Hikvision Ezviz Touts Robust Security

Published Mar 11, 2016 05:00 AM

Hikvision's poor security track recordChinese government ownership and hiding of their own brand in the consumer space has raised many concerns about their direct sales to American consumers. Indeed, a Google Consumer survey showed significant resistance.

Now, Hikvision has gone public with a statement explaining and defending their security.

Key ****** ****

****** ****** ********* *****:

  • ***** ***** ******* ** *** ** Amazon *** ********, **** "*** **** and *********** ******" ** *** ****** States.
  • ***** ***** ******** ******* ** *****
  • "***** ** ** ** ******* *** EZVIZ *******"
  • "****** *** ****** ******** ** ***** cameras *** **** ** ******** ******* the *********** ***** ***."
  • "****** *** **** *** *********** *** HTTPS *** ***"
  • "************ **** ** ******** ** **** both **** *** ******** *****, *** when ******* ** *** ********** *******. The ******** ** *** **** ****** with *** ************ ****, *** ***** is ** ******* **** **** *** override *** **********."

** **** ** ******** ***** ****** in ******** *****.

Still ******* **** *****

***** ** ******* ********* *** ******* a ******** *** ******** *** ** technical ******, ** ***** ********* **** to ** ********** ***** *** **** are.

*************** *************:

"***** ** ************* ****** ** ********, **********. ***** ******** lives ******* ****** ********** *****. ** design *** ************..."

***** ************* ******* *** ********* ***** *** Hikvision. **** ** ******** ***** ** security ** ***** **** ***** *** *** are. ****** *** ****** **** ** certainly ***** ****** *** ** ** good **** ********* ** ******* **** specific ***** ***** ******** *********.

Comments (17)
U
Undisclosed #1
Mar 11, 2016
IPVMU Certified

EZVIZ North America is run on Amazon Web Services, with "all data and connections remain" in the United States.

Last time I checked the Internet lacked any customs or border patrol, so I am not sure how they could insure that routers not on U.S. soil would not ever pass traffic.

As a practical matter, I'm not sure how often your data would actually leave the country (during transmission), but it is a naive statement nonetheless.

(1)
JH
John Honovich
Mar 11, 2016
IPVM
  • "There is no IP address for EZVIZ cameras"

Ethan pulled up the Ezviz Mini in Hikvision's own software tool, showing an IP address for it:

(1)
UM
Undisclosed Manufacturer #2
Mar 11, 2016

"There is no IP address for EZVIZ cameras"

If these are network cameras connected to a home/business router, it will have an IP address. Their software may not disclose it, rather using a cloud/app connection, it still has an IP address. I believe they are referring to it not having a web browser interface (HTTP web page), which is different than it having an IP address (TCP/IPv4).

Just like hwen people confuse the world wide web with the Internet.

JH
John Honovich
Mar 11, 2016
IPVM

2, yes, I agree I think they are just confusing the two but still...

Here is the full quote:

"One critical element that distinguishes EZVIZ's security measures from others is that there is no IP address for EZVIZ cameras -- meaning no direct web connection to EZVIZ products."

They emphasized it quite clearly 'no IP address', which is strange to say the least.

(1)
(1)
U
Undisclosed #1
Mar 11, 2016
IPVMU Certified

Yes, I think they mean from the outside.

So if you were to establish a connection to your home camera from your phone using the local Starbucks free wireless, you wouldn't see a connection to your home IP, only the generic IP to their Amazon cloud service which is relays the data pushed to it from your home.

So no inbound connection for video, only outbound to the cloud.

IMHO, that's what they are trying to say, but still just guessing based on other p2p implementations I've read about.

JH
John Honovich
Mar 12, 2016
IPVM

"relays the data pushed to it from your home"

And inside your home, the Ezviz camera has an IP address that it uses to interface with the cloud service.

If Hikvision wants to say what you say, they should say it. However, they published a document saying "there is no IP address for EZVIZ cameras"

Avatar
Brian Karas
Mar 12, 2016
IPVM

"there is no IP address for EZVIZ cameras"

Maybe they're referring to the TVI cameras, LOL.

(1)
U
Undisclosed #1
Mar 12, 2016
IPVMU Certified

Or maybe they're running LonWorks...

(1)
Avatar
Jon Dillabaugh
Mar 12, 2016
Pro Focus LLC

I think a lot of you are confused. They simply meant a public facing IP address. Of course any device using TCP/IP will have an IP address. But, it doesn't have to be public facing. You need to be able to speak Chinglish. I'm fluent.

(1)
JH
John Honovich
Mar 12, 2016
IPVM

"You need to be able to speak Chinglish. I'm fluent."

But:

"EZVIZ is a North American company headquartered in City of Industry, California"

I suspect it is not a 'Chinglish' issue as much as it is a marketing department who has deficiencies communicating about technology.

(1)
U
Undisclosed #1
Mar 12, 2016
IPVMU Certified

You need to be able to speak Chinglish. I'm fluent.

Prove it. What's a "male Wallace house"? (Don't skip the ending.)

UI
Undisclosed Integrator #3
Mar 12, 2016

EZVIZ is super secure in that it's nearly impossible to make it work right...

(1)
(2)
JH
John Honovich
Mar 12, 2016
IPVM

3, what specific problems have you faced? We are in the middle of testing the Ezviz mini and found a fairly fundamental wireless connection (or lack thereof) problem.

UI
Undisclosed Integrator #3
Mar 14, 2016

The one time I tried to use it, it refused to configure UPnP on the router despite that being enabled, the EZVIZ app refused to recognize the QR code (once I found the version that was in English), it wouldn't let me log in on my phone with the account I set up with it (I eventually just created a new one that did work), then when I added it to the client's phone it refused to log in with either account... at that point I gave up and configured port forwarding on the router manually and just configured the regular app on his phone with his internet IP (you know, the old fashioned way).

(1)
UI
Undisclosed Integrator #4
Mar 22, 2016

John,

Ezviz touts that their WiFi camera doesn't have a default password, but the camera itself has a default verification code which is used as a camera password on the product itself next to the QR code and it stays as default code unless the user changes it. So this is also contradicting their claim about not having a default password. You should point out this claim as well.

Also, do you know how I can verify that all my data is staying in the US AWS servers instead of other co-located AWS servers?

(1)
U
Undisclosed #1
Mar 22, 2016
IPVMU Certified

Ezviz touts that their WiFi camera doesn't have a default password, but the camera itself has a default verification code which is used as a camera password on the product itself next to the QR code and it stays as default code unless the user changes it.

What is the default password then? 8888888? 6666666?

Or do you mean each camera has a unique pre-assigned password?

Avatar
Ethan Ace
Mar 22, 2016

Each camera has a six-character alphanumeric access code. You'll find it on a bunch of Hikvision stuff, also, below the serial number. You have to enter it when adding it to EZVIZ, and sometimes you have to enter it again to view video.