Dahua Won't Say, But Anyone With Telnet Enabled Is At Risk

By: Brian Karas, Published on Oct 05, 2016

Dahua has decided not to provide details they have about how hackers are exploiting their products. They explained:

A public statement about what technology is in place and which models have certain security features would serve as a beacon to hackers to attempt to infiltrate older-model Dahua products. We do not wish to put our customers at risk to such hackers.

Instead, Dahua's communication focuses on Dahua models running firmware releases prior to January 2015. Because of Dahua's fractured distribution / OEM model and historically poor firmware upgrade offering, many devices purchased after January 2015 are at risk.

In this note, we examine why telnet is critical to the Dahua hacks and what you should do about it.

***** *** ******* *** to ******* ******* **** have ***** *** ******* are ********** ***** ********. They *********:

* ****** ********* ***** what ********** ** ** place *** ***** ****** have ******* ******** ******** would ***** ** * beacon ** ******* ** attempt ** ********** *****-***** Dahua ********. ** ** not **** ** *** our ********* ** **** to **** *******.

*******, *****'* ************* ******* on ***** ****** ******* firmware ******** ***** ** January ****. ******* ** Dahua's ********* ************ / OEM ***** *** ************ poor ******** ******* ********, many ******* ********* ***** January **** *** ** ****.

** **** ****, ** examine *** ****** ** critical ** *** ***** hacks *** **** *** should ** ***** **.

[***************]

Three Core ******

*** **** **************** ** ****** ******* like ***** *** **** propagate ****** ** *** devices *************.

** ******* ** ***** **** issues:

  • ****** ****** ** *** camera/recorder. ** ***** **** recently ***** ******* *** recorders (*** ********** **** of ***** ****) *** ****** permanently ******* *** ***** could *** ****** ****.
  • ******* ********* *** *********.
  • ********** ********* ****** ** *** camera **** **** ******* arbitrary **** ********** ** attackers.

**** *** ***** ******** gains ****** ** *** device, ** ******** *** executes ********* ****. ***** can ******* *** ***** two ******, ***** ** describe *****, *** **** no ******* **** *** Dahua ********** *** **** operating ****** ** ***** devices. ****, ****** ******* using *** *******, *** occur *** ***** ** Dahua ******** ****** ** vigilant ***** ********** ***** devices *** ********.

Three Steps ** ******** **** ********

***** *** ***** ******* ****** users *** ** ** reduce ***** **** ** infection ** **** (*** other) *******:

  • ******* ********
  • ****** ******* *********
  • ****** ****** ** ********

Upgrade ********

**** ** *** **** critical *********, ******* ****** access ***** *** ** method ** ******* ** the ******. ** **** *** ***** firmware *** ******* ****** **********, ******* older ******** *** ****** enabled *** ** ***** for *** **** ** disable **.

***** *** ********* ******** downloads ** ***** ******* ****, ***** ** ***** countries **** **** ** utilize ******* ***** ********* in ***** ******. *** **** to **** *** ***** number, ***** ****** ** printed ** *** ******, or ********* ** *** web ** ** **** device ** ***** ** find *** ****** ******** download. *** ********* ********** shows *** ****** **** for * ***** ******, available ***** *** "***********" section ** *** *** UI ** *** ******, you *** **** *** the ******** ***** **** shows ** ***** ******* that ****** ** ********:

Change ******* *********

*** ***** ******* **** a ****-***** **** ** usernames *** ********* ** try **** ********* *******. There *** ** ***** combinations, ********* ******* *****'* like "*****/*****" *** "*****/********". Strong ********* *** ***********, but *********** ******** ***** than * ****** ******* password ****** ******* ********* by *** ******* *******.

Verify ****** ** ********

****** ****** ** ******** after ******** ** ******** to * ***** *******, but ** ** **** to ****** ** ** truly ********. *** *** to ***** ***** ***** are **** ** ***** ****, ** * variant **** ******, ***** ** **** in *** ***** *****:

What ** ** ** *** *** *** ******* ********

***** ** ***** *** products, ** ***** **** are ****** ** **** a ******** ****** *** their ****** ***** **** options ** ******* **********. Changing *** ******* ********* will ******* ********* **** gaining ****** *** *****. Disabling ****** (**** **) on ****** ****-********** ***** will ******* *** ******* from ********** ** *** camera ** *** ***** place, ******** ****** **** if *** ********* *** more ******* ********/******** ******.

Dahua ************* *****

***** *** ****** ******** **** ********* guide [**** ** ****** available], ***** ********* ****** common *********** **** ******** passwords, ***** ****** *********, and **** ********** ******** ports. ** **** *** specifically ******* ****** ** disabling ****** ******, ****** by ******* ***** ** only ******* ******** ***** it **** ******* **** indirectly.

 

Comments (9)

The first core issue listed is telnet access. Isn't telnet in most cases blocked by the firewall to the internet or is this malware spreading from the LAN itself?

Also, as for changing passwords, didn't Dahua have hard coded known usernames and passwords that couldn't be changed?

They had 888888 accounts in the old fimware that couldn't be deleted, but they could only be used locally. Maybe even older models you could?

If there are models that do allow access remotely thru a unchangeble admin acct, then whether telnet can be disabled is relevant.

Otherwise, its really on whomever didnt change the password.

Yes, until recently, all Dahua cameras could be accessed via Telnet with admin/admin, even if you changed the admin password to something else. The changing of the admin password only restricted http web browser access. All other services still allowed admin/admin credentials, including ONVIF.

So that makes it sound like the only real fix here is to update the firmware assuming there is firmware through all the OEM brands to upgrade to.

If you are using white label OEM products, just find files with General rather than DH in the header. SavvyTech hosts a number of firmware files themselves and if you need more help finding firmware updates, please feel free to contact me. I can assist with cross referencing your model number and ensuring your update goes smoothly. Just um...if you want the super shiny 2.6 firmware that I got John Dillabaugh...I found out that it was not supposed to be released yet >.>

They'll release it officially when IVS gets rebuilt. Oh and I think it'll have Control4 compatibility and it already has Smart H.264+!

Regardless, I'm here to help!

Isn't telnet in most cases blocked by the firewall to the internet or is this malware spreading from the LAN itself?

In most cases, yes, it should be blocked, but clearly there are hundreds of thousands of cameras that do not have it blocked.

The malware should not be able to spread via LAN at all, in fact if you look at the Mirai source code, the part that assembles a random IP address to scan specifically excludes local IP's, and certain other networks:

Also, as for changing passwords, didn't Dahua have hard coded known usernames and passwords that couldn't be changed?

This seems to vary product. US OEM's, DahuaUSA official product, and overseas (and imported gray market cameras) all seem to have different behaviors here.

I spoke with an integrator who had used Dahua OEM product from ~2011 onward, and those had admin/admin hard-coded and seemingly unchangeable. Dahua USA "official" products have been recent, and so their firmware has telnet disabled by default. I have some Dahua graymarket Amazon cameras where the telnet admin password changes with the web UI admin password.

All of the above is what makes it very difficult for users to know if they are affected. Part of the problem lies in exactly which variant of a Dahua camera you have. Oddly enough people who bought through official channels (Dahua OEMs) may be at much higher risk than people who bought through rogue importers.

You can not always blame the manufacture. A lot of Security techs are not properly trained in IP systems and create vulnerabilities. They leave default passwords and open ports in firewalls that are not required.

A lot of Security techs are not properly trained in IP systems and create vulnerabilities.

But there would be no vulnerability here if the manufacturer closed Telnet? And it is not as if Telnet is something that is commonly needed out of the box. Yes/no?

Correct Telnet should be disabled OOB, and only enabled if and when needed.

Login to read this IPVM report.
Why do I need to log in?
IPVM conducts unique testing and research funded by member's payments enabling us to offer the most independent, accurate and in-depth information.

Related Reports

Subnetting for Video Surveillance on Apr 30, 2019
This guide explains when subnetting is used on security networks, and how it works. We explain how to add or remove IP addresses to your range,...
LifeSafety Power NetLink Vulnerabilities And Problematic Response on May 20, 2019
'Power supplies' are not devices that many think about when considering vulnerabilities but as more and more devices go 'online', the risks for...
Vivotek Trend Micro Cyber Security Camera App Tested on Jul 22, 2019
Vivotek and Trend Micro are claiming five million blocked attacks on IP cameras, with their jointly developed app for Vivotek cameras. This new...
Dahua Wiretapping Vulnerability on Aug 02, 2019
IPVM has validated, with testing, and from Dahua, that many Dahua cameras have a wiretapping vulnerability. Even if the camera's audio has been...
Hikvision OEM Directory on Aug 13, 2019
The Chinese government-owned and US-government banned Hikvision has become the world's largest video surveillance manufacturer and generally hidden...
Uniview OEM Directory on Sep 11, 2019
This directory lists 20+ companies that OEM products from Uniview, with a graphic and links to company websites below. It does not cover all...
Critical Vulnerability Across 18+ Network Switch Vendors: Cisco, Netgear, More on Aug 26, 2019
Cisco, Netgear and more than a dozen other brands, including small Asian ones, have been found to share the same critical vulnerability, discovered...
ONVIF Exposure To "Devastating DDoS Attacks" Examined on Sep 06, 2019
ZDnet reported "Protocol used by 630,000 devices can be abused for devastating DDoS attacks", citing exposure of ONVIF devices. And after an...
Dahua New Critical Vulnerability 2019 on Sep 23, 2019
Dahua has quietly admitted 5 new vulnerabilities including 1 critical vulnerability with a 9.8 / 10.0 CVSS score and 2 high vulnerabilities (scored...
Remote Access (DDNS vs P2P vs VPN) Usage Statistics on Oct 25, 2019
Remote access can make systems more usable but also more vulnerable. How are integrators delivring remote access in 2019? How many are using...

Most Recent Industry Reports

Intersec 2020 Final Show Report on Jan 21, 2020
IPVM spent all 3 days at the Intersec 2020 show interviewing various companies and finding key trends. We cover: Middle East Enterprise...
Vehicle & Long Range Access Reader Tutorial on Jan 21, 2020
One of the classic challenges for access control are parking lots and garages, where the user's credential is far from the reader. With modern...
Clearview AI Alarm - NY Times Report Says "Might End Privacy" on Jan 20, 2020
Over the weekend, the NY Times released a report titled "The Secretive Company That Might End Privacy as We Know It" about a company named...
Favorite Camera Manufacturers 2020 on Jan 20, 2020
The past 2 years of US bans and sanctions have shaken the video surveillance industry but what impact would this have on integrators' favorite...
"Severely Impacted" Mercury Security 2020 Leap Year Firmware Issue on Jan 17, 2020
One of the largest access controller manufacturers has a big problem: February 29th. Mercury Security, owned by HID, is alerting partners of the...
Apple Acquires XNOR.ai, Loss For The Industry on Jan 16, 2020
Apple has acquired XNOR.ai for $200 million, reports GeekWire. This is a loss for the video surveillance industry. XNOR.ai stunned the industry...
Installation Course January 2020 - Last Chance on Jan 16, 2020
Thursday, January 16th is your last chance to register for the Winter 2020 Video Surveillance Installation Course. This is a unique installation...
Halo Smart Vape Detector Tested on Jan 16, 2020
The Halo Smart Sensor claims to detect vaping, including popular brand Juul and even THC vapes. But how well does it work in real world...
PRC Government Entity Now Controlling Shareholder of Infinova / March Networks on Jan 16, 2020
A PRC government entity is now the controlling shareholder of US security manufacturer Infinova as well as its wholly-owned subsidiary March...
Network Cabling for Video Surveillance on Jan 15, 2020
In this guide, we explain the fundamentals of network cabling for video surveillance networks, how they should be installed, and the differences in...