Dahua Won't Say, But Anyone With Telnet Enabled Is At Risk

Author: Brian Karas, Published on Oct 05, 2016

Dahua has decided not to provide details they have about how hackers are exploiting their products. They explained:

A public statement about what technology is in place and which models have certain security features would serve as a beacon to hackers to attempt to infiltrate older-model Dahua products. We do not wish to put our customers at risk to such hackers.

Instead, Dahua's communication focuses on Dahua models running firmware releases prior to January 2015. Because of Dahua's fractured distribution / OEM model and historically poor firmware upgrade offering, many devices purchased after January 2015 are at risk.

In this note, we examine why telnet is critical to the Dahua hacks and what you should do about it.

***** *** ******* *** ** ******* ******* **** **** ***** how ******* *** ********** ***** ********. **** *********:

* ****** ********* ***** **** ********** ** ** ***** *** which ****** **** ******* ******** ******** ***** ***** ** * beacon ** ******* ** ******* ** ********** *****-***** ***** ********. We ** *** **** ** *** *** ********* ** **** to **** *******.

*******, *****'* ************* ******* ** ***** ****** ******* ******** ******** prior ** ******* ****. ******* ** *****'* ********* ************ / OEM ***** *** ************ **** ******** ******* ********, **** ******* purchased ***** ******* **** *** ** ****.

** **** ****, ** ******* *** ****** ** ******** ** the ***** ***** *** **** *** ****** ** ***** **.

[***************]

Three Core ******

*** **** **************** ** ****** ******* **** ***** *** **** ********* ****** to *** ******* *************.

** ******* ** ***** **** ******:

  • ****** ****** ** *** ******/********. ** ***** **** ******** ***** cameras *** ********* (*** ********** **** ** ***** ****) *** ****** permanently ******* *** ***** ***** *** ****** ****.
  • ******* ********* *** *********.
  • ********** ********* ****** ** *** ****** **** **** ******* ********* **** downloaded ** *********.

**** *** ***** ******** ***** ****** ** *** ******, ** installs *** ******** ********* ****. ***** *** ******* *** ***** two ******, ***** ** ******** *****, *** **** ** ******* over *** ***** ********** *** **** ********* ****** ** ***** devices. ****, ****** ******* ***** *** *******, *** ***** *** users ** ***** ******** ****** ** ******** ***** ********** ***** devices *** ********.

Three Steps ** ******** **** ********

***** *** ***** ******* ****** ***** *** ** ** ****** ***** risk ** ********* ** **** (*** *****) *******:

  • ******* ********
  • ****** ******* *********
  • ****** ****** ** ********

Upgrade ********

**** ** *** **** ******** *********, ******* ****** ****** ***** has ** ****** ** ******* ** *** ******. ** **** *** ***** firmware *** ******* ****** **********, ******* ***** ******** *** ****** ******* *** no ***** *** *** **** ** ******* **.

***** *** ********* ******** ********* ** ***** ******* ****, ***** ** ***** ********* **** **** ** ******* ******* Dahua ********* ** ***** ******. *** **** ** **** *** ***** number, ***** ****** ** ******* ** *** ******, ** ********* in *** *** ** ** **** ****** ** ***** ** find *** ****** ******** ********. *** ********* ********** ***** *** device **** *** * ***** ******, ********* ***** *** "***********" section ** *** *** ** ** *** ******, *** *** also *** *** ******** ***** **** ***** ** ***** ******* that ****** ** ********:

Change ******* *********

*** ***** ******* **** * ****-***** **** ** ********* *** passwords ** *** **** ********* *******. ***** *** ** ***** combinations, ********* ******* *****'* **** "*****/*****" *** "*****/********". ****** ********* are ***********, *** *********** ******** ***** **** * ****** ******* password ****** ******* ********* ** *** ******* *******.

Verify ****** ** ********

****** ****** ** ******** ***** ******** ** ******** ** * newer *******, *** ** ** **** ** ****** ** ** truly ********. *** *** ** ***** ***** ***** *** **** is ***** ****, ** * ******* **** ******, ***** ** **** ** *** ***** *****:

What ** ** ** *** *** *** ******* ********

***** ** ***** *** ********, ** ***** **** *** ****** to **** * ******** ****** *** ***** ****** ***** **** options ** ******* **********. ******** *** ******* ********* **** ******* attackers **** ******* ****** *** *****. ********* ****** (**** **) on ****** ****-********** ***** **** ******* *** ******* **** ********** to *** ****** ** *** ***** *****, ******** ****** **** if *** ********* *** **** ******* ********/******** ******.

Dahua ************* *****

***** *** ****** ******** **** ********* *****, ***** ********* ****** ****** *********** **** ******** *********, ***** strong *********, *** **** ********** ******** *****. ** **** *** specifically ******* ****** ** ********* ****** ******, ****** ** ******* users ** **** ******* ******** ***** ** **** ******* **** indirectly.

 

Comments (9)

The first core issue listed is telnet access. Isn't telnet in most cases blocked by the firewall to the internet or is this malware spreading from the LAN itself?

Also, as for changing passwords, didn't Dahua have hard coded known usernames and passwords that couldn't be changed?

They had 888888 accounts in the old fimware that couldn't be deleted, but they could only be used locally. Maybe even older models you could?

If there are models that do allow access remotely thru a unchangeble admin acct, then whether telnet can be disabled is relevant.

Otherwise, its really on whomever didnt change the password.

Yes, until recently, all Dahua cameras could be accessed via Telnet with admin/admin, even if you changed the admin password to something else. The changing of the admin password only restricted http web browser access. All other services still allowed admin/admin credentials, including ONVIF.

So that makes it sound like the only real fix here is to update the firmware assuming there is firmware through all the OEM brands to upgrade to.

If you are using white label OEM products, just find files with General rather than DH in the header. SavvyTech hosts a number of firmware files themselves and if you need more help finding firmware updates, please feel free to contact me. I can assist with cross referencing your model number and ensuring your update goes smoothly. Just um...if you want the super shiny 2.6 firmware that I got John Dillabaugh...I found out that it was not supposed to be released yet >.>

They'll release it officially when IVS gets rebuilt. Oh and I think it'll have Control4 compatibility and it already has Smart H.264+!

Regardless, I'm here to help!

Isn't telnet in most cases blocked by the firewall to the internet or is this malware spreading from the LAN itself?

In most cases, yes, it should be blocked, but clearly there are hundreds of thousands of cameras that do not have it blocked.

The malware should not be able to spread via LAN at all, in fact if you look at the Mirai source code, the part that assembles a random IP address to scan specifically excludes local IP's, and certain other networks:

Also, as for changing passwords, didn't Dahua have hard coded known usernames and passwords that couldn't be changed?

This seems to vary product. US OEM's, DahuaUSA official product, and overseas (and imported gray market cameras) all seem to have different behaviors here.

I spoke with an integrator who had used Dahua OEM product from ~2011 onward, and those had admin/admin hard-coded and seemingly unchangeable. Dahua USA "official" products have been recent, and so their firmware has telnet disabled by default. I have some Dahua graymarket Amazon cameras where the telnet admin password changes with the web UI admin password.

All of the above is what makes it very difficult for users to know if they are affected. Part of the problem lies in exactly which variant of a Dahua camera you have. Oddly enough people who bought through official channels (Dahua OEMs) may be at much higher risk than people who bought through rogue importers.

You can not always blame the manufacture. A lot of Security techs are not properly trained in IP systems and create vulnerabilities. They leave default passwords and open ports in firewalls that are not required.

A lot of Security techs are not properly trained in IP systems and create vulnerabilities.

But there would be no vulnerability here if the manufacturer closed Telnet? And it is not as if Telnet is something that is commonly needed out of the box. Yes/no?

Correct Telnet should be disabled OOB, and only enabled if and when needed.

Login to read this IPVM report.
Why do I need to log in?
IPVM conducts unique testing and research funded by member's payments enabling us to offer the most independent, accurate and in-depth information.

Related Reports on Hacking

No GDPR Penalties For UK Swann 'Spying Hack' on Nov 20, 2018
The UK’s data protection agency has closed its investigation into Infinova-owned Swann Security UK, the ICO confirmed to IPVM, deciding to take “no...
Winter 2019 IP Networking Course on Nov 05, 2018
This is the only networking course designed specifically for video surveillance professionals.  Lots of network training exists but none of it...
HID: Stop Selling Cracked 125 kHz Credentials on Nov 05, 2018
HID should stop selling cracked 125 kHz access control credentials, that have been long cracked and can easily be copied by cheap cloners sold on...
"New Zealand Govt Uses Chinese Cameras Banned In US", Considers Security Audit on Oct 12, 2018
Newsroom NZ has issued a report: "NZ Govt uses Chinese cameras banned in US": This comes after the US federal government banned purchases of...
China Hacks Video Servers Causing Uproar on Oct 05, 2018
An incident causing an international uproar is hitting home in the video surveillance industry as a Bloomberg report, "The Big Hack: How China...
Genetec Takes Aim At 'Untrustworthy' 'Foreign Government-Owned Vendors' on Sep 24, 2018
Genetec is taking aim at 'untrustworthy' 'foreign government-owned vendors'. This is not a new theme for Genetec as nearly 2 years ago, Genetec...
Hikvision FIPS 140-2 Cybersecurity Certification Examined on Aug 27, 2018
A week after the US government passed a law banning Hikvision, Hikvision announced it had obtained a FIPS 140-2 certification from the US...
Sony Gen 5 IP Cameras Critical Vulnerabilities on Jul 26, 2018
Cybersecurity vulnerabilities remain prevalent in video surveillance devices. Now Talos researchers have discovered multiple vulnerabilities in...
Hikvision Corrects False Cybersecurity Announcement on Jun 18, 2018
Hikvision has corrected a false cybersecurity announcement that claimed a British government-sponsored program endorsed the cybersecurity of...
The Dumb Ones: PSA's Bozeman On Cybersecurity on Jun 15, 2018
The smart ones are the hundred people who flew to Denver and spent $500+ on a 1.5-day conference featuring (now US government banned) Dahua as a...

Most Recent Industry Reports

Openpath Access Control Tested on Nov 20, 2018
Big investment in access startups is uncommon, but Openpath has recently attracted $20 million doing just that. The company has limited security...
No GDPR Penalties For UK Swann 'Spying Hack' on Nov 20, 2018
The UK’s data protection agency has closed its investigation into Infinova-owned Swann Security UK, the ICO confirmed to IPVM, deciding to take “no...
Milestone Disrupts Milestone With Arcules on Nov 19, 2018
Milestone is now competing against... Milestone's own spinout Arcules. New IPVM testing shows that Arcules has incorporated a substantial amount...
Pressure Mounts Against Dahua and Hikvision Xinjiang Business on Nov 19, 2018
Pressure is mounting against Hikvision, Dahua, and other companies operating in Xinjiang as an international outcry brews against the Chinese...
Arcules Cloud VMS Tested on Nov 19, 2018
Arcules is a big bet, or as they describe themselves a 'bold company', spun out and backed by Milestone and Canon.  But how good is Arcules cloud...
'Sticker' Surveillance Camera Developed (CSEM Witness) on Nov 16, 2018
The Swiss Center for Electronics and Microtechnology (CSEM) has announced what it calls the: world’s first fully autonomous camera that can be...
ISC East 2018 Mini-Show Final Report on Nov 16, 2018
This is our second (updated) and final show report from ISC East. ISC East, by its own admission, is not a national or international show, billed...
Facial Detection Tested on Nov 16, 2018
Facial detection and recognition are increasingly offered by video surveillance manufacturers. Facial detection detects faces in an image/video...
Throughtek P2P/Cloud Solution Profile on Nov 15, 2018
Many IoT manufacturers either do not have the capabilities or the interest to develop their own cloud management software for their devices....
ASIS Offering Custom Research For Manufacturers on Nov 15, 2018
Manufacturers often want to know what industry people think about trends and, in particular, the segments and product they offer.  ASIS and its...

The world's leading video surveillance information source, IPVM provides the best reporting, testing and training for 10,000+ members globally. Dedicated to independent and objective information, we uniquely refuse any and all advertisements, sponsorship and consulting from manufacturers.

About | FAQ | Contact