Dahua Critical Cloud Vulnerabilities

By: John Scanlan, Published on May 12, 2020

Dahua has acknowledged a series of cloud vulnerabilities that researcher Bashis discovered. Additionally, and separately, researcher Thomas Vogt found a separate vulnerability.

IPVM Image

Dahua has had numerous vulnerabilities over the past few years including the 2019 critical vulnerabilities that Vogt's team found and the 2017 backdoor that Bashis found. The company is moreover banned for US federal use (NDAA) based on cybersecurity risks.

Inside this report:

  • A summary of the vulnerabilities
  • The vulnerabilities explained
  • A statement from Dahua
  • OEMs Impacted
  • Response from bashis
  • Analysis from Refirm Labs
  • Continued cybersecurity issues
  • IPVM recommendations

Long **** *************** *** *****

***** *** ****** **** confirmed **** ***** *** now (*********) ***** ***** issues, *******, **** ******* for * **** ****, indeed****** ***** ****** * warning ** **** ** IPVM ** ********:

IPVM Image

********, ****** *** **** to **** **** **** still ******* **** *** cloud ****:

****, **’* *** ** easy ** **** ****** cloud **** ** *** devices ****** *** *****, so **** **** **** for **** **** ***** – ** *** ***** working ***.

****** **** ********* ***** potential *****:

******* ** **** ******* will ** ********* *** registered ** *** ***** by *** *******, **** if ****** *** ********** them ** ***** *** account.

**, **** ** *******,

*) ***** *** ****** to ******* – **** they ****** ***** **** that ***?

*) ****** **** ***** could **** ********* ** them *** ******** ** their ******* (******** **** I ***** ***** ***** sniffing).

*** ******** ********:

  • ***** *** ** ****, including ********* *** *******, using ***** ***** ******** were **********.
  • ***** ********* *** ***** keys/passwords *** *** **** (including ********* *** *******) then ******** *** **** in ** ********** **** was *********** ** ***.
  • ********* ***** *** ***** cloud **** ** ******* credentials ***** * ******* listening ****** ** ******* monitoring.
  • ***** **** ***/**** ** encrypt ********* / ***** security ********* ******* ** a ****** ******** **** TLS.
  • ***** *** ******* ****** of ******** *** ***** confirmed ***** ******.
  • ********* ***** **** **** access ** ********* *** cloud ****** ** ******* by ******* ** *** Dahua ********.

Dahua ***** ************* *********

****** ****** * ***** of ******* *** *** vulnerabilities. *****'* ***** ******** is **** *** ***** branded ********* ** **** as ** **** *** has ********* ***** **** stored ****** ** ********** that *** *********** ** users *** ********* *** download *** *** ***.

***** *************** ****** ********* to **** **** ****** to *** ********* *********.

*** ***** ************* ****** by *********** ***** ****** via *** ***** ******, which ********* *** ****** the ***** * ********** of *********. ***** *** two ******* *************** ********* this ******* **** ********* methods ** ******* *** data.

*** ***** ************* ** a ****-********** **** ** the ***** ******** **** IMOU ***** ********* ***** keys/password *** ***** ******* details *** ***** *** 22 ****.

Statement **** *****

********** ****** * ******** advisory ************** ** *** ***************, they *** *** ****** our ********* ***** *** they **** ** **** these ******* ***************. **** the *****, **** **** made ******* *******, ********* back ** ****, ***** the ********,******:

“************** **** ******* **** a ***** ****** ** disruption *** ***********, ********** and *********** *****-****,” ********* Ms. ******, **** ** Marketing, ***** *******, ***** Technology ***. “** ********* in *** *********** ** improved ************* *********** *** new ******* ******** **** higher ********** ** *****-*******, Dahua’s ******* **** **** to ****** ******* ***** customers ******* ***** ******* and **** ******* ****** protection *** *** ****** global ********* *********.”

OEM's ********

***** *** ** **** listed ******* ******** **** Panasonic *** *******. **** reached *** ** ********* for *******.

***** ** * ********** from *** *** ******* the ***** **** *** Panasonic, *******, *** ******:

IPVM Image

********* ********* ******* **** they **** ******** ** research **** *** ****** if ***** *** **** to ***** *********.

Refirm **** ********

************* ******* ****** ************ *** *************** *** comments ** **** *********:

*** *** **** ***** is ***** ** *** credentials *** ********* **** either *** ** **** then **** ** *** CLEAR. *** ****** *** Unix-like ******* *** *** password ** *** *** to ******** *** **** so *** ******** ****** be (******) ********. ***** is ***** ********* ***/**** keys ** ******* *** supplied ******** ** *** other ****. **** ** bad *** **** ******* but ********* ** ** attacker ***** *** ********* key *** *** ********* observe *** ******* ******* she ***** ** **** to ********* ******* *** credentials ** *** ****. The ******* ***** **** a ******* ********* ****** to ******* *** ******** but ******* ********** ***** also ****.

**** ** *** ***** that ***** *** ****. Dahua *** ********** *** of ***** ***** **** "cloud" ***/**** **** ** their ********** **** *** being ***********. **** ********. At ***** *** *** OEMs ****** ***** *** password *** ****** ** themselves? * ****** ***** of * ********* ****** to ** ****.

** *** *** **** to *** ***** ***** then *** *** *********** remotely ******* *** ****** connected ** **.

**** ************ ***** **** of ***** ***** ******** best *********. *********** ****** always ** ********* ** an ******** ******** ****** protocol (*.*. ***), ********* keys ****** ***** ** used ** ******* ************** data, *** ** *** do *** ******** **** don't ******* **** *** in * ****** ********** that *** ******* ** the *****.

Another ***** *** **** *************

***** *********** *** *************** above ** ************ ** *** ******* Dahua ************************* ****** ****:

IPVM Image

***** *** ****** ********* ******** ***** **** here, ******:

**** ***** ******** **** Session ** *********** ***************. During ****** **** ******, an ******** *** *** the ********* ******* ** to ********* * **** packet ** ****** *** device.

* ******* ** ****** and ******** ** ********, requiring ******** ** ********* the *************.

Continued ************* ******

***** *** **** *** most ****** ***************. ***** has * **** ******* of ************* *************** ***** led ** **** *********** *** *** **** the ** ********** *** US ********** ****** *********. ***** ****** *************** include *** *** *** limited ** *** **** below:

What ***** ******?

** ****** ****,***** *** ****** ********* that **** ***** ** "pepper-ed", ********* * *************, secure, *** ******** ***** firmware *** ****** ****** cloud ********. *** ******* plan **** **** *** to ***** **** **** which ** *********** ** the ************* ******** ** a ***** ** ******* and *** ************ ** IMOU. **** ********* ***** and ****** *** ** update. ******* ** ***** 9 ****** ***** *** press ******* ***** ** no ******** ** ***** of. ***** *** *** responded ** *** ******* and ****** ********* ****:

***** ******** **********, ** do *** **** ******* on *** **** ******* to ***** ** **** time.

IPVM ***************

** *** *** ***** Dahua ** ***** *** equipment *** ****** ***** to ****** **** ***** access ** ********. ***** enables **** ** *******, so **** ** *** are *** ******** ***** their ***** ******** ********* can ***** **** ****** to **** ********* ****** you ******* **. ** you *** ******** ***** the ***** ******** *** may ******** ****** ** a **** ************ ****** ****** **** VPN.

Poll / ****

Comments (10)

Undisclosed Integrator #1

05/12/20 05:52pm

** ******* *** *** issue ******** ** ***** before ****** **********? * don't ********** *** *** cloud ***** ** ******* by ******* !?

John Honovich

IPVM | In reply to Undisclosed Integrator #1 | 05/12/20 05:59pm

**, ****** ****** * months ***** ** *** a **** ** *****. And **** *** ** top ** *** ***** it **** ** *** a ******** **** *****.

Undisclosed Integrator #1

In reply to John Honovich | 05/12/20 06:01pm

** ****... **** ** a **** **** **** from ***** :(

Undisclosed Manufacturer #2

05/12/20 06:35pm

***** *** ********** *** of ***** ***** **** "cloud" ***/**** **** ** their ********** **** *** being ***********. **** ********. At ***** *** *** OEMs ****** ***** *** password *** ****** ** themselves? * ****** ***** of * ********* ****** to ** ****.

**** ** *** **** insane ***** ** **. It's *** ***** ** their ***** **** *** prioritized ***** ****** **** updating *** ******* *** and **** ******* ********** which ** *** *** understandable, *** ********** *** encryption **** ** *** executable *** *** ***** customers *** ***** **** and ***** **** ** acceptable ** ***** ** security.

*****'* ***** ******** ** used *** ***** ******* equipment ** **** ** 22 **** *** *** hardcoded ***** **** ****** within ** ********** **** was *********** ** ***** and ********* *** ******** via *** ***.

** ***** ** *** if **** **** *********** the ********** **** *** keys ********** ** *****, but **'* * *********** that ***** *********** **** been *** ** *** public **** *** ********** keys.

****:** **** ********* ** that **** ** *** OEMs *** *** * requirement **** **** **** to *** * ********** key **** **** **** generated ********** ****** **** one **** *** ******** to ****. *'* ****** that ******* *** *** up *** ****** *** the **** ***** **** realized **** **** *** kind ** *******, ** maybe ***** *** ** the ***** ******** *** them?

Undisclosed Manufacturer #4

In reply to Undisclosed Manufacturer #2 | 05/13/20 02:28pm

* ***** ****** ** you *******, **** ***** simply *** ** *** cloud *** *** ****. Or ***** **** ***'* even *** ** *** it ** ******* ** the ******** *** **** they *********** **.

*** ****** *** *** lack ** ******** ** that ** ** ****. That ** *** *** of ***** ********* ** to ** ***.

bashis mcw

In reply to Undisclosed Manufacturer #4 | 05/13/20 06:47pm

*** ******, *** *** their *** ***** **** and ***** **/**** ** their *****. (** *** has **** ******* *****/**** IP/FQDN, * ***** ***'* IP/FQDN ** **** ********** too, *** ****'* **** it ********* ** ****** them ** *** *** description, *** ***** **** where ******)

**** ** ***** ** 3DES ********** ***** *** DVRIP *** *****, *** - **** ***** **** PSK.

****:

**** *** ********* *** are ****** *** ******, so ******** ******** **** the ***** ****** (*******/*******) share **** ***, ****** natural ***** *** **** needs ** ******* *** other **** **** ** decrypt - *** *** thing ** **** ***** credentials *** **** ** remote *** ********** *****/****** for *****/*****, *** *** only ***** ***** **** 3DES.

* *** ** ****** on ******* ***** ******* ********** **** ***** ** well, (******* */* ********** leaks), *** ** ***** you *** *** **** out ** *** ****.

Undisclosed Integrator #3

05/13/20 12:40pm

*****'* **** *** **** and ****. ** *** nice ****** ***** ****** cameras **** ****, *** now **** ** *** them ** *** ******** it ** ***** ****** to *** ****. ** one **** *** ***** for *** ***** *****.

**** ** *******, *** please ***** **** *** vendor ********** *** ******** before *** ******. **** a ******* ******** ************ review *** ************** ****** you ** *******.

**** ******** *** ******** reasons. *** *** ***** Hik?

Avatar

John Scanlan

IPVM | IPVMU Certified | 05/13/20 04:35pm

******: **** ****** *** been ******* ** ******* that,despite ** ***** * months ***** *** ***** release, ***** ** ** progress ** ***** ** with ******* ** *** Dahua / ****** ************. Dahua *** *** ********* to *** ******* *** Pepper ********* *******:

***** ******** **********, ** do *** **** ******* on *** **** ******* to ***** ** **** time.

Avatar

Jon Dillabaugh

Pro Focus LLC
05/15/20 03:22pm

*** **** ****** ****** STRONG ** *** **** above *** ***** ***** guys. **** ***** ***** would **** ****. *** honest ***** **** **** AVERAGE. 🤣

Undisclosed Distributor #5

In reply to Jon Dillabaugh | 05/17/20 10:36pm

***, *** ******** ***** true.

Read this IPVM report for free.

This article is part of IPVM's 6,536 reports, 881 tests and is only available to members. To get a one-time preview of our work, enter your work email to access the full article.

Already a member? Login here | Join now

Related Reports

Verkada Falsely Claims "First Native Cloud-based Access Control and Video Security Solution" on Jun 18, 2020
Verkada's false claims continue, this time to be the first native cloud-based...
Dahua Buenos Aires Bus Screening Violates IEC Standards and Dahua's Own Instructions on Jun 30, 2020
Dahua has promoted Buenos Aires bus deployments as "solutions that facilitate...
Startup Rhombus Presents Cloud Managed Physical Security on Sep 02, 2020
Rhombus Systems, a closed camera, analytics and cloud VMS alternative to...
US GSA Explains NDAA 889 Part B Blacklisting on Jul 31, 2020
With the 'Blacklist Clause' going into effect August 13 that bans the US...
Honeywell Warns of Huawei, Advocates Futureproofing on Aug 31, 2020
For years, Honeywell has profited from OEMing Dahua and using Huawei...
HID Presents Mercury Security & Aero Access Controllers on Aug 25, 2020
HID presented Mercury Security & Aero Access Controllers at the 2020 IPVM...
Sunell is The First China Manufacturer to Market NDAA Compliance on Jul 30, 2020
Most China manufacturers are going to be impacted by the NDAA 'Blacklist...
Dahua, Hikvision, ZKTeco Face Mask Detection Shootout on Jun 19, 2020
Temperature tablets with face mask detection are one of the hottest trends in...
SenseB4 Presents Cloud Network Device Monitoring on Jun 09, 2020
SenseB4 presented its cybersecurity and network health monitoring products at...
HID Releases VertX Replacement Aero on Aug 10, 2020
HID is replacing two established and broadly supported types of access...
The Insecure Verkada Access Control System on Jun 25, 2020
While Verkada touts the security of its system and that how their new door...
Integrator Acquisitions 'A Good Market' During COVID-19, Says Greybeards on Jul 28, 2020
Industry broker Ron Davis of the "Greybeards" says that the integrator and...
Hanwha Face Mask Detection Tested on Jul 01, 2020
Face mask detection or, more specifically lack-of-face-mask detection, is an...
Exit Devices For Access Control Tutorial on Aug 25, 2020
Exit Devices, also called 'Panic Bars' or 'Crash Bars' are required by safety...
Face Masks Increase Face Recognition Errors Says NIST on Aug 04, 2020
COVID-19 has led to widespread facemask use, which as IPVM testing has shown...

Recent Reports

New Products Show Fall 2020 Starts Tomorrow! on Sep 27, 2020
Tomorrow, IPVM's sixth online show will feature New Products from over 25...
OnTech Smart Services Partners With Google and Amazon To Compete With Integrators on Sep 25, 2020
A pain point for many homeowners to use consumer security and surveillance is...
The Future of Metalens For Video Surveillance Cameras - MIT / UMass / Immervision on Sep 25, 2020
Panoramic cameras using 'fisheye' lens have become commonplace in video...
Hikvision Sues Over Brazilian Airport Loss on Sep 24, 2020
Hikvision was excluded from a Brazilian airport project because it is owned...
China General Chamber of Commerce Calls Out US Politics on Sep 24, 2020
While US-China relations are at an all-time low, optimism about relations...
Verkada Disruptive Embedded Live Help on Sep 24, 2020
Call up your integrator? Have someone come by the next day? Verkada is...
IP Networking Course Fall 2020 - Last Chance - Register Now on Sep 23, 2020
Today is the last chance to register for the only IP networking course...
Drain Wire For Access Control Reader Tutorial on Sep 23, 2020
An easy-to-miss cabling specification plays a key role in access control, yet...
Norway Council of Ethics Finds Hikvision Human Rights Abuses "Ongoing" on Sep 23, 2020
Hikvision's involvement in "serious human rights abuse" in Xinjiang is...
IPVM Camera Calculator User Manual / Guide on Sep 23, 2020
Learn how to use the IPVM Camera Calculator (updated for Version 3.1). The...
Installation Course Fall 2020 - Save $50 - Last Chance on Sep 22, 2020
This is a unique installation course in a market where little practical...
SimpliSafe Business Security Launched Examined on Sep 22, 2020
SimpliSafe has launched "SimpliSafe Business Security" that the company...
FLIR CEO: Many New Fever Entrants "Making Claims That The Science Just Won't Support" on Sep 22, 2020
FLIR's CEO joins a growing number calling out risks with fever / screening...
China Bems Temperature Measurement Terminal Tested on Sep 22, 2020
Guangzhou Bems (brand Benshi) is the manufacturer behind temperature...