste of resources. Forcing users to create a password and not using a default one can likely avoid the vast majority of these issues, as most won't go through the trouble of hacking it. They'll just try passwords and when they fail, move on to the next sucker.

Even in typical commercial install scenarios, why is having a complex admin password necessarily a bad thing? How often do users need to access the camera via that password? It seems like as long as it's documented, it should not be a problem.

All IPVM Samsung camera's passwords are now "dereK1scool!"

To play devil's advocate, sure, assuming its documented and assuming one can instantly get to that document, which is often not the case.

Forcing people to create their own password on a device is good. There are far too many 'open' devices on the internet because people couldn't bother to change the password.

I once hijacked a printer at my old school because they couldn't be bothered to change the default password.

However, telling me that my standard password isn't up to their standards, is just nonesense. I already hate those damn websites who tell you how your password should look like with all those capitols/symbols etc. Let me choose my own level of protection!

Also, obligatory XKCD

Foscam has a 12-character limit which precludes correcthorsebatterystaple.

I see many applications with password length limits that will virtually assure many insecure passwords among their users.

I'm going to go out on a limb and suggest that allowing arbitrary password lengths would probably do a great deal more for device security than enforcing bizzare and unmemorable contortions within artificially restricted password lengths.

A typical response to wacky and unmemorable rules is to standardize on some formula that is used across multiple applications.

This is great until passwords from multiple hacked sites are available to someone who cares to attempt pattern analysis. Also, data mining capabilities are becoming increasingly sophisticated, bringing such analysis within the reach of script kiddies even when they don't care to apply that much effort.

All told, I just wish applications would give me enough room to make a memorable and secure password. <-- (that sentence would be a decent password)

This Black Hat 2013 presentation suggests that remote code execution on a compromised camera could lead to a compromise of the network. Many surveillance cameras are not isolated from a facility's data networks. I agree; the level of complexity should be in line with the value of what you are protecting.

On a separate but related note, some systems severely limit the number of characters allowed in a password. As noted in an earlier IPVM discussion, longer passwords can be more easily remembered while still being secure. Cameras which store and stream high volumes of data are clearly capable of managing reasonably long passwords; could anyone suggest another possible motivation for password length restrictions?

I'm not sure about their new offerings, but Dahua is known for having a backdoor password by the day and a telnet password I believe that cannot be changed. I was able to login using root:vizxv and reboot the camera as that was the only command I knew.

I believe that the camera should never be allowed to be directly accessed but only through a VMS or access through a secure channel into the server. They should also be on a VLAN isolated from the rest of the network. It would be good if the physical network were also secured.

On a positive note, the latest Dahua cameras received allowed one to change the passwords for Onvif. On prior firmware/models, this was not possible and any computer on the network could access the feeds using Onvif.

Hi

Coming from a relative newcmer to the field of security Cameras (IP integrator is our other/main hat). When you are dealing with 200 cameras how do you go about the 200 different cameras passwords you would have? You now must finda way to manage those 200 passwords... and that securely.

I believe that security shoud lstart from the network itself. That is not an easy thing to accomplish but this seems to be the way IMO to deal with the Device Management / Device Security conflicting requirements.

A, I added a new discussion on this here - How Do You Handle Password Assignment Of 200 Cameras?

Update: Dahua now asks users (but doesn't force them) to change password on first login, and gives password strength recommendations.

They've also removed the 888888 and 666666 backdoor accounts from cameras.

We've confirmed this on multiple cameras, but don't have a new DVR to check with. We'll update if we do.

Thanks for the update. I haven't seen this in the IP cameras but I have seen the password request in the CVI DVRs. It asked me to change the password and I noticed I could have a password longer than 6 characters. The 6 and 8 accounts were still there, but I removed them which I know you used to not be able to on the IP cameras which makes it take longer to set passwords.

Have you tested if the Onvif password could be changed? I know that I could change the passwords on the cameras, but then simply use Onvif manager to completely alter settings without a password or using admin admin.

I didn't check the ONVIF password. I'll check it out tomorrow. I do recall seeing a checkbox for ONVIF authentication I don't recall being there, but I didn't try it out.

Yes, I noticed that too when it first got added. I thought, wow this is great. That was until I changed the passwords on the camera and it didn't change the ONVIF password. It was still admin/admin with authentication turned on (no password turned off). I tried to change the password with ONVIF manager, but that didn't work which is why I'm hoping newer firmware addresses this issue.

Here is an update to Dahua and Onvif security. So the latest Dahua firmware (one that has admin with no other accounts) has the ability to change the Onvif password. However, Onvif authentication must be on and you can't change the password from the web browser. You must change the Onvif admin password using Onvif Device Manager.

In addition to that, almost all Dahua cameras have newer firmware that can be installed on all existing cameras. All the ones we updated had auto zoom/focus. The upgrade reset the zoom/focus back to default and then made it out of focus. After the firmware update, we could delete the 8's and 6's accounts and then login to Onfiv Device Manager and change all the passwords. No more admin/admin Onfif backdoor.

No more admin/admin Onfif backdoor.

Good work, Kyle!

Jon D. owes you a beer. ;)

Update: we added a section on Bosch, who famously included no password by default. In new firmwares, they prompt the user to create a password, but don't require a strong one.

They also turned of SSH and telnet by default, which used to be on, and with no password required, either.

Login to read this IPVM report.
Why do I need to log in?
IPVM conducts unique testing and research funded by member's payments enabling us to offer the most independent, accurate and in-depth information.

Related Reports

Verint Victimized By Ransomware on Apr 18, 2019
Verint, which is best known in the physical security industry for video surveillance but has built a sizeable cybersecurity business as well, was...
Security Fail: ASISNYC Auto Emails Passwords In Plain Text on May 14, 2019
ASIS NYC automatically emails a user with the password the user just entered, in plain text, when one registers for the site / event, as the...
LifeSafety Power NetLink Vulnerabilities And Problematic Response on May 20, 2019
'Power supplies' are not devices that many think about when considering vulnerabilities but as more and more devices go 'online', the risks for...
Vivotek Trend Micro Cyber Security Camera App Tested on Jul 22, 2019
Vivotek and Trend Micro are claiming five million blocked attacks on IP cameras, with their jointly developed app for Vivotek cameras. This new...
Dahua Wiretapping Vulnerability on Aug 02, 2019
IPVM has validated, with testing, and from Dahua, that many Dahua cameras have a wiretapping vulnerability. Even if the camera's audio has been...
Uniview OEM Directory on Sep 11, 2019
This directory lists 20+ companies that OEM products from Uniview, with a graphic and links to company websites below. It does not cover all...
Critical Vulnerability Across 18+ Network Switch Vendors: Cisco, Netgear, More on Aug 26, 2019
Cisco, Netgear and more than a dozen other brands, including small Asian ones, have been found to share the same critical vulnerability, discovered...
Warning: Windows 7 Update Crashing NVRs on Aug 26, 2019
Windows 7 updates are causing VMS servers to fail to boot. After running the update, impacted systems do not boot as normal, instead display this...
ONVIF Exposure To "Devastating DDoS Attacks" Examined on Sep 06, 2019
ZDnet reported "Protocol used by 630,000 devices can be abused for devastating DDoS attacks", citing exposure of ONVIF devices. And after an...
Dahua New Critical Vulnerability 2019 on Sep 23, 2019
Dahua has quietly admitted 5 new vulnerabilities including 1 critical vulnerability with a 9.8 / 10.0 CVSS score and 2 high vulnerabilities (scored...

Most Recent Industry Reports

Video Surveillance 101 Course - Last Chance on Feb 20, 2020
This is the last chance to join IPVM's first Video Surveillance 101 course, designed to help those new to the industry to quickly understand the...
Cheap Camera Problems at Night on Feb 19, 2020
Cheap cameras generally have problems at night, despite the common perception that integrated IR makes cameras mostly the same, according to new...
Milestone Launches Multiple Cloud Solutions on Feb 18, 2020
Milestone is going to the cloud, becoming one of the last prominent VMSes to do so. Milestone is clearly late but how competitive do these new...
Video Surveillance Architecture 101 on Feb 18, 2020
Video surveillance can be designed and deployed in a number of ways. This 101 examines the most common options and architectures used in...
UK Stands Behind Hikvision But Controversy Continues on Feb 18, 2020
Hikvision is exhibiting at a UK government conference for law enforcement, provoking controversy from the press, politicians, and activists due to...
IronYun AI Analytics Tested on Feb 17, 2020
Taiwan startup IronYun has raised tens of millions for its "mission to be the leading Artificial Intelligence, big data video software as a service...
Access Control ADA and Disability Laws Tutorial on Feb 17, 2020
Safe access control is paramount, especially for those with disabilities. Most countries have codes to mandate safe building access for those...
ISC West 2020 Removes China Pavilion, No Plans To Cancel Or Postpone on Feb 17, 2020
ISC West plans to go on next month, amidst concerns over coronavirus. However, the Asia / China Pavilion has been removed, show organizers...
Hanwha Wisenet X Plus PTRZ Tested on Feb 14, 2020
Hanwha has released their PTRZ camera, the Wisenet X Plus XNV-6081Z, claiming the "modular design allows for easy installation". We bought and...
PRC Warns Against China Video Surveillance Hacks, Hikvision Targeted on Feb 14, 2020
Hackers are targeting China video surveillance manufacturers and systems, according to the PRC's main cyber threat monitoring body. The hackers...