Fortune 500 Company Bars Dahua and Hikvision

By: IPVM Team, Published on Aug 30, 2017

A Fortune 500 company has barred Dahua and Hikvision cameras from a large RFP due to cyber security concerns, IPVM has confirmed with the company.

In this note, we examine the reasons, Dahua and Hikvision's cyber security issues, and why this is a growing trend for large end users.

The RFP Specification

The RFP explicitly prohibits Dahua and Hikvision under their camera section:

OEMs (i.e. licensed by) are also barred (related, see: Dahua OEM Directory, Hikvision OEM Directory).

Customer - Republic Services

The RFP is from Republic Services, who is #299 on the 2017 Forbes 500 list with $9+ billion revenue, 30,000+ employees and "340 collection operations, 201 transfer stations, 193 active landfills, 67 recycling centers."

Confirmation Cybersecurity

Get Notified of Video Surveillance Breaking News
Get Notified of Video Surveillance Breaking News

A Republic Services representative cited ongoing cyber security concerns for those two companies as reasons for them being barred from the RFP, in response to IPVM's inquiry.

Dahua and Hikvision Poor Track Record

Both Dahua and Hikvision have a poor cybersecurity track record, with Dahua's backdoor gaining a 9.8 out of 10.0 score from DHS ICS-CERT and Hikvision's backdoor gaining a 10.0 out of 10.0 score from DHS ICS-CERT. Both DHS advisories were issued in May 2017 and are therefore quite recent. That is not all. Dahua's security vulnerabilities were a key factor in the large-scale Mira botnet attacks of Fall 2016. And Hikvision continues to have new vulnerabilities discovered regularly.

Moreover, both companies struggle to responsibly, pro-actively and appropriately communicate the risks involved. For example, Dahua claimed to be a 'victim' of Mirai, has never released a full list of products impacted by their backdoor and failed to properly address another vulnerability in July 2017. Likewise, Hikvision has repeatedly shown they will hide known vulnerabilities until and unless they face bad press.

Poll / Vote

Expanding To The Enterprise

In the West, Dahua and Hikvision started their expansion targeting the lower end of the market, where lower camera counts and less sophisticated software was acceptable so long as they could offer low enough prices and sufficient local sales support. And, at that part of the market, few buyers are very concerned about cyber security vulnerabilities.

However, both companies have ambitions to break into the lucrative, large-scale enterprise market. However, these buyers are much more concerned about cyber security across the board, due to increasing number of organizations breached or hacked (e.g., Sony, Target, US government entities like OPM). Given these buyers much greater resources and concerns about cyber security, they are far less likely to take chances on any products (video surveillance) or otherwise that have a poor cyber security track record.

Chinese Decision Making Limits Enterprise Success

Western enterprise customers prefer dealing directly with corporate decision makers from their suppliers to ensure that problems or questions are quickly and clearly addressed.

This is unfortunately not feasible with Dahua and Hikvision. Both companies product decisions are made in China by Chinese executives whose English is generally limited. We have seen that while Western leaders of Dahua and Hikvision often try to help, they are constrained by geographic, cultural and language barriers. Answers to direct questions about security, or other specifics not listed on data sheets, typically have to come from or be approved by their respective Chinese headquarters.

Dahua and Hikvision's lack of strong cyber security controls, and inability of Western teams to directly solve these problems adds to the risks that Western enterprise buyers face.

Increasing Problem for Dahua and Hikvision

Cyber security is clearly an increasing problem for Dahua and Hikvision. Both companies are fundamentally fast moving, mass market, hardware focused, low price models. This fits poorly with the more careful and thorough software development expertise and open communication processes needed to be strong at cyber security. And this is a concern even without the role of the Chinese government and their control of Hikvision. Combining those elements, we expect large corporations and Western government institutions to become even more concerned about Dahua and Hikvision especially as understanding of these company's risks increases.

1 report cite this report:

Hikvision Removed From US Army Base, Congressional Hearing Called on Jan 12, 2018
Hikvision has been removed from a US Army Base and a US congressional...
Comments (140) : Members only. Login. or Join.

Related Reports

Hikvision Hides Xinjiang R&D Activities on Apr 22, 2020
Hikvision has systematically deleted evidence showing their R&D base and...
Hikvision USA Refuses [Now In], Dahua USA Drives Forward With "Coronavirus Cameras" on Apr 07, 2020
Both have been federally banned, both sanctioned for human rights abuses but...
Fever Cameras Are Medical Devices, Per The FDA, Dahua, Feevr, Hikvision, InVid Contrary Claims Are False on May 28, 2020
Fever cameras are medical devices, despite what euphemisms various sellers...
US DoD Declares "Can No Longer Do Business" With Contractors Using Dahua, Hikvision, Huawei on Apr 08, 2020
The US Department of Defense has confirmed to IPVM that they fully support...
Sunell Panda Cam Body Temperature Measurement Camera Tested on May 14, 2020
Sunell is far less well known than its gargantuan domestic competitors Dahua...
Hikvision AI Training In Xinjiang Paramilitary Base, Now Denies on Mar 10, 2020
Hikvision has been listing AI training in a Xinjiang paramilitary base that...
UK Firm Markets False Fever Screening, Hikvision Disavows on Jun 30, 2020
A UK security firm falsely claimed its Hikvision-based thermal solution could...
"He Is An Idiot!" Exclaims SIA Director John Mack on Mar 23, 2020
Here is another inside look into the "leaders" of the security industry. SIA...
Dahua Critical Cloud Vulnerabilities on May 12, 2020
Dahua has acknowledged a series of cloud vulnerabilities that researcher...
2020 Mid Year Video Surveillance Industry Guide on Jul 27, 2020
The first half of 2020 has been shocking, for the world generally, and for...
Fever Camera Sales From Integrators Surveyed on Jun 01, 2020
Fever cameras are the hottest trend in video surveillance currently but how...
Hikvision Global News Reports Directory on Jun 18, 2020
Hikvision has received the most global news reporting of any video...
Anyvision Presents AI Facial Recognition and Mask Detection on Jun 08, 2020
AnyVision presented its AI facial recognition and mask detection at the May...
White House Proposes Blacklist of Dahua, Hikvision Users on Feb 04, 2020
The White House is proposing to blacklist Hikvision and Dahua users from...
China DVR/NVR Backdoor Discovered, Huawei Refutes on Feb 07, 2020
A backdoor was found in Chinese-produced DVRs and NVRs that secretly allowed...

Recent Reports

Dangerous Hikvision Fever Camera Showcased by Chilean City on Aug 07, 2020
Deploying a fever camera outdoors, in the rain, with no black body, is...
"Grand Slam" For Pelco's PE Firm, A Risk For Motorola on Aug 07, 2020
The word "Pelco" and "grand slam" have not been said together for many years....
FLIR Stock Falls, Admits 'Decelerating' Demand For Temperature Screening on Aug 07, 2020
Is the boom going to bust for temperature screening? FLIR disappointed...
VSaaS Will Hurt Integrators on Aug 06, 2020
VSaaS will hurt integrators, there is no question about that. How much...
Dogs For Coronavirus Screening Examined on Aug 06, 2020
While thermal temperature screening is the surveillance industry's most...
ADT Slides Back, Disappointing Results, Poor Commercial Performance on Aug 06, 2020
While ADT had an incredible start to the week, driven by the Google...
AHJ / Authority Having Jurisdiction Tutorial on Aug 06, 2020
One of the most powerful yet often underappreciated characters in all of the...
SIA Coaches Sellers on NDAA 889B Blacklist Workarounds on Aug 05, 2020
Last month SIA demanded that NDAA 899B "must be delayed". Now that they have...
ADI Returns To Growth, Back To 'Pre-COVID Levels' on Aug 05, 2020
While ADI was hit hard in April, with revenue declining 21%, the company's...
Exposing Fever Tablet Suppliers and 40+ Relabelers on Aug 05, 2020
IPVM has found 40+ USA and EU companies relabeling fever tablets designed,...
Indian Government Restricts PRC Manufacturers From Public Projects on Aug 04, 2020
In a move that mirrors the U.S. government’s ban on Dahua and Hikvision...
Directory of 201 "Fever" Camera Suppliers on Aug 04, 2020
This directory provides a list of "Fever" scanning thermal camera providers...
Face Masks Increase Face Recognition Errors Says NIST on Aug 04, 2020
COVID-19 has led to widespread facemask use, which as IPVM testing has shown...
Dahua Loses Australian Medical Device Approval on Aug 04, 2020
Dahua has cancelled its medical device registration after "discussions" with...
Google Invests in ADT, ADT Stock Soars on Aug 03, 2020
Google has announced a $450 million investment in the Florida-based security...