Bosch/Genetec Video Cybersecurity Partnership Examined (CHAVE)

By: Brian Karas, Published on Feb 15, 2017

Surveillance products have been relatively weak when it comes to cyber security. Default passwords, open ports, and weak authentication mechanisms led to a wave of exploits.

Now, Bosch and Genetec are working together to deliver a system that is "resilient against unauthorized access, malware, brute force cracking and other exploit techniques."

The two companies described the solution, which Bosch is marketing as CHAVE (Credentialed High Assurance Video Encryption), in a conversation with IPVM.

In this report we describe how CHAVE differs from other security mechanisms, what it adds in terms of costs, and how installation and day to day use vary from other systems.

************ ******** **** **** relatively **** **** ** comes ** ***** ********. Default *********, **** *****, and **** ************** ********** led ** * **** of ********.

***, ***** *** ******* are ******* ******** ** deliver * ****** **** is "********* ******* ************ ******, malware, ***** ***** ******** and ***** ******* **********."

*** *** ********* ********* the ********, ***** ***** is ********* ** ***** (************ **** ********* ***** Encryption), ** * ************ with ****.

** **** ****** ** describe *** ***** ******* from ***** ******** **********, what ** **** ** terms ** *****, *** how ************ *** *** to *** *** **** from ***** *******.

[***************]

CHAVE ****** ********

***** ** ** ***-**-*** security *********** *** ***** systems. ** ******** ******* with ********** ******** / chipsets *** ******** **** encryption, ***** **** ***-****** security ************ *** * VMS **** *** ********* make *** ** ***** components. 

*** **** ** ***** is ** ****** *** integrity ** *****, **** *** cameras **** *** **** compromised, *** ** ****** manage *** *** **** access ** **** *** stored *****. ***** ***** *.*. government **** ***-* ***** * ************, ***** Bosch ****** ** ***** manufacturer ** **** ** do.

*********, ***** ** ********* CHAVE-capable *******, *** ******* is ****** ***** ******* to ** ******** ******** Center *******.

User ************** 

***** ** * ***** system *** ****** ***** cards, **** ******************-****** ****-** *****, ***** **** **** an ********** ****. ***** to *** *** ******** inserting ***** ***** **** in * ****** ******** to *** ****** ** and ******** * ***.

Target *********

*******/**********, ** ******* ********* that **** ********** ** compliance ************ ****** ************* are *** ****** ******. ** is ******** **** **** a ***** ********** *******-****** customer ***** ********* ***** without ******* ************.

CHAVE ********** ********

********* ** *****, *** technology ********** ** ***** are *** ***** ** standards-compliant ********, **** ** *.*** ************ ****** (********* ***** ********). ***** ** *****'* marketing **** *** ******* these ********* ******** **** an ** ******, *** implementing *** ******** *** accessing *** *******.

******* ******* *** ******** to **** ******** ******** components ** ******* *****, it ** *** * feature **** *** ** added ** ******** ******* via ******** ******** ** other *******.

Username/Password No ****

***** **** *********** ***** **************, ***** ********** ********/******** access ** *******, *** the **** ** ****** or ******* *********. *** system ** ******** ** have ****** ** *** internet, ** **** *** devices *** ********* ******* the *********** ********* ** ensure *** ***** *** still *****. ********* ** Bosch, *** ******** ****** requirement ** *** ** issue, **** *** ********-****** government *************, ** *** systems ********* ******* **** internet ****** *** ****** access/administration ********.

Supported *******

***** ***** *** ********* cameras ** ********* ********** CHAVE:

  • ********* ** **** ** fixed **** ******
  • ********* ** ********* **** VR ***** **** ******
  • ****** ** ********* **** MP ***** *** ******
  • ********* ** **** ** panoramic ******
  • ******** ** ******* **** HD PTZ
  • *** ** ********* **** HD ********** ***
  • ****** ** ****** **** HD ******

Genetec *******

******* **** **** *** aiming ** **** **** support *** ***** ** the **** ******* ** Security ******, ***** ****** be *.*.

********* ***** ******* ** ********* to *******, ****** ******* Bosch *** ******* ***** specify *** **** *** exclusive *********** ** ******** to ****.

Additional ******** *** ************ ************

******* **** ** **** the ******** ************ ***-********* before ********, **** **** is ******* ** ************. *** *********** ******* process **** ******** ****-**** slightly, ********* ** *****, but ****** *** *** more **** * *** extra ****.

**** ********, ************* ************ need ** ** ******** into ******** ****** ****** the ******* *** ** added ** *** *** and **********. ***** ******** of ****** *****, **** as ******** ******* ******** or ******** ******** *** the **** ** ***-***** cameras.

*******, *** ********** **** required ** ******* *** configure *****-******* ******* ****** be *******, *** **** require ***** ** ** through * ********/************* *******.

Training ************

***** **** **** *********** will **** ** ******* additional ******** ****** **** are ********* ** **** and ******* ***** ********. The ******** ** ******** to ** ********* *****, and **** ****** ** a **** *** ******.

Cost ** ***** 

***** *** ********** ******* costs ** ********* ***** vs * ***-***** ******. While *** ********* ******* do *** **** ***** and ***-***** ********, ******* that * ******** **** not *** **** *** CHAVE *******, *** ******* price *** * ***** camera *** ** ****** than * *********** *******.

*** ******** ******** ************ cost $**-$***, ********* ** the ***** ***** ** the *********** ***** ******, and **** **** ** be ******* ***** * years.

******* **** **** **** not ********* ******* *** Security ****** **** *****, but *** *** ** would ****** ** * different ******* *******, **** an ********** ****.

***** **** **** **** to ** ****** ***** cards, *** **** ****** PCs ******** **** ***** card *******. *******, ** is ****** **** ********* implementing ***** **** ******* be ***** ***** *****, so **** **** *** not ** ********, ** may **** ******* * few *** ** **** smart **** ******* *****.

Compared ** ***** ******** *******

*****'* ******* *************** *** the **** ***-* ***** 3 **********, *** ***********-***** logins **** *** *********** of ********/******** *****.  ** ** *** **** ******** ** are ***** ** **** specifically ****** *** **** compliance, ***** ***** ** valuable ** ********* **** need ** **** ***** requirements, ** ** ***** eliminate *** **** ** submit ** *********** ******** for *******/********. *********** *** ability ** ***** **** a ****/**** ***** ***** be ******** ** ********-****** customers, **** ** **** did *** **** ** meet *** ******** ********** requirements.

*******, * ***** ****** would ****** ** ************ more ********* **** *********** options, **** ** ***** a *** *** ******* that ******* ***** ************** and ***** *********, ** it ******** ******** ****** hardware, ************ **** **** to ** ****** ********* and **** ******* ***** 3 *****, **** ********** setup/installation ****.

Outlook *** *****

***** **** ** ****** targeted ** ********** ************, it **** **** *** a ********* *** **** can ** **** **** a ************* *********** ** make ******* **** **********. When/if ***** ***** ******* CHAVE, ** *** ****** some ** ***** ******** methods ** *******-**** ** everyday *******, ****** ****** with ******* ************ (*.*., no *********** *** ***** cards). *****, **** ** unlikely ** ****** ** 2017, ****** ***** * relatively ***** ******* **** only ** *** ********** market.

Comments (19)

Undisclosed #1

02/15/17 02:12pm

This is a fantastic and innovate solution that Bosch have come up with. I am jealous.

John Honovich

IPVM | In reply to Undisclosed #1 | 02/15/17 02:16pm

Well, I can buy 2 of your cameras for the cost of adding just the certificate to Bosch, so you may still have some advantages ;)

Eddie Perry

02/15/17 02:27pm

CHAVE's primary differentiators are the FIPS 140-2 Level 3 compliance, and certificate-based logins with the elimination of username/password login. it is the only approach we are aware of that specifically claims the FIPS compliance, which would be valuable to customers that need to meet these requirements, as it would eliminate the need to submit an alternative approach for testing/approval. Eliminating the ability to login with a user/pass combo could be valuable to security-minded customers, even if they did not need to meet any specific regulatory requirements

 

Panasonic Has something similar to this they claim FIPS Level-1 or something on the new extreme cameras coming out along with the new WJ-NX400.

Details are still fuzzy on the new Security licenses that the have listed for the Units but I still havent really sat down and looked at the FIPS Documentation on my desk yet anyway so I'll make that decision when i get there. 

Avatar

Brian Karas

IPVM | In reply to Eddie Perry | 02/15/17 02:58pm

FIPS 140-2 has 4 levels of protection, 1 being the most basic, 4 being the most secure.

Panasonic lists FIPS 140-2 Level 1 in their Extreme series release. We covered some more details of the newer Extreme cameras, and also did a test.

The Panasonic cameras also only offer 720p and 1080p fixed options, the Bosch cameras have options for a 1080p PTZ, 5MP box camera, and 12MP panoramic. 

 

Undisclosed

02/15/17 04:45pm

From an end user standpoint, I'd like to see the camera manufacturers provide notification (email or alarm into VMS etc) when the number of failed log-in attempts  exceeds a configurable number. This would provide the system administrator visibility of how often a human or bot etc. is attempting to access to the cameras.

Avatar

Ethan Ace

IPVM | In reply to Undisclosed | 02/15/17 04:52pm

I agree with that sentiment. I appreciate that Dahua, Hanwha, and Hikvision have added auto account lock, but I believe only Hikvision allows emails to be sent or events sent to the client (and I believe that's only compatible with iVMS, but I haven't checked). Locking the account is good, but without notification, far less useful than it could be.

That setup in Hikvision cameras is here:

The bigger issue is how few manufacturers support failed login detection at all. My email tells me the second someone tries to login with a wrong password, but cameras and VMSes, products in the security industry, do not?

John Honovich

IPVM | In reply to Undisclosed | 02/15/17 05:33pm

I'd like to see the camera manufacturers provide notification (email or alarm into VMS etc) when the number of failed log-in attempts exceeds a configurable number.

Related: Axis: 90% Of Hacks Are NOT The Manufacturer's Fault discusses how Axis does not support this.

Avatar

Jon Dillabaugh

Pro Focus LLC | In reply to Undisclosed | 02/16/17 01:35am

With Hikvision cameras, simply keep the default setting of auto lock on illegal login enabled and let your VMS alert you of the camera being offline. Should be easy with any decent VMS. 

Avatar

Ethan Ace

IPVM | In reply to Jon Dillabaugh | 02/16/17 01:55am

Locking an account on a Hikvision camera doesn't drop the stream necessarily, just the web interface. I just tested this with Exacq and I've seen the same in other VMSes. It could vary depending on the VMS, though.

Second, even if it did reliably does kick the camera offline, that notification will only tell you it's offline. Then you're left investigating why it's offline separately. Actually sending a discrete event would be preferable. 

Undisclosed

In reply to Ethan Ace | 02/16/17 04:47pm

I am hoping that  camera manufacturers are reading this... As an end user and camera specifier of a relatively large video surveillance system - I will be making purchasing decisions based upon the camera's cyber-security features.. Top among these will be cameras that can notify me either by email or SDK hook into a VMS when failed login attempts occur as a prime differentiator as most camera manufacturers can do a decent job with WDR, picture quality etc. I don't think I am alone on this....

Avatar

Brian Karas

IPVM | In reply to Undisclosed | 02/16/17 05:08pm

Curious, would you trade cyber-security features for other advancements? On-board analytics, higher resolutions, better compression, enhanced WDR?

 

Undisclosed

In reply to Brian Karas | 02/16/17 05:33pm

Brian, For us, the features that you listed are nice to haves for the majority of our locations needing surveillance. That being said, I am a big fan of the Smart Codecs for reducing file storage and better performing WDR.

In my opinion, from a corporate network standpoint - having features that provide notification of threat to the security of your video surveillance system is a higher priority (Marai Botnet which you covered extensively etc) .

Putting this all together - I am looking for a 4K dome with built in IR , an excellent wide dynamic range, good low light performance, utilizes a smart codec and includes log-in failure notification - Am I asking for too much :) ?? 

Avatar

Brian Karas

IPVM | In reply to Undisclosed | 02/16/17 06:11pm

I don't think you are asking for too much in the sense of wanting a product featureset that is impractical. I think the challenge for manufacturers is that it is often a zero-sum game with engineering resources. Implementing more cyber-security features means something else gets cut or delayed. Maybe that delay is just 1 quarter, maybe it is 1 year, hard to say.

I think more customers need to make it clear the cyber security enhancements might be more important than "camera stuff" like analytics or smart(er) CODECs (assuming of course that the other camera features are on par with industry standards, a company with an old H.264 CODEC might be better off working on that first).

Undisclosed

In reply to Brian Karas | 02/17/17 04:04pm

I agree with what you are saying - all things being equal we will lean towards companies that have robust security features. At this point I feel that notification would add more value than all of the overhead involved in using certificate based authentication etc.

Undisclosed Integrator #3

02/16/17 09:19am

"The system is required to have access to the internet, so that the devices can routinely contact the certificate authority to ensure the certs are still valid. According to Bosch, the internet access requirement is not an issue, even for security-minded government organizations, as the systems typically already have internet access for remote access/administration purposes."

 

This is where I stopped reading. My opinion is no security systems should be EVER connected to the Internet. Especially not for remote administration purposes. 

Another issue I have with this system that you need one card and a login/password combo and you can login to the system. These can be stolen or cloned, so your system is vulnerable again.

If the user is already on the Internet, why can't the user use their smartphone NFC with the builting fingerprint reader, online certification system can be developed for iOS or Android, I know one system like that already.

Avatar

Michael Archer

In reply to Undisclosed Integrator #3 | 02/16/17 11:53pm

So do you mean NFC to camera? if you installed a camera up a 30foot pole how you doing to touch it with your Android phone! 

Also currently NFC on iOS currently at 10.3beta3 as yet does not support NFC flags, rumour maybe iOS10 will.

So how to make a secure IPC for a respectable cost with minimal effort?

 

1. Camera has a Bluetooth module, and attached to this is a QR code label. removable.

2. Install camera where is needed, requires power PoE or direct.

3. Device on first power on will go into certification / password generation mode.

4. Installer run the appropriate phone App, which will then after a code scan allow a pairing with the device, for only enough time so than certification generate is done from phone (because it will have a better chance at a random generation) making the use wiggle his finger over the screen to be used a part of the certificate generation. (see PuTTy software which is what the do via the mouse)

5. When complete the device then can enable Ethernet communication, close off Bluetooth.

6. Smart App now has a master public / private codes stored, when then can be passed to the software, this could be cloud based.

7. Camera generates it's own password, to stop reverse engineering of the App to discover a weakness.

8.Time/date can be set from phone to device as normally at least most users will have this correct.

7. Note: An installation engineer may not be person doing software side, so that the data now collected. Password and certificate are then delivered to the software side, or sent as data to customer.

8. Many assumptions that software platform is on internet, can allow phone - device (NVR or PC platform) to open a P2P pre-setup so all information about new device is added.

9 Software platform can be accessed by phone App so we don't need know password.

10. installation company could keep backup of device data, not even knowing the data contents.

11. Device will only now respond to communication from the generated certificate.

Linux as used in most IPC devices has all software certificate generation, and password generation available now. a simple 'openssl rand -base64 24' gives you a lovely password nobody would be able to guess.

 

 

Undisclosed Integrator #3

In reply to Michael Archer | 02/20/17 03:58pm

No, I meant logging in to the VMS client:

 

Login to the VMS requires inserting their smart card in a reader attached to the client PC and entering a PIN.

 

Avatar

Baudouin Genouville

In reply to Undisclosed Integrator #3 | 03/17/17 04:56am

Another issue I have with this system that you need one card and a login/password combo and you can login to the system. These can be stolen or cloned, so your system is vulnerable again.

 

Do not worry!

Bosch has already some good fingerprint readers, so if you have the requirement, then Bosch can supply that product as well

=> https://us.boschsecurity.com/en/products/accesscontrolsystems/readersandcards/biometricreaders/biometricreaders_34654

 

 

 

 

Avatar

Fabian Muyawa

LONTECH SYSTEMS | IPVMU Certified | 11/30/17 01:10pm

 There is no exaggeration in suggestion that CHAVE by Genetec and Bosch is a giant step forward towards improving system hardening. It is also exciting to learn that authentication as been extended to biometric which appears to be more reliable.

I want to believe that the onus lies on the installers and integrators to  utilise the systems tools and capabilities  to full capacity.

   

Login to read this IPVM report.
Why do I need to log in?
IPVM conducts unique testing and research funded by member's payments enabling us to offer the most independent, accurate and in-depth information.

Related Reports

China DVR/NVR Backdoor Discovered, Huawei Refutes on Feb 07, 2020
A backdoor was found in Chinese-produced DVRs and NVRs that secretly allowed access to the recorders. While it was first attributed to Huawei...
ONVIF Exposure To "Devastating DDoS Attacks" Examined on Sep 06, 2019
ZDnet reported "Protocol used by 630,000 devices can be abused for devastating DDoS attacks", citing exposure of ONVIF devices. And after an...
Mobotix First CNPP CCTV Cybersecurity Certification Examined on Sep 05, 2019
Mobotix recently became the first video surveillance manufacturer to receive the CNPP cybsersecurity certification for its cameras, in which they...
Warning: Windows 7 Update Crashing NVRs on Aug 26, 2019
Windows 7 updates are causing VMS servers to fail to boot. After running the update, impacted systems do not boot as normal, instead display this...
Critical Vulnerability Across 18+ Network Switch Vendors: Cisco, Netgear, More on Aug 26, 2019
Cisco, Netgear and more than a dozen other brands, including small Asian ones, have been found to share the same critical vulnerability, discovered...
Axis Suffers Outage, Provides Postmortem on Aug 15, 2019
This week, Axis suffered an outage impacting their website and cloud services. Inside this note, we examined what happened, what was impacted...
Honeywell Speaks On NDAA Ban, New Non-Banned Cameras and Cybersecurity on Aug 06, 2019
For years, Honeywell has depended on Dahua, a company with a poor cybersecurity track record and now banned by the US NDAA, for the development and...
Dahua Wiretapping Vulnerability on Aug 02, 2019
IPVM has validated, with testing, and from Dahua, that many Dahua cameras have a wiretapping vulnerability. Even if the camera's audio has been...
Security Fail: ASISNYC Auto Emails Passwords In Plain Text on May 14, 2019
ASIS NYC automatically emails a user with the password the user just entered, in plain text, when one registers for the site / event, as the...
HTTPS / SSL Video Surveillance Usage Statistics on Apr 01, 2019
HTTPS / SSL / TLS usage has become commonplace for websites to improve security and, in particular, to help mitigate attackers reading or modifying...

Most Recent Industry Reports

Athena CEO Criticizes 'Deplorable' 'Nitpicking', IPVM Refutes on Mar 27, 2020
Athena Security's CEO Lisa Falzone has strongly objected to IPVM's reporting on Athena, calling it 'deplorable' and repeatedly criticizing IPVM's...
Hikvision Admits Sanctions Harming Its Financial Performance on Mar 27, 2020
While Hikvision initially downplayed being sanctioned for human rights abuses, the company is now admitting a significant impact in a new PRC...
New Axis M30 Cameras Tested on Mar 26, 2020
Axis has released a new generation of, for them, relatively low cost M30 series cameras, claiming to deliver "sharp video quality even in poor...
Coronavirus Shuts Down ADT Door Knockers on Mar 26, 2020
Coronavirus has another victim - this time, alarm giant ADT has stopped all door to door sales. Door knockers are a critical but controversial...
Access Control Course Spring 2020 - Save $50 Last Day on Mar 26, 2020
Register Now - Spring 2020 Access Control Course. Today, March 26th is the last day to save $50. IPVM offers the most comprehensive access...
Convergint Coronavirus Cuts on Mar 25, 2020
One of the world's largest security integrators, Convergint, has made a major move to handle the impact of coronavirus, with cuts across the...
VSaaS 101 on Mar 25, 2020
Video Surveillance as a Service (VSaaS) is the common industry term for cloud video. But what does it mean? How does it all work? Inside this...
TVT / InVid Facial Recognition Tested on Mar 25, 2020
Facial recognition is frequently sold for thousands of dollars per channel but some China manufacturers are offering full facial recognition...
IPVM Launches On-Demand Courses on Mar 24, 2020
For nearly a decade, IPVM has been a leader in online live courses. Now, we have added on-demand versions for all courses. The same course...