IP Camera Passwords - Axis, Dahua, Samsung

By: Ethan Ace, Published on Oct 15, 2014

IP cameras are famous / infamous for weak default passwords that can lead to major problems. See our IP Cameras Default Passwords Directory for examples.

However, in the last few years that is starting to change.

In this note, we look at password procedures for Axis, Dahua and Samsung, explaining why and which are strong, moderate or weak.

** ******* *** ****** / ******** *** **** default ********* **** *** lead ** ***** ********. See *** ** ******* ******* ********* Directory *** ********.

*******, ** *** **** few ***** **** ** starting ** ******.

** **** ****, ** look ** ******** ********** for ****,******** *******, ********** *** and ***** *** ******, moderate ** ****.

[***************]

Strong: *******

** ***** **** ****** firmware *******, ******* *** done *** ****** ** improve ******** ********:

  • *****, ***** **** ****** a ******** **** *** camera ** ***** ****** or ******** ** ** factory *********. ***** ** no ******* ********.
  • ******, *** ***** ******** must ** ** ***** 8 ********** *** ****** two ******* *****, ** seen ** *** ***** below. ***** ***** ** not ***** *******'* ******* default ******** ("****") ** be ****.

********* **** ***** *** find ***** ***** ******* and **** *** ***** password ********* ** ********, but **** ** *** more ****** **** ****** defaulting ** "****."

Moderate: ****

**** ******* *** ***** the **** ** ****** a ******** **** ***** login. *******, "****" ** still ********, *** ***** functions ** * ******* password, **** ***** **** to ******* ** *** camera ****** *** ******** creation ***** ** ********. This ***** ** **** likely **** **** ***** simply ***** "****" ******* thought, *** ** *** change ** *****.

Bosch: ********

******** ** *.** ********, Bosch ******* ***** ** set * ********, **** this ***** ********* **** connecting ** *** ******'* web *********. **** **** no ******** ** *** by ******* *** **** is ********, ****** ******* or *********, ***** ***** users ** *** ***.

******** ** ***** ***** to *** ******** ***** page, **** * ***** showing ******** "********." **** that *** ******** ** this ******* *** * characters **** *** ******** uppercase *** ********* *******, numbers, *** * ******* character, *** *** ***** only ******** ** "******." Strong ********* ******* ** characters *** * *** of ***** *****.

****:***** (*** *********)

************ ******* ** *****/*****, poor ******** ** ******, but ************* *** ** all ******** ***** ** cameras. ** ******** ********, Dahua ******* (*** ****) included *** ******** ***** could *** ** *******, named  ****** (**** ***** ******) and ****** (**** ****). However, ** ***** ******** (Q2/Q3 ****), ***** ******** no ****** *****, **** admin *** **** ******* by *******.

***** **** *** **** users ** ****** *** password ****** *** ***** login, *** ******** ******** strength ***************, **** *****. However, ********* *** **** contain ******* *** ********, no ******* **********, ******* users ** ******** ****** to ****** * ****** password.

************, ***** ******* **** ** option ** ****** ***** if ******** ****** ***** attempts *** ****, **** below. **** ** ******** in ** *******, **** very *** ****** ** repeated ********. **** ** least ******** **** ******** against ******** ******, ******** intruders ** *** **** the ******* *********.


******

*** **** ******** ** manufacturers ***** *** ******* passwords ******* ******* ***** to ****** **** ** login, *** **** **** we **** **** ******* ******* rules ** ******* ****. The **** ****** *********** remains *****/*****.

***** *** **** * few ******** ** ************ and *********** ** ******** security **'** **** ** our ****** *****. *******, feel **** ** *** others ** *** ******** below.

****

**** ** ***** ******** our** ******* ******* ********* Directory, ****** **% ** ***** said **** ** ***** sometimes *** ******* ********* in * ********** **********:

**** **** ** ****, what ** *** ***** manufacturers ****** ** (** anything) ** **** ** camera ********* **** ******?

Comments (19)

Regarding Dahua's 6 and 8 passwords, those numbers are considered especially lucky in Chinese. It's a lucky password....

I'll be sure to let the Costco and Sam's Club crowd know that.

Just as an addendum here, I added one point to Dahua: they do allow for notification if someone attempts to login in one or more times with the wrong password:

That's moderately useful for basic intrusion detection (assuming you've changed the passwords from default, and intruders do not have them), and not a common feature in cameras.

I do not agree with Samsung's complex rules for passwords. I understand the concept of creating a difficult to hack pass word but having to create a complex, hard to remember additional password for Samung is somewhat of a problem.

I agree more with the track taken by Axis, forcing users to create a password but letting you set your own desired level of complexity. Cameras do not store credit card numbers or other financial data which must be protected. The worst thing that can happen is that a hacker would change your camera settings.

You cannot pay most people to simply view surviellance video, so why would a hacker want to just log in and look at the live view ?

The level of complexity should be in line with the value of what you are protecting.

I am aware of the problems with some inexpensivee systems which have default passwords and I agree that all systems should require a new password with initial login to protect the unwary. But Samsung goes overboard requiring a level of difficulty which is not warranted by the downside to someone hacking your password. By the way, why on earth would a hacker put in the effort to crack even a simple password to gain access to a video camera ? If you feel your video is so valuable to need high level of protection then you should be able to implement it but is should not be required.

I have used Samsung cameras and found the password a real pain since all my other cameras used something simpler.

On the flip side, though, look at it from a manufacturer's perspective: There are sites out there dedicated to showing open IP cameras on the internet, and a search engine that lets you easily find them.

If there is even a small chance that an unskilled user will drop one of these in a private area and leave it open to the internet (and that's a realistic scenario), there's also a chance someone will find it and view it. The fallout from these events can be a PR nightmare and a waste of resources. Forcing users to create a password and not using a default one can likely avoid the vast majority of these issues, as most won't go through the trouble of hacking it. They'll just try passwords and when they fail, move on to the next sucker.

Even in typical commercial install scenarios, why is having a complex admin password necessarily a bad thing? How often do users need to access the camera via that password? It seems like as long as it's documented, it should not be a problem.

All IPVM Samsung camera's passwords are now "dereK1scool!"

To play devil's advocate, sure, assuming its documented and assuming one can instantly get to that document, which is often not the case.

Forcing people to create their own password on a device is good. There are far too many 'open' devices on the internet because people couldn't bother to change the password.

I once hijacked a printer at my old school because they couldn't be bothered to change the default password.

However, telling me that my standard password isn't up to their standards, is just nonesense. I already hate those damn websites who tell you how your password should look like with all those capitols/symbols etc. Let me choose my own level of protection!

Also, obligatory XKCD

Foscam has a 12-character limit which precludes correcthorsebatterystaple.

I see many applications with password length limits that will virtually assure many insecure passwords among their users.

I'm going to go out on a limb and suggest that allowing arbitrary password lengths would probably do a great deal more for device security than enforcing bizzare and unmemorable contortions within artificially restricted password lengths.

A typical response to wacky and unmemorable rules is to standardize on some formula that is used across multiple applications.

This is great until passwords from multiple hacked sites are available to someone who cares to attempt pattern analysis. Also, data mining capabilities are becoming increasingly sophisticated, bringing such analysis within the reach of script kiddies even when they don't care to apply that much effort.

All told, I just wish applications would give me enough room to make a memorable and secure password. <-- (that sentence would be a decent password)

This Black Hat 2013 presentation suggests that remote code execution on a compromised camera could lead to a compromise of the network. Many surveillance cameras are not isolated from a facility's data networks. I agree; the level of complexity should be in line with the value of what you are protecting.

On a separate but related note, some systems severely limit the number of characters allowed in a password. As noted in an earlier IPVM discussion, longer passwords can be more easily remembered while still being secure. Cameras which store and stream high volumes of data are clearly capable of managing reasonably long passwords; could anyone suggest another possible motivation for password length restrictions?

I'm not sure about their new offerings, but Dahua is known for having a backdoor password by the day and a telnet password I believe that cannot be changed. I was able to login using root:vizxv and reboot the camera as that was the only command I knew.

I believe that the camera should never be allowed to be directly accessed but only through a VMS or access through a secure channel into the server. They should also be on a VLAN isolated from the rest of the network. It would be good if the physical network were also secured.

On a positive note, the latest Dahua cameras received allowed one to change the passwords for Onvif. On prior firmware/models, this was not possible and any computer on the network could access the feeds using Onvif.

Hi

Coming from a relative newcmer to the field of security Cameras (IP integrator is our other/main hat). When you are dealing with 200 cameras how do you go about the 200 different cameras passwords you would have? You now must finda way to manage those 200 passwords... and that securely.

I believe that security shoud lstart from the network itself. That is not an easy thing to accomplish but this seems to be the way IMO to deal with the Device Management / Device Security conflicting requirements.

A, I added a new discussion on this here - How Do You Handle Password Assignment Of 200 Cameras?

Update: Dahua now asks users (but doesn't force them) to change password on first login, and gives password strength recommendations.

They've also removed the 888888 and 666666 backdoor accounts from cameras.

We've confirmed this on multiple cameras, but don't have a new DVR to check with. We'll update if we do.

Thanks for the update. I haven't seen this in the IP cameras but I have seen the password request in the CVI DVRs. It asked me to change the password and I noticed I could have a password longer than 6 characters. The 6 and 8 accounts were still there, but I removed them which I know you used to not be able to on the IP cameras which makes it take longer to set passwords.

Have you tested if the Onvif password could be changed? I know that I could change the passwords on the cameras, but then simply use Onvif manager to completely alter settings without a password or using admin admin.

I didn't check the ONVIF password. I'll check it out tomorrow. I do recall seeing a checkbox for ONVIF authentication I don't recall being there, but I didn't try it out.

Yes, I noticed that too when it first got added. I thought, wow this is great. That was until I changed the passwords on the camera and it didn't change the ONVIF password. It was still admin/admin with authentication turned on (no password turned off). I tried to change the password with ONVIF manager, but that didn't work which is why I'm hoping newer firmware addresses this issue.

Here is an update to Dahua and Onvif security. So the latest Dahua firmware (one that has admin with no other accounts) has the ability to change the Onvif password. However, Onvif authentication must be on and you can't change the password from the web browser. You must change the Onvif admin password using Onvif Device Manager.

In addition to that, almost all Dahua cameras have newer firmware that can be installed on all existing cameras. All the ones we updated had auto zoom/focus. The upgrade reset the zoom/focus back to default and then made it out of focus. After the firmware update, we could delete the 8's and 6's accounts and then login to Onfiv Device Manager and change all the passwords. No more admin/admin Onfif backdoor.

No more admin/admin Onfif backdoor.

Good work, Kyle!

Jon D. owes you a beer. ;)

Update: we added a section on Bosch, who famously included no password by default. In new firmwares, they prompt the user to create a password, but don't require a strong one.

They also turned of SSH and telnet by default, which used to be on, and with no password required, either.

Login to read this IPVM report.
Why do I need to log in?
IPVM conducts unique testing and research funded by member's payments enabling us to offer the most independent, accurate and in-depth information.

Related Reports

Dahua OEM Directory 2019 on Aug 16, 2019
US Government banned Dahua OEMs for dozens of companies. The following directory includes 40+ of those companies with a graphic and links to...
Hikvision OEM Directory on Aug 13, 2019
The Chinese government-owned and US-government banned Hikvision has become the world's largest video surveillance manufacturer and generally hidden...
Hikvision Global News Reports Directory on Aug 11, 2019
Hikvision has received the most global news reporting of any video surveillance company, ever, ranging from the WSJ, the Financial Times, Reuters,...
Dahua Wiretapping Vulnerability on Aug 02, 2019
IPVM has validated, with testing, and from Dahua, that many Dahua cameras have a wiretapping vulnerability. Even if the camera's audio has been...
History of Video Surveillance on Jul 19, 2019
The video surveillance market has changed significantly since 2000, going from VCRs to ab emerging AI cloud era.  The goal of this history is to...
Directory of 60 Video Surveillance Startups on Jun 25, 2019
This directory provides a list of video surveillance startups to help you see and research what companies are new or not yet broadly known. 2019...
Directory of 30+ VSaaS / Cloud Video Surveillance Providers on Jun 07, 2019
This directory provides a list of VSaaS / cloud video surveillance providers to help you see and research what options are available. 2019 State...
LifeSafety Power NetLink Vulnerabilities And Problematic Response on May 20, 2019
'Power supplies' are not devices that many think about when considering vulnerabilities but as more and more devices go 'online', the risks for...
Bluecherry Open Sources Entire VMS on May 13, 2019
Bluecherry announced they have "released the entire Bluecherry software application open source with a GPL license". We spoke to Bluecherry's...
Register Now - Fall 2019 IP Networking Course on May 02, 2019
Register for the Fall 2019 IP Networking Course. For early registration save $50 off the course's normal $299 price. This is the only networking...

Most Recent Industry Reports

Dahua OEM Directory 2019 on Aug 16, 2019
US Government banned Dahua OEMs for dozens of companies. The following directory includes 40+ of those companies with a graphic and links to...
Installation Course - Register Now on Aug 15, 2019
Register Now for the September 2019 Video Surveillance Install Course. This is a unique installation course in a market where little practical...
Axis Suffers Outage, Provides Postmortem on Aug 15, 2019
This week, Axis suffered an outage impacting their website and cloud services. Inside this note, we examined what happened, what was impacted...
Hikvision Scrutinized In The Netherlands on Aug 15, 2019
Hikvision is facing unprecedented scrutiny in the Netherlands, at the same time the US government ban has taken effect. This week, a Dutch...
Axis 4K Camera Shootout 2019 on Aug 14, 2019
Axis' 4K Q3518-LVE claims the "best video quality possible", with Lightfinder super low light performance, Axis' high end Forensic WDR, and...
CheckMySystems Company Profile on Aug 14, 2019
CheckMySystems says that too many users respond, "I get an email when something is wrong" when talking about their video system maintenance plan,...
Hikvision OEM Directory on Aug 13, 2019
The Chinese government-owned and US-government banned Hikvision has become the world's largest video surveillance manufacturer and generally hidden...
Biometrics Usage Statistics 2019 on Aug 13, 2019
Biometrics are commonly used in phones, but how frequently are they used for access? 150+ integrators told us how often they use biometrics,...
US Government Ban of Dahua, Hikvision, Huawei Takes Effect Now on Aug 13, 2019
The 'prohibition on use or procurement' of Dahua, Hikvision and Huawei products and 'essential components' take effect today, August 13, 2019, one...

The world's leading video surveillance information source, IPVM provides the best reporting, testing and training for 10,000+ members globally. Dedicated to independent and objective information, we uniquely refuse any and all advertisements, sponsorship and consulting from manufacturers.

About | FAQ | Contact