Hikvision Firmware Decrypted

By: Brian Karas, Published on Mar 09, 2017

A developer has decrypted Hikvision's firmware, allowing examination of Hikvision's device source code and contents.

In this report, we overview the tool, showing you how it works, sharing a Hikvision's camera decrypted firmware and overviewing some things to look for inside.

* ********* *** ********* Hikvision's ********, ******** *********** of *********'* ****** ****** code *** ********.

** **** ******, ** overview *** ****, ******* you *** ** *****, sharing * *********'* ****** decrypted ******** *** *********** some ****** ** **** for ******.

[***************]

Utility ********

*** *********, ***********,********* *** ******* ** the ******* **** ** ipcamtalk. "*******" ** ***** for "********* ******/********". ** decrypts *** ******** ****** Hikvision ******** ******, ******** the ********* **** ******* to *******, *** ******* them **** *** ****** required ** ******* ** on * ****** ** recorder. *** ****** ******* takes * *** *******.

*** ******* ******** "** and **" ****** ********* and "*** *** ***" recorder *********, ***** ****** the ******** ** *********'* most ******* ** *******, and ****-****** *********.

Hikpack *****

* ** *** ***** environment ** ******** ** run *** ******* *******. For ***** ******* * linux *******, * *********** of************* ****-***** ***** ***** ******** ** ****.

** *** ******* *** need ********* ******** ****** (********* ******** ********* ****), ***** *** **** unpack ***** *** ********* command:

** *** ***** ** repack **** ************* (*.*., changing ******** **** *******), specify "-* *" ** tell ** ** ******* the ***** ** ** English *******:

*** ********* ******** ** left ****** ** *** specified ********* ("*****" ** this ****), ***** *** be *******, ** ******** further ** ******** *****.

Sample ********* ********

***** **** *******, *** is **** ** ******* and ******* *********'* ******** firmware ****** ** *** a *** ** ******** files. ************** .*** ***** ********* yields ********** ***** *** directories ** *******.

******* **** *** ****, displays *** *** *********** / ********** ** *********'* firmware:

**** *********** ******** **** the ********* *****:

*** ********* "*****.***-**************" ******** the **** ** *** linux ********* ****** **** runs ** *** ******. From **** ********* ** can **** ** /***/****** and *** ** ******** a ****** *****:

**** ***** **** ***** is * ****-***** "****" user, **** ***** ** not **********, ** ********* linux ***** ** ***** a **** **** ** run ********* *****. *** lack ** ***** ***** would ******** **** ***** process ** *** ****** runs ** ****, ***** can **** ** ***** exploitable ********** ** ********** are ***** ** ***** processes.

/***/****.*/*** ***** *** ********* and ******** *** ****** kicks ** **** ** starts:

*** *********** **** **** is *** ******** ******** rule, ******* *** ****** to **** *********** ****** in ** **** ** (SSH). ***** ****** ** no **** ** **** SSH *********** ** *** is *** ******* ** the ******.

********* *** /***/*** **** that ** ****** ***** this **** ***** *** first ******* ***** "********", * ****** *** server **** ** ******** devices:

** *** ******** **** was ******* ***, *** would **** ****** ** able ** **** *** access ** *** ******, which ***** **** ******* you ** **** *** root ******** ** *** camera.

***** ** **** * binary **** ****** "*************", whose **** ******* ** could ** ****** **** other ********* ** ******* system-level ******** ** ******** to ***** *******.

***** **** ** ***** items ******** ** ******** security *****, **** ** call **** ******** *** Hikvision ***** ****** ** keep ** *** ****** running, *** ******* ** a ******** ****, ******* of ****** *** ******* SSH ** ***.

Firmware ********** **** ********

*** ********* ******** ****** both *********** *** ********* to ******* *** ***** workings ** *** ********. With **** **** *** analysis ** ** ******** to ***** *** ********** weaknesses **** *** ** exploited, *********, ***. **** is *** *** *********** *************** ************ **********, **** *********** managed ** ******* ******** files *** **** ******* them *** **********.

****** ********* ** *** need ****** ** ******** files ** **** *********** components ** * ******, having **** ****** ***** their *** **** ******.*** ********* **** *** researcher *** ******* ******** used ** **+ *** brands****** **** ** **** this **** ******** ******** approach.

Comments (16)

Good Stuff, keep it coming.

Funny I didnt have to de-crypt it But then again I use real tool set OS

Binwalk from source does a better job than from the repos in my opinion

Kali_screenshot

Surprised we are doing firmware dumps on here though< i had been debating whether or not post some.

What version of Kali are you running if you don't mind me asking?

I assume the only reason to have a server running and blocking all inc connection instead of not having the server running at all, would be to be able to access the server via a backdoor...

Or am i being influenced by all those hacks and cia/nsa docs recently? =P

So,

is there a bookdoor? or "phone home" ?

This decrypted firmware download will lead Hikvision into serious issues. Now all the bored ppl. out there start playing with their Kali-Toolbox (decompilers and soucecode vulnerability scanners) and they WILL find many new attack vectors.

Hikvision should prepare for a massive demand of firmware updates...

It's been known how to decrypt the firmware for a long while. Most of the obvious vulnerabilities have been found.

You also don't get sourcecode out of a firmware image.

Could also be a test to verify port 22 is indeed blocked before shipping?

There is no need to a block a port that is not running any services.

Unless I misread, SSH is running:

"Examining the /etc/app file that is called after this line shows the first command loads "dropbear", a common SSH server used on embedded devices:"

"why Hikvision would choose to keep an SSH server running, but blocked by a firewall rule, instead of simply not running SSH at all."

Because they can disable the firewall rule by a hidden cgi or whatever... the answer is in the download.

Here's an interesting thought. I'm not sure I agree with my thought yet, but it's worth a discussion... how about Hikvision just open sources their camera firmware? They make money on hardware sales and if they open source it, they would benefit from the community contributing to their code (or at the very least scrutinizing the security vulnerabilities). There may be a few pieces that they'd want to keep to themselves, like any advanced encoding features, or perhaps some of the analytics, but they could also benefit from the transparency of allowing others to see the source.

Most parts of the firmware are open source anyways.

A Linux system always contains many GPL based packages.

The GPL terms of use allow everybody who's interested to request the source code of all GPL licensed packages at any time. The manufacturer has to send you a file that includes all GPL parts and all of his modifications to GPL based code. The "copyleft" of the GPL requires the manufacturer to publish his modifications to GPL code also under GPL license. This applies e.g. to driver/kernel modifications to support the different SoC's.

Please check yourself: https://en.wikipedia.org/wiki/GNU_General_Public_License

Does Hikvision provide such a GPL download?

Hikvision does now, actually. See Hikvision Discloses Open Source Software Used

Just some of the software used under GPL:

  • GCC library
  • Linux kernel
  • busybox 1.19.3
  • u-boot
  • udev 114
  • IPTables 1.4.18
  • ppp - Pauls PPP Package 2.4.3
  • RP PPP OE 3.8
  • wpa_supplicant 0.7.2
Login to read this IPVM report.
Why do I need to log in?
IPVM conducts unique testing and research funded by member's payments enabling us to offer the most independent, accurate and in-depth information.

Related Reports

Security / Privacy Journalist Sam Pfeifle Interview on May 24, 2019
Sam Pfeifle is best known as the outspoken former Editor of Security Systems News. After that, he was publications director at the International...
Access Control Job Walk Guide on May 22, 2019
Significant money can be saved and problems avoided with an access control job walk if you know what to look for and what to ask. By inviting...
US Considers Sanctions Against Hikvision and Dahua on May 22, 2019
The US government is considering blacklisting "up to 5" PRC surveillance firms, including Hikvision and Dahua, Bloomberg reported, with human...
Dahua USA Celebrates 5 Years of Errors on May 21, 2019
Dahua USA is, in their own words, 'celebrating' 5 years in North America or as trade magazine SSN declared: Dahua Technology finds success in...
LifeSafety Power NetLink Vulnerabilities And Problematic Response on May 20, 2019
'Power supplies' are not devices that many think about when considering vulnerabilities but as more and more devices go 'online', the risks for...
Trump Signs 'Huawei Ban' - Executive Order Targeting Foreign Adversary Technology on May 16, 2019
US President Donald Trump has signed an executive order targeting technology provided by 'foreign adversaries', in what is widely being called a...
China PRC Government New National Video Surveillance Standards on May 14, 2019
The People's Republic of China (PRC) government has released a new set of overarching standards for authorities to follow when they install video...
Bluecherry Open Sources Entire VMS on May 13, 2019
Bluecherry announced they have "released the entire Bluecherry software application open source with a GPL license". We spoke to Bluecherry's...
Vivotek Talks About Taiwan, China, Bans, AI And Business Development on May 10, 2019
Vivotek, Taiwan's biggest manufacturer by revenue, did not have a booth at Taiwan's Secutech 2019 (which we are covering). However,...
10 Facial Recognition Providers Review (Secutech) on May 09, 2019
Adding to our 19 Facial Recognition Providers Profiled report from ISC West, IPVM focused on facial recognition technology for our Day 2 coverage...

Most Recent Industry Reports

Verkada Video Quality Problems Tested on May 23, 2019
Verkada suffers from numerous video quality problems, not found in commercial IP cameras, new IPVM testing of Verkada vs Axis and Hikvision...
Average Frame Rate Video Surveillance 2019 on May 23, 2019
What is the average frame rated used in video surveillance systems? In IPVM's 2011 statistics, the average was 6-8fps increasing to ~10fps in...
Access Control Job Walk Guide on May 22, 2019
Significant money can be saved and problems avoided with an access control job walk if you know what to look for and what to ask. By inviting...
US Considers Sanctions Against Hikvision and Dahua on May 22, 2019
The US government is considering blacklisting "up to 5" PRC surveillance firms, including Hikvision and Dahua, Bloomberg reported, with human...
Dahua USA Celebrates 5 Years of Errors on May 21, 2019
Dahua USA is, in their own words, 'celebrating' 5 years in North America or as trade magazine SSN declared: Dahua Technology finds success in...
Axis ~$150 Outdoor Camera Tested on May 21, 2019
Axis has released the latest in their Companion camera line, the outdoor Companion Dome Mini LE, a 1080p integrated IR model aiming to compete with...
Covert Facial Recognition Using Axis and Amazon By NYTimes on May 20, 2019
What if you took a 33MP Axis camera covering one of the busiest parks in the US and ran Amazon Facial Recognition against it? That is what the...
Amazon Ring Public Subsidy Program Aims To Dominate Residential Security on May 20, 2019
Amazon dominates market after market. Quitely, but increasingly, they are doing so in residential security, through a combination of significant...
LifeSafety Power NetLink Vulnerabilities And Problematic Response on May 20, 2019
'Power supplies' are not devices that many think about when considering vulnerabilities but as more and more devices go 'online', the risks for...

The world's leading video surveillance information source, IPVM provides the best reporting, testing and training for 10,000+ members globally. Dedicated to independent and objective information, we uniquely refuse any and all advertisements, sponsorship and consulting from manufacturers.

About | FAQ | Contact