Hikvision Ezviz Touts Robust Security

By: John Honovich, Published on Mar 11, 2016

Hikvision's poor security track record, Chinese government ownership and hiding of their own brand in the consumer space has raised many concerns about their direct sales to American consumers. Indeed, a Google Consumer survey showed significant resistance.

Now, Hikvision has gone public with a statement explaining and defending their security.

Key ****** ****

****** ****** ********* *****:

  • ***** ***** ******* ** run ** ****** *** Services, **** "*** **** and *********** ******" ** the ****** ******.
  • ***** ***** ******** ******* to *****
  • "***** ** ** ** address *** ***** *******"
  • "****** *** ****** ******** by ***** ******* *** only ** ******** ******* the *********** ***** ***."
  • "****** *** **** *** transmitted *** ***** *** SSL"
  • "************ **** ** ******** to **** **** **** and ******** *****, *** when ******* ** *** additional *******. *** ******** is *** **** ****** with *** ************ ****, and ***** ** ** default **** **** *** override *** **********."

** **** ** ******** these ****** ** ******** tests.

Still ******* **** *****

***** ** ******* ********* for ******* * ******** and ******** *** ** technical ******, ** ***** encourage **** ** ** forthright ***** *** **** are.

*************** *************:

"***** ** ************* ****** ** ********, **********. EZVIZ ******** ***** ******* easily ********** *****. ** design *** ************..."

***** ************* ******* *** marketing ***** *** *********. **** of ******** ***** ** security ** ***** **** ***** who *** ***. ****** the ****** **** ** certainly ***** ****** *** it ** **** **** Hikvision ** ******* **** specific ***** ***** ******** practices.

Comments (17)

Undisclosed #1

03/11/16 05:35pm

EZVIZ North America is run on Amazon Web Services, with "all data and connections remain" in the United States.

Last time I checked the Internet lacked any customs or border patrol, so I am not sure how they could insure that routers not on U.S. soil would not ever pass traffic.

As a practical matter, I'm not sure how often your data would actually leave the country (during transmission), but it is a naive statement nonetheless.

John Honovich

IPVM | 03/11/16 06:20pm
  • "There is no IP address for EZVIZ cameras"

Ethan pulled up the Ezviz Mini in Hikvision's own software tool, showing an IP address for it:

Undisclosed Manufacturer #2

03/11/16 06:25pm

"There is no IP address for EZVIZ cameras"

If these are network cameras connected to a home/business router, it will have an IP address. Their software may not disclose it, rather using a cloud/app connection, it still has an IP address. I believe they are referring to it not having a web browser interface (HTTP web page), which is different than it having an IP address (TCP/IPv4).

Just like hwen people confuse the world wide web with the Internet.

John Honovich

IPVM | In reply to Undisclosed Manufacturer #2 | 03/11/16 06:36pm

2, yes, I agree I think they are just confusing the two but still...

Here is the full quote:

"One critical element that distinguishes EZVIZ's security measures from others is that there is no IP address for EZVIZ cameras -- meaning no direct web connection to EZVIZ products."

They emphasized it quite clearly 'no IP address', which is strange to say the least.

Undisclosed #1

In reply to John Honovich | 03/11/16 07:28pm

Yes, I think they mean from the outside.

So if you were to establish a connection to your home camera from your phone using the local Starbucks free wireless, you wouldn't see a connection to your home IP, only the generic IP to their Amazon cloud service which is relays the data pushed to it from your home.

So no inbound connection for video, only outbound to the cloud.

IMHO, that's what they are trying to say, but still just guessing based on other p2p implementations I've read about.

John Honovich

IPVM | In reply to Undisclosed #1 | 03/12/16 12:19am

"relays the data pushed to it from your home"

And inside your home, the Ezviz camera has an IP address that it uses to interface with the cloud service.

If Hikvision wants to say what you say, they should say it. However, they published a document saying "there is no IP address for EZVIZ cameras"

Avatar

Brian Karas

IPVM | In reply to John Honovich | 03/12/16 01:27pm

"there is no IP address for EZVIZ cameras"

Maybe they're referring to the TVI cameras, LOL.

Undisclosed #1

In reply to Brian Karas | 03/12/16 02:37pm

Or maybe they're running LonWorks...

Avatar

Jon Dillabaugh

Pro Focus LLC | In reply to Undisclosed Manufacturer #2 | 03/12/16 03:49pm

I think a lot of you are confused. They simply meant a public facing IP address. Of course any device using TCP/IP will have an IP address. But, it doesn't have to be public facing. You need to be able to speak Chinglish. I'm fluent.

John Honovich

IPVM | In reply to Jon Dillabaugh | 03/12/16 04:05pm

"You need to be able to speak Chinglish. I'm fluent."

But:

"EZVIZ is a North American company headquartered in City of Industry, California"

I suspect it is not a 'Chinglish' issue as much as it is a marketing department who has deficiencies communicating about technology.

Undisclosed #1

In reply to Jon Dillabaugh | 03/12/16 07:24pm

You need to be able to speak Chinglish. I'm fluent.

Prove it. What's a "male Wallace house"? (Don't skip the ending.)

Undisclosed Integrator #3

03/12/16 03:40am

EZVIZ is super secure in that it's nearly impossible to make it work right...

John Honovich

IPVM | In reply to Undisclosed Integrator #3 | 03/12/16 12:39pm

3, what specific problems have you faced? We are in the middle of testing the Ezviz mini and found a fairly fundamental wireless connection (or lack thereof) problem.

Undisclosed Integrator #3

In reply to John Honovich | 03/14/16 06:14am

The one time I tried to use it, it refused to configure UPnP on the router despite that being enabled, the EZVIZ app refused to recognize the QR code (once I found the version that was in English), it wouldn't let me log in on my phone with the account I set up with it (I eventually just created a new one that did work), then when I added it to the client's phone it refused to log in with either account... at that point I gave up and configured port forwarding on the router manually and just configured the regular app on his phone with his internet IP (you know, the old fashioned way).

Undisclosed Integrator #4

03/22/16 03:01pm

John,

Ezviz touts that their WiFi camera doesn't have a default password, but the camera itself has a default verification code which is used as a camera password on the product itself next to the QR code and it stays as default code unless the user changes it. So this is also contradicting their claim about not having a default password. You should point out this claim as well.

Also, do you know how I can verify that all my data is staying in the US AWS servers instead of other co-located AWS servers?

Undisclosed #1

In reply to Undisclosed Integrator #4 | 03/22/16 04:26pm

Ezviz touts that their WiFi camera doesn't have a default password, but the camera itself has a default verification code which is used as a camera password on the product itself next to the QR code and it stays as default code unless the user changes it.

What is the default password then? 8888888? 6666666?

Or do you mean each camera has a unique pre-assigned password?

Avatar

Ethan Ace

IPVM | In reply to Undisclosed #1 | 03/22/16 04:52pm

Each camera has a six-character alphanumeric access code. You'll find it on a bunch of Hikvision stuff, also, below the serial number. You have to enter it when adding it to EZVIZ, and sometimes you have to enter it again to view video.

Login to read this IPVM report.
Why do I need to log in?
IPVM conducts unique testing and research funded by member's payments enabling us to offer the most independent, accurate and in-depth information.

Related Reports

Bad: Dahua Villa Video Doorbell Tested on Jan 11, 2019
Doorbells are one of the hottest segments in the residential market but Dahua's Villa Video Doorbell is the worst we have tested.   We bought and...
Manufacturer Favorability Guide 2019 on Jun 12, 2019
The 259 page PDF guide may be downloaded inside by all IPVM members. It includes our manufacturer favorability rankings and individual...
Security Fail: ASISNYC Auto Emails Passwords In Plain Text on May 14, 2019
ASIS NYC automatically emails a user with the password the user just entered, in plain text, when one registers for the site / event, as the...
Honeywell Speaks On NDAA Ban, New Non-Banned Cameras and Cybersecurity on Aug 06, 2019
For years, Honeywell has depended on Dahua, a company with a poor cybersecurity track record and now banned by the US NDAA, for the development and...
TMA Apologizes to Amazon / Ring on Aug 23, 2019
Not only is Amazon / Ring making major incursions into the residential security market, the organization representing the biggest incumbents, The...
Uniview OEM Directory on Sep 11, 2019
This directory lists 20+ companies that OEM products from Uniview, with a graphic and links to company websites below. It does not cover all...
3 Weeks Later, Honeywell Still Cannot Say Whether They Are Vulnerable To Dahua Wiretapping [Now Admits] on Aug 27, 2019
The Dahua wiretapping vulnerability and Dahua's decision to delay disclosing it until IPVM inquired underscored problems with cybersecurity and...
US Army Base To Buy Banned Honeywell Surveillance on Sep 17, 2019
The U.S. Army's Fort Gordon, home to their Cyber Center of Excellence, has issued a solicitation to purchase Honeywell products that are US...
Wyze Massive Data Leak on Dec 26, 2019
Wyze has exposed millions of user's data, as reported by Twelve Security, and confirmed by IPVM, who has spoken with Twelve Security and reviewed...
Stop Blaming Your Employee, Wyze on Dec 30, 2019
Wyze management is at fault for its massive data leak, not its 'employee', as it has centered the blame on. While blaming an employee is clever...

Most Recent Industry Reports

'Severe Impact' Mercury Security 2020 Leap Year Firmware Issue on Jan 17, 2020
One of the largest access controller manufacturers has a big problem: February 29th. Mercury Security, owned by HID, is alerting partners of the...
Apple Acquires XNOR.ai, Loss For The Industry on Jan 16, 2020
Apple has acquired XNOR.ai for $200 million, reports GeekWire. This is a loss for the video surveillance industry. XNOR.ai stunned the industry...
Installation Course January 2020 - Last Chance on Jan 16, 2020
Thursday, January 16th is your last chance to register for the Winter 2020 Video Surveillance Installation Course. This is a unique installation...
Halo Smart Vape Detector Tested on Jan 16, 2020
The Halo Smart Sensor claims to detect vaping, including popular brand Juul and even THC vapes. But how well does it work in real world...
PRC Government Entity Now Controlling Shareholder of Infinova / March Networks on Jan 16, 2020
A PRC government entity is now the controlling shareholder of US security manufacturer Infinova as well as its wholly-owned subsidiary March...
Network Cabling for Video Surveillance on Jan 15, 2020
In this guide, we explain the fundamentals of network cabling for video surveillance networks, how they should be installed, and the differences in...
ONVIF [Un]Trashed Statement, Confirms Dahua and Hikvision Still Suspended on Jan 15, 2020
ONVIF has 'trashed' the suspension statement for Dahua, Hikvision, Huawei, etc. but confirms to IPVM that those companies are all still...
Wyze Smart Door Lock Test on Jan 14, 2020
Wyze's inexpensive cameras have grabbed the attention of many in the consumer market, but can the company's new smart lock get similar...
Wesco Wins Anixter on Jan 13, 2020
Despite Anixter earlier arguing that Wesco's bid was inferior to CD&R's by nearly 10%, Anixter confirmed that they are taking Wesco's 3.1%...
Anixter Resisting Takeover From Competitor, Bidding War Emerges, Wesco Wins on Jan 13, 2020
Mega distributor Anixter is going to be acquired but by whom? Initially, Anixter planned to go private, being bought by a private equity firm....

What IPVM Is

The world's leading authority on video surveillance, with 200,000+ visits monthly.

  • Articles on cameras, video analytics, VMS, and trends
  • Tests showing actual performance and problems
  • Courses in surveillance, access control, etc
  • Camera Calculator for designing systems

Dedicated To Independence

We're dedicated to staying independent and objective. We're the only industry source to refuse any and all advertisements, sponsorship, and consulting from manufacturers. Why?