Dahua Won't Say, But Anyone With Telnet Enabled Is At Risk

By: Brian Karas, Published on Oct 05, 2016

Dahua has decided not to provide details they have about how hackers are exploiting their products. They explained:

A public statement about what technology is in place and which models have certain security features would serve as a beacon to hackers to attempt to infiltrate older-model Dahua products. We do not wish to put our customers at risk to such hackers.

Instead, Dahua's communication focuses on Dahua models running firmware releases prior to January 2015. Because of Dahua's fractured distribution / OEM model and historically poor firmware upgrade offering, many devices purchased after January 2015 are at risk.

In this note, we examine why telnet is critical to the Dahua hacks and what you should do about it.

***** *** ******* *** to ******* ******* **** have ***** *** ******* are ********** ***** ********. They *********:

* ****** ********* ***** what ********** ** ** place *** ***** ****** have ******* ******** ******** would ***** ** * beacon ** ******* ** attempt ** ********** *****-***** Dahua ********. ** ** not **** ** *** our ********* ** **** to **** *******.

*******, *****'* ************* ******* on ***** ****** ******* firmware ******** ***** ** January ****. ******* ** Dahua's ********* ************ / OEM ***** *** ************ poor ******** ******* ********, many ******* ********* ***** January **** *** ** ****.

** **** ****, ** examine *** ****** ** critical ** *** ***** hacks *** **** *** should ** ***** **.

[***************]

Three Core ******

*** **** **************** ** ****** ******* like ***** *** **** propagate ****** ** *** devices *************.

** ******* ** ***** **** issues:

  • ****** ****** ** *** camera/recorder. ** ***** **** recently ***** ******* *** recorders (*** ********** **** of ***** ****) *** ****** permanently ******* *** ***** could *** ****** ****.
  • ******* ********* *** *********.
  • ********** ********* ****** ** *** camera **** **** ******* arbitrary **** ********** ** attackers.

**** *** ***** ******** gains ****** ** *** device, ** ******** *** executes ********* ****. ***** can ******* *** ***** two ******, ***** ** describe *****, *** **** no ******* **** *** Dahua ********** *** **** operating ****** ** ***** devices. ****, ****** ******* using *** *******, *** occur *** ***** ** Dahua ******** ****** ** vigilant ***** ********** ***** devices *** ********.

Three Steps ** ******** **** ********

***** *** ***** ******* ****** users *** ** ** reduce ***** **** ** infection ** **** (*** other) *******:

  • ******* ********
  • ****** ******* *********
  • ****** ****** ** ********

Upgrade ********

**** ** *** **** critical *********, ******* ****** access ***** *** ** method ** ******* ** the ******. ** **** *** ***** firmware *** ******* ****** **********, ******* older ******** *** ****** enabled *** ** ***** for *** **** ** disable **.

***** *** ********* ******** downloads ** ***** ******* ****, ***** ** ***** countries **** **** ** utilize ******* ***** ********* in ***** ******. *** **** to **** *** ***** number, ***** ****** ** printed ** *** ******, or ********* ** *** web ** ** **** device ** ***** ** find *** ****** ******** download. *** ********* ********** shows *** ****** **** for * ***** ******, available ***** *** "***********" section ** *** *** UI ** *** ******, you *** **** *** the ******** ***** **** shows ** ***** ******* that ****** ** ********:

Change ******* *********

*** ***** ******* **** a ****-***** **** ** usernames *** ********* ** try **** ********* *******. There *** ** ***** combinations, ********* ******* *****'* like "*****/*****" *** "*****/********". Strong ********* *** ***********, but *********** ******** ***** than * ****** ******* password ****** ******* ********* by *** ******* *******.

Verify ****** ** ********

****** ****** ** ******** after ******** ** ******** to * ***** *******, but ** ** **** to ****** ** ** truly ********. *** *** to ***** ***** ***** are **** ** ***** ****, ** * variant **** ******, ***** ** **** in *** ***** *****:

What ** ** ** *** *** *** ******* ********

***** ** ***** *** products, ** ***** **** are ****** ** **** a ******** ****** *** their ****** ***** **** options ** ******* **********. Changing *** ******* ********* will ******* ********* **** gaining ****** *** *****. Disabling ****** (**** **) on ****** ****-********** ***** will ******* *** ******* from ********** ** *** camera ** *** ***** place, ******** ****** **** if *** ********* *** more ******* ********/******** ******.

Dahua ************* *****

***** *** ****** ******** **** ********* guide [**** ** ****** available], ***** ********* ****** common *********** **** ******** passwords, ***** ****** *********, and **** ********** ******** ports. ** **** *** specifically ******* ****** ** disabling ****** ******, ****** by ******* ***** ** only ******* ******** ***** it **** ******* **** indirectly.

 

Comments (9)

The first core issue listed is telnet access. Isn't telnet in most cases blocked by the firewall to the internet or is this malware spreading from the LAN itself?

Also, as for changing passwords, didn't Dahua have hard coded known usernames and passwords that couldn't be changed?

They had 888888 accounts in the old fimware that couldn't be deleted, but they could only be used locally. Maybe even older models you could?

If there are models that do allow access remotely thru a unchangeble admin acct, then whether telnet can be disabled is relevant.

Otherwise, its really on whomever didnt change the password.

Yes, until recently, all Dahua cameras could be accessed via Telnet with admin/admin, even if you changed the admin password to something else. The changing of the admin password only restricted http web browser access. All other services still allowed admin/admin credentials, including ONVIF.

So that makes it sound like the only real fix here is to update the firmware assuming there is firmware through all the OEM brands to upgrade to.

If you are using white label OEM products, just find files with General rather than DH in the header. SavvyTech hosts a number of firmware files themselves and if you need more help finding firmware updates, please feel free to contact me. I can assist with cross referencing your model number and ensuring your update goes smoothly. Just um...if you want the super shiny 2.6 firmware that I got John Dillabaugh...I found out that it was not supposed to be released yet >.>

They'll release it officially when IVS gets rebuilt. Oh and I think it'll have Control4 compatibility and it already has Smart H.264+!

Regardless, I'm here to help!

Isn't telnet in most cases blocked by the firewall to the internet or is this malware spreading from the LAN itself?

In most cases, yes, it should be blocked, but clearly there are hundreds of thousands of cameras that do not have it blocked.

The malware should not be able to spread via LAN at all, in fact if you look at the Mirai source code, the part that assembles a random IP address to scan specifically excludes local IP's, and certain other networks:

Also, as for changing passwords, didn't Dahua have hard coded known usernames and passwords that couldn't be changed?

This seems to vary product. US OEM's, DahuaUSA official product, and overseas (and imported gray market cameras) all seem to have different behaviors here.

I spoke with an integrator who had used Dahua OEM product from ~2011 onward, and those had admin/admin hard-coded and seemingly unchangeable. Dahua USA "official" products have been recent, and so their firmware has telnet disabled by default. I have some Dahua graymarket Amazon cameras where the telnet admin password changes with the web UI admin password.

All of the above is what makes it very difficult for users to know if they are affected. Part of the problem lies in exactly which variant of a Dahua camera you have. Oddly enough people who bought through official channels (Dahua OEMs) may be at much higher risk than people who bought through rogue importers.

You can not always blame the manufacture. A lot of Security techs are not properly trained in IP systems and create vulnerabilities. They leave default passwords and open ports in firewalls that are not required.

A lot of Security techs are not properly trained in IP systems and create vulnerabilities.

But there would be no vulnerability here if the manufacturer closed Telnet? And it is not as if Telnet is something that is commonly needed out of the box. Yes/no?

Correct Telnet should be disabled OOB, and only enabled if and when needed.

Login to read this IPVM report.
Why do I need to log in?
IPVM conducts unique testing and research funded by member's payments enabling us to offer the most independent, accurate and in-depth information.

Related Reports

China DVR/NVR Backdoor Discovered, Huawei Refutes on Feb 07, 2020
A backdoor was found in Chinese-produced DVRs and NVRs that secretly allowed access to the recorders. While it was first attributed to Huawei...
Remote Access (DDNS vs P2P vs VPN) Usage Statistics 2019 on Oct 25, 2019
Remote access can make systems more usable but also more vulnerable. How are integrators delivring remote access in 2019? How many are using...
Dahua New Critical Vulnerability 2019 on Sep 23, 2019
Dahua has quietly admitted 5 new vulnerabilities including 1 critical vulnerability with a 9.8 / 10.0 CVSS score and 2 high vulnerabilities (scored...
Uniview OEM Directory on Sep 11, 2019
This directory lists 20+ companies that OEM products from Uniview, with a graphic and links to company websites below. It does not cover all...
ONVIF Exposure To "Devastating DDoS Attacks" Examined on Sep 06, 2019
ZDnet reported "Protocol used by 630,000 devices can be abused for devastating DDoS attacks", citing exposure of ONVIF devices. And after an...
Critical Vulnerability Across 18+ Network Switch Vendors: Cisco, Netgear, More on Aug 26, 2019
Cisco, Netgear and more than a dozen other brands, including small Asian ones, have been found to share the same critical vulnerability, discovered...
Dahua Wiretapping Vulnerability on Aug 02, 2019
IPVM has validated, with testing, and from Dahua, that many Dahua cameras have a wiretapping vulnerability. Even if the camera's audio has been...
LifeSafety Power NetLink Vulnerabilities And Problematic Response on May 20, 2019
'Power supplies' are not devices that many think about when considering vulnerabilities but as more and more devices go 'online', the risks for...
Subnetting for Video Surveillance on Apr 30, 2019
This guide explains when subnetting is used on security networks, and how it works. We explain how to add or remove IP addresses to your range,...
HTTPS / SSL Video Surveillance Usage Statistics on Apr 01, 2019
HTTPS / SSL / TLS usage has become commonplace for websites to improve security and, in particular, to help mitigate attackers reading or modifying...

Most Recent Industry Reports

IPVM's 12th Anniversary - Thank You! on Apr 07, 2020
IPVM is proud to celebrate it's 12 anniversary expanding our commitment to providing the industry independent and objective information on video...
Mobotix Thermal Body Temperature Detection Examined on Apr 07, 2020
Mobotix has jumped into the Coronavirus temperature detection market, but how do they compare to thermal incumbents like FLIR or ICI who have been...
Verkada Coronavirus Response: Free Temp Systems For Government and Health Care on Apr 07, 2020
Verkada has built a reputation on giving away things for free - free Yeti Tumblers, free trial cameras and now free temporary systems for...
Hikvision USA Refuses, Dahua USA Drives Forward With "Coronavirus Cameras" on Apr 07, 2020
Both have been federally banned, both sanctioned for human rights abuses but only one - Dahua - is taking aim at the booming "coronavirus cameras"...
China Surveillance Vulnerabilities Being Used To Attack China, Says China on Apr 07, 2020
While China video surveillance vulnerabilities have been much debated in the West in the past few years, China is now saying those vulnerabilities...
USA ICI Elevated Skin Temperature Detectors Examined on Apr 06, 2020
Infrared Cameras, Inc. (ICI) is aiming to help slow the spread of COVID-19 with "pinpoint accurate skin temperature measurement" using their...
Trade Groups Request NDAA Blacklist Delay Citing Coronavirus on Apr 06, 2020
Two trade groups representing government contractors have asked Congress to delay implementation of the NDAA's 'blacklist' clause from this August...
Coronavirus Hits Manufacturers, Standing Now, Worse To Come on Apr 06, 2020
Coronavirus is hitting security manufacturers, though overall modestly for now, with worse expected to come, new IPVM survey results...
FLIR New Coronavirus Prioritized Temperature Screening Camera Examined on Apr 03, 2020
FLIR has announced a new series of thermal cameras "prioritized for entities working to mitigate the spread of COVID-19 virus", the A400/A700...
ADI Branch Burglary on Apr 03, 2020
A security systems distributor branch is an odd target for burglary but that happened this week at ADI's Memphis location. Vehicle Smash &...