Broken Hikvision App Exposes Hypocrisy

By John Honovich, Published on Dec 06, 2017

While Hikvision talks about a commitment to cybersecurity, their broken app and their insecure 'solution' exposes not only their engineering problems but their hypocrisy about cybersecurity.

In this note, we examine the problems, angry Hikvision dealers responses, how this invalidates historical defenses and the risks involved.

Broken App

The Hik-Connect app, which Hikvision is promoting as their cloud service/interface, continues to suffer from serious problems. One key problem is slow video streams that are frustrating customers and impairing the system's usability.

Since Hikvision is unable to fix that, they have now taken the unprecedented step of directing users, in the app itself, to set up port mapping (forwarding) to overcome their problem, as shown in the screenshot below:

Security Risks of Port Forwarding

Those Hikvision IP cameras getting hacked are not just because of their backdoor, it is because Hikvision continues to tell people to port forward, which exposes the device to the global public Internet, making it easy for hackers around the world to attack their devices.

And it is surreal that they are directing users to port forward when one of the core benefits of a cloud service like Hik-Connect is to stop exposing devices to the public Internet via port forwarding.

But Hikvision continues to do this, e.g., in this March 2017 guide from Hikvision corporate:

Get Notified of Video Surveillance Breaking News
Get Notified of Video Surveillance Breaking News

In this June 2017 Hikvision 'hardening guide':

In this summer 2017 Hikvision partner presentation that again recommends port forwarding because of Hik-Connect problems:

Cybersecurity may be 'tops' in Hikvision marketing but when it comes to Hikvision actual technical recommendations, it is ignored.

Angry Hikvision Dealers

And Hikvision dealers are rightfully angry about this, as a new LinkedIn discussion highlights:

These dealers understand the irony of Hikvision directing them to use port forwarding:

And even this prominent dealer gets no response to their concerns:

Disproves the Dealer's Fault Defense

The most popular Hikvision loyalist defense is that even though Hikvision ships insecure products, it is the dealer's responsibility and fault to cover for Hikvision's problems, as this dealer declared in response to Hikvision's UPnP security risks:

The reality is simple, though. Hikvision is directing integrators and end users to do insecure things, now even inside their app. When the manufacturer is telling customers to do insecure things, the manufacturer has to take blame.

Worse, Hikvision targets small dealers with their ongoing sales and no training requirements. This results in dealers who lack IT skills depending on a company that claims to be "#1" in R&D, with 10,000 "engineers". Despite this literal legion of "engineers", Hikvision cannot fix the Hik-Connect app nor can they control themselves from directing customers to insecure actions.

Where is Chuck Davis?

[link no longer available]

Chuck Davis [link no longer available] is Hikvision's newest tactic in their cybersecurity PR campaign. He is supposed to bring his expertise to fix these types of basic cybersecurity errors. But, instead, to date, Hikvision is using him as a 'white monkey', parading him around.

Is Hikvision going to give Chuck Davis the power to do his real job of improving Hikvision's own cybersecurity issues? We hope so and are rooting for him.

Do Not Let Critics Win

Hikvision is very sensitive to not let their critics 'win'. They do not want to acknowledge nor give satisfaction to those who criticize them (in their minds 'bullied') that they were right. And perhaps they will keep up this trend here.

Customers Lose

The irony, of course, is that their customers are the ones losing and the rest of us are understanding their 10,000 'engineers' and the commitment to cybersecurity is just more deception.

7 reports cite this report:

VMS Mobile App Shootout - Avigilon, Dahua, Exacq, Genetec, Hikvision, Milestone on Oct 01, 2018
Mobile VMS apps are a critical interface for the modern surveillance...
Hikvision Critical Cloud Vulnerability Disclosed on Apr 25, 2018
Security researchers Vangelis Stykas [link no longer available] and George...
JCI / Tyco Security Acquires Smartvue on Apr 03, 2018
Johnson Controls (Tyco Security) has acquired cloud provider Smartvue (see...
P2P 'Fail To' 'Quick And Steady Access' - Hikvision Defends Port Forwarding on Apr 02, 2018
Following criticism of Hikvision's ongoing port forwarding recommendation...
Hikvision HQ Contradicts Cybersecurity Director on Mar 07, 2018
Hikvision HQ has contradicted Hikvision USA's Director of Cybersecurity,...
The 2018 Surveillance Industry Guide on Jan 16, 2018
The 300 page, 2018 Video Surveillance Industry Guide, covering the key events...
Hikvision NA Biggest Sale of 2017 (Twice) on Dec 28, 2017
Hikvision North America has been relatively disciplined the past 5 months,...
Comments (65) : Members only. Login. or Join.

Related Reports

Verkada: "IPVM Should Never Be Your Source of News" on Jul 02, 2020
Verkada was unhappy with IPVM's recent coverage declaring that reading IPVM...
Verkada Disruptive Embedded Live Help on Sep 24, 2020
Call up your integrator? Have someone come by the next day? Verkada is...
Six Flags' FDA Violating Outdoor Dahua Fever Cameras on Oct 26, 2020
As Six Flags scrambled to reopen parks amid plummeting revenues caused by the...
Drain Wire For Access Control Reader Tutorial on Sep 23, 2020
An easy-to-miss cabling specification plays a key role in access control, yet...
Ubiquiti Access Control Tested on Oct 21, 2020
Ubiquiti has become one of the most widely used wireless and switch providers...
Hikvision Q3 2020 Global Revenue Rises, US Revenue Falls on Oct 27, 2020
While Hikvision's global revenue rises driven by domestic recovery, its US...
Worst Manufacturer Technical Support 2020 on Oct 15, 2020
4 manufacturers stood out as providing the worst technical support to ~200...
Facial Recognition: Weak Sales, Anti Regulation, No Favorite, Says Security Integrators on Jul 07, 2020
While facial recognition has gained greater prominence, a new IPVM study of...
China General Chamber of Commerce Calls Out US Politics on Sep 24, 2020
While US-China relations are at an all-time low, optimism about relations...
False: Verkada: "If You Want To Remote View Your Cameras You Need To Punch Holes In Your Firewall" on Jul 31, 2020
Verkada falsely declared to “3,000+ customers”, “300 school districts”, and...
Uniview Deep Learning Camera Tested on Jul 14, 2020
Uniview's intrusion analytics have performed poorly in our shootouts. Now,...
Monitoring Alarm Systems From Home - Innovation or Danger? on Oct 13, 2020
Remote monitoring by alarm companies since COVID-19 is bringing cost savings...
China's SMIC Hit By US Trade Restrictions, Impact On Video Surveillance on Oct 13, 2020
US trade restrictions have hit Semiconductor Manufacturing International...
Axis Exports To China Police Criticized By Amnesty International on Sep 21, 2020
Axis Communications and other EU surveillance providers are under fire from...
Faulty Hikvision Cali Colombia Fever Camera Implementation on Jul 20, 2020
The mayor of one of Colombia's largest cities has promoted a faulty Hikvision...

Recent Reports

Bedside Cough and Sneeze Detector (Sound Intelligence and CLB) on Oct 28, 2020
Coronavirus has increased interest in detecting symptoms such as fever and...
Fever Tablet Thermal Sensors Examined (Melexis) on Oct 28, 2020
Fever tablet suppliers heavily rely on the accuracy and specs of...
Verkada Fires 3 on Oct 28, 2020
Verkada has fired three employees over an incident where female colleagues...
Recruiters Online Show LIVE Thursday! on Oct 27, 2020
IPVM's 7th online show resumes Thursday with 12 recruiters presenting...
Eagle Eye Networks Raises $40 Million on Oct 27, 2020
Eagle Eye has raised $40 million aiming to "reinvent video...
Hikvision Q3 2020 Global Revenue Rises, US Revenue Falls on Oct 27, 2020
While Hikvision's global revenue rises driven by domestic recovery, its US...
VICE Investigates Verkada's Harassing "RawVerkadawgz" on Oct 26, 2020
This month, IPVM investigated Verkada's sexism, discrimination, and cultural...
Six Flags' FDA Violating Outdoor Dahua Fever Cameras on Oct 26, 2020
As Six Flags scrambled to reopen parks amid plummeting revenues caused by the...
ISC Brasil Digital Experience 2020 Report on Oct 23, 2020
ISC Brasil 2020 rebranded itself to ISC Digital Experience and, like its...
Top Video Surveillance Service Call Problems 2020 on Oct 23, 2020
3 primary and 4 secondary issues stood out as causing the most problems when...
GDPR Impact On Temperature / Fever Screening Explained on Oct 22, 2020
What impact does GDPR have on temperature screening? Do you risk a GDPR fine...
Security And Safety Things (S&ST) Tested on Oct 22, 2020
S&ST, a Bosch spinout, is spending tens of millions of dollars aiming to...
Nokia Fever Screening Claims To "Advance Fight Against COVID-19" on Oct 22, 2020
First IBM, then briefly Clorox, and now Nokia becomes the latest Fortune 500...
Deceptive Meridian Temperature Tablets Endanger Public Safety on Oct 21, 2020
IPVM's testing of and investigation into Meridian Kiosk's temperature...
Honeywell 30 Series and Vivotek NVRs Tested on Oct 21, 2020
The NDAA ban has driven many users to look for low-cost NVRs not made by...