Dahua has decided not to provide details they have about how hackers are exploiting their products. They explained:
A public statement about what technology is in place and which models have certain security features would serve as a beacon to hackers to attempt to infiltrate older-model Dahua products. We do not wish to put our customers at risk to such hackers.
Instead, Dahua's communication focuses on Dahua models running firmware releases prior to January 2015. Because of Dahua's fractured distribution / OEM model and historically poor firmware upgrade offering, many devices purchased after January 2015 are at risk.
In this note, we examine why telnet is critical to the Dahua hacks and what you should do about it.
Three Core ******
*** **** **************** ** ****** ******* **** ***** and **** ********* ****** ** *** devices *************.
** ******* ** ***** **** ******:
**** *** ***** ******** ***** ****** to *** ******, ** ******** *** executes ********* ****. ***** *** ******* the ***** *** ******, ***** ** describe *****, *** **** ** ******* over *** ***** ********** *** **** operating ****** ** ***** *******. ****, future ******* ***** *** *******, *** occur *** ***** ** ***** ******** should ** ******** ***** ********** ***** devices *** ********.
Three Steps ** ******** **** ********
***** *** ***** ******* ****** ***** *** do ** ****** ***** **** ** infection ** **** (*** *****) *******:
Upgrade ********
**** ** *** **** ******** *********, without ****** ****** ***** *** ** method ** ******* ** *** ******. ** know the ***** ******** *** ******* ****** **********, ******* older ******** *** ****** ******* *** no ***** *** *** **** ** disable **.
***** *** ********* ******** ********* ** their ******* ****, ***** ** ***** ********* **** need ** ******* ******* ***** ********* in ***** ******. *** **** ** **** the ***** ******, ***** ****** ** printed ** *** ******, ** ********* in *** *** ** ** **** device ** ***** ** **** *** proper ******** ********. *** ********* ********** shows *** ****** **** *** * Dahua ******, ********* ***** *** "***********" section ** *** *** ** ** the ******, *** *** **** *** the ******** ***** **** ***** ** older ******* **** ****** ** ********:
Change ******* *********
*** ***** ******* **** * ****-***** list ** ********* *** ********* ** try **** ********* *******. ***** *** 62 ***** ************, ********* ******* *****'* like "*****/*****" *** "*****/********". ****** ********* are ***********, *** *********** ******** ***** than * ****** ******* ******** ****** prevent ********* ** *** ******* *******.
Verify ****** ** ********
****** ****** ** ******** ***** ******** is ******** ** * ***** *******, but ** ** **** ** ****** it ** ***** ********. *** *** to ***** ***** ***** *** **** is ***** ****, ** * ******* **** Zenmap, ***** ** **** ** *** video *****:
What ** ** ** *** *** *** ******* ********
***** ** ***** *** ********, ** users **** *** ****** ** **** a ******** ****** *** ***** ****** still **** ******* ** ******* **********. Changing *** ******* ********* **** ******* attackers **** ******* ****** *** *****. Disabling ****** (**** **) ** ****** port-forwarding ***** **** ******* *** ******* from ********** ** *** ****** ** the ***** *****, ******** ****** **** if *** ********* *** **** ******* username/password ******.
Dahua ************* *****
***** *** ****** ******** **** ********* ***** [**** no ****** *********], ***** ********* ****** ****** *********** like ******** *********, ***** ****** *********, and **** ********** ******** *****. ** does *** ************ ******* ****** ** disabling ****** ******, ****** ** ******* users ** **** ******* ******** ***** it **** ******* **** **********.
The first core issue listed is telnet access. Isn't telnet in most cases blocked by the firewall to the internet or is this malware spreading from the LAN itself?
Also, as for changing passwords, didn't Dahua have hard coded known usernames and passwords that couldn't be changed?
They had 888888 accounts in the old fimware that couldn't be deleted, but they could only be used locally. Maybe even older models you could?
If there are models that do allow access remotely thru a unchangeble admin acct, then whether telnet can be disabled is relevant.
Otherwise, its really on whomever didnt change the password.
Yes, until recently, all Dahua cameras could be accessed via Telnet with admin/admin, even if you changed the admin password to something else. The changing of the admin password only restricted http web browser access. All other services still allowed admin/admin credentials, including ONVIF.
So that makes it sound like the only real fix here is to update the firmware assuming there is firmware through all the OEM brands to upgrade to.
If you are using white label OEM products, just find files with General rather than DH in the header. SavvyTech hosts a number of firmware files themselves and if you need more help finding firmware updates, please feel free to contact me. I can assist with cross referencing your model number and ensuring your update goes smoothly. Just um...if you want the super shiny 2.6 firmware that I got John Dillabaugh...I found out that it was not supposed to be released yet >.>
They'll release it officially when IVS gets rebuilt. Oh and I think it'll have Control4 compatibility and it already has Smart H.264+!
Regardless, I'm here to help!
Isn't telnet in most cases blocked by the firewall to the internet or is this malware spreading from the LAN itself?
In most cases, yes, it should be blocked, but clearly there are hundreds of thousands of cameras that do not have it blocked.
The malware should not be able to spread via LAN at all, in fact if you look at the Mirai source code, the part that assembles a random IP address to scan specifically excludes local IP's, and certain other networks:
Also, as for changing passwords, didn't Dahua have hard coded known usernames and passwords that couldn't be changed?
This seems to vary product. US OEM's, DahuaUSA official product, and overseas (and imported gray market cameras) all seem to have different behaviors here.
I spoke with an integrator who had used Dahua OEM product from ~2011 onward, and those had admin/admin hard-coded and seemingly unchangeable. Dahua USA "official" products have been recent, and so their firmware has telnet disabled by default. I have some Dahua graymarket Amazon cameras where the telnet admin password changes with the web UI admin password.
All of the above is what makes it very difficult for users to know if they are affected. Part of the problem lies in exactly which variant of a Dahua camera you have. Oddly enough people who bought through official channels (Dahua OEMs) may be at much higher risk than people who bought through rogue importers.
You can not always blame the manufacture. A lot of Security techs are not properly trained in IP systems and create vulnerabilities. They leave default passwords and open ports in firewalls that are not required.
A lot of Security techs are not properly trained in IP systems and create vulnerabilities.
But there would be no vulnerability here if the manufacturer closed Telnet? And it is not as if Telnet is something that is commonly needed out of the box. Yes/no?
Correct Telnet should be disabled OOB, and only enabled if and when needed.
