FLIR Responds to Dahua Backdoor

By John Honovich, Published on Mar 10, 2017

FLIR is the first Dahua OEM partner to issue a statement following Dahua's backdoor disclosure:

Certain FLIR and Lorex branded products that are produced by Dahua may be affected by this vulnerability.

To reduce concern / problems, they highlighted many product lines that are not from Dahua:

Please note that the following product lines are NOT affected by this vulnerability:

FC-Series ID, FC-Series S, FC-Series R
PT-Series, F-Series, D-Series
Ariel, Quasar
Meridian, Horizon, Latitude Series
TRK, IoI
FLIR FX, FLIR Secure HD

However, that still leaves a lot of Lorex products and lower end FLIR branded devices that are Dahua OEMs.

Unlike Dahua, FLIR emphasized the benefit of their existing cloud management feature on a number of their Dahua OEMed devices:

Many of these products are already protected from this vulnerability due to the external connection being managed by FLIR’s Cloud connection service. With the device connected to the internet via the FLIR Cloud service, we have confirmed that these devices are no longer vulnerable to this issue.

Also, FLIR went further than Dahua, advising strong action for those not using their cloud service with Dahua OEMed products:

Until this issue is resolved, our recommendation is to immediately disable DDNS, disable all port forwarding and, if available, turn off UPnP.

However, FLIR acknowledges that Dahua still has not provided clarity and a solution to the vulnerable devices:

We are continuing to work with Dahua to discover exactly which products are affected, and when patches will be available.

Why Dahua?

One obvious question that comes to mind is why would FLIR, Honeywell, Tyco, etc. choose Dahua?

****** *** ** *** major *** ***** **** Dahua **** ****** ***** ago **** ***** *** virtually ******* ** *** West *** ***** *** not ******** ******* ************* sales.

***, ** ******, **** before *** ********, *********'* **** **********,******** **** *****, ********* *********** **** ***** partners, ***** ** * baffling ******.

*** **** **** ** Dahua, **** ***** *** when **** ***** *****, was **** ***** *** one ** *** ****** factories *** ********* **** to **** *** ****** / ******** ******* ******* of ***** ****** ******* companies. *** ***** ******** emerged **** ****.

Hit *** ****

**** ** ******* * negative *** ****, **** simply ******** ************* *** Dahua ************ ** ***********. Worse, ** * ******* government ********** (**** ** these ******** ***** ***** products **** ********* **** to ********* *** ****), the ******* **** **** has *** ******** ****** its ******** *** ***** security **** ********** ******* some ****** ******. ********, while ***** * ******* based ******* **** ******* US ******** *** ** an ************ ***********, ******** US ***** **** *** be **** ********.

Dahua ****** **** ****?

**** *****, ***** **** Dahua's ********** ********* *********** with ****, **** ****** put ******* ** ******** the ************ **** *****. On *** ***** ****, switching **** ** *** easy ** ** *******, given *** ********* ******** of ******* ** **** cameras. *** ********* **** may **** ******'* **** *********** ** ISD, * **** ** which **** *** ***** was ** ******** ***** internal ** ****** ***********.

Credit *** **********

**** ********* ******** ****** for ********** ******* *** informing ***** *********, ********** given **** *** **** are ***** ******* ** the **** ***** **** and **** ***** **** actually ** ** ***** this.

***** ** ******** ************ with ********* *** ****, we *** ********* **** they **** ** *******, though ** ********* **** publicize **** ** **** do ***.

Comments (6)

Thanks IPVM for including this important topic in your blog series. Industry awareness had definitely increased and clearer information is appreciated. OEM partnerships cut both ways- On one side, a trusted brand can get products to market quickly. On the other hand, it is evident a couple of high profile OEMs have emboldened themselves to poach their own customers.

To FLIR's customer care credit, they have included a hotline number and email enrollment for those needing immediate help or want to be first in the development loop: 877-757-6981 and www.flir.com/securityinfo

 

 

I want to know what the customer response is... When we first released a statement last time Dahua was involved in a hack and a major world-record-breaking DDOS attack NO ONE CARED.

Do we really think anyone will care now? I talked to some people who run businesses in our city's chamber of commerce meeting and no one cares about it. If they can see video on their phone they're pleased...

Until someone gets properly sued and there's a precedent for responsibility... no one will care.

I talked to some people who run businesses in our city's chamber of commerce meeting and no one cares about it.

I believe that and have seen similar. However, the larger the end user gets, the more likely they are to consider poor security vulnerabilities / recent backdoors to be a disqualification / deal breaker.

I talked to some people who run businesses in our city's chamber of commerce meeting and no one cares about it. If they can see video on their phone they're pleased.

That does not surprise me. My personal feeling is that in many cases there is still a mentality of "well, *my* system is so small/inconsequential/boring that I won't be a target". Or similarly "what are the odds that *I* get attacked?".

I do not know the exact number, but I believe it will take 10 or 20 (or more) widespread cases like this before people realize that ALL unprotected internet-connected devices are at risk. The hackers don't care if your system is big or small, boring or exciting, they just know you as an IP address, found by scanning endless across all possibilities.

This is probably not the straw that will break the camel's back, but it is still a straw.

Our page has been updated. 

http://www.flir.com/securityinfo/

FLIR has been pushing updates to Cloud Connected models and users or dealers can accept these updates locally at the machine or  through the CMS software and App.

Please read the instructions carefully.

Read this IPVM report for free.

This article is part of IPVM's 6,602 reports, 890 tests and is only available to members. To get a one-time preview of our work, enter your work email to access the full article.

Already a member? Login here | Join now

Related Reports

School District Admits Not Following FDA Guidelines With 144, No Blackbody, Hikvision Fever Cameras on Aug 21, 2020
The Baldwin County School District has admitted it is not following FDA...
Avigilon Face Mask Detection Tested on Jun 24, 2020
Face mask detection or, more specifically not wearing a face mask, is an...
Warning: Panasonic i-PRO Deceives About NDAA Compliance on Aug 18, 2020
IPVM has determined that Panasonic i-PRO has deceived about its NDAA...
Clinton Public View Monitor (PVM) Mask Detection Tested on Jul 09, 2020
Face mask detection, or more specifically not wearing one, is expanding...
White House Expands Dahua Hikvision Blacklist To Federal Funding [Final Rule Reverses] on Aug 13, 2020
The White House is expanding the NDAA to blacklist anyone who "uses" banned...
Temperature Screening From The Protection Bureau and ZKTeco Violate IEC Standards and FDA Correct Operation on Jun 22, 2020
ZKTeco and integrator The Protection Bureau are marketing an installation...
Avigilon Social Distancing Analytics Tested on Aug 26, 2020
Avigilon released its social distancing analytics in response to the...
FLIR Markets Windows Temperature Screening, Violates IEC And Causes Performance Problems on Jul 17, 2020
FLIR, one of the largest thermal screening manufacturers, is marketing...
JCI / Tyco Drops Dahua on Sep 03, 2020
Johnson Controls (JCI) / Tyco Security has completely dropped Dahua OEMs from...
Briefcam Responsible Use Examined on Aug 24, 2020
While mega-companies Amazon, IBM, and Microsoft have been criticized for...
Hanwha Face Mask Detection Tested on Jul 01, 2020
Face mask detection or, more specifically lack-of-face-mask detection, is an...
Dartmouth College Deploys K3 Temperature Screening on Sep 29, 2020
While Dartmouth College has a $6+ billion endowment, the College has bought...
The Insecure Verkada Access Control System on Jun 25, 2020
While Verkada touts the security of its system and that how their new door...
Ink Labs Relabels China YCX Fever Camera And Steals Dahua's Marketing on Jul 30, 2020
A US company marketed a 'thermal temperature scanner' as its own, selling...
Industry Study: 83% of US Temperature Screening Sellers Falsely Say Not Medical Devices on Jun 29, 2020
83% of US companies selling temperature screening devices, aka 'fever'...

Recent Reports

Recruiters Online Show LIVE Today! on Oct 29, 2020
IPVM's 7th online show resumes today with 12 recruiters presenting themselves...
Hikvision AcuSense G2 Camera Test on Oct 29, 2020
Hikvision has released their next generation of AcuSense analytic cameras...
Biggest Problems Selling Access Control 2020 on Oct 29, 2020
Access control can cause integrators big headaches. What practical issues do...
Taiwan Geovision AI Analytics and NDAA Examined on Oct 29, 2020
Taiwan manufacturer Geovision's revenue has been falling for years. However,...
Bedside Cough and Sneeze Detector (Sound Intelligence and CLB) on Oct 28, 2020
Coronavirus has increased interest in detecting symptoms such as fever and...
Fever Tablet Thermal Sensors Examined (Melexis) on Oct 28, 2020
Fever tablet suppliers heavily rely on the accuracy and specs of...
Verkada Fires 3 on Oct 28, 2020
Verkada has fired three employees over an incident where female colleagues...
Eagle Eye Networks Raises $40 Million on Oct 27, 2020
Eagle Eye has raised $40 million aiming to "reinvent video...
Hikvision Q3 2020 Global Revenue Rises, US Revenue Falls on Oct 27, 2020
While Hikvision's global revenue rises driven by domestic recovery, its US...
VICE Investigates Verkada's Harassing "RawVerkadawgz" on Oct 26, 2020
This month, IPVM investigated Verkada's sexism, discrimination, and cultural...
Six Flags' FDA Violating Outdoor Dahua Fever Cameras on Oct 26, 2020
As Six Flags scrambled to reopen parks amid plummeting revenues caused by the...
ISC Brasil Digital Experience 2020 Report on Oct 23, 2020
ISC Brasil 2020 rebranded itself to ISC Digital Experience and, like its...
Top Video Surveillance Service Call Problems 2020 on Oct 23, 2020
3 primary and 4 secondary issues stood out as causing the most problems when...
GDPR Impact On Temperature / Fever Screening Explained on Oct 22, 2020
What impact does GDPR have on temperature screening? Do you risk a GDPR fine...
Security And Safety Things (S&ST) Tested on Oct 22, 2020
S&ST, a Bosch spinout, is spending tens of millions of dollars aiming to...