Broken Hikvision App Exposes Hypocrisy

Author: John Honovich, Published on Dec 06, 2017

While Hikvision talks about a commitment to cybersecurity, their broken app and their insecure 'solution' exposes not only their engineering problems but their hypocrisy about cybersecurity.

In this note, we examine the problems, angry Hikvision dealers responses, how this invalidates historical defenses and the risks involved.

Broken App

The Hik-Connect app, which Hikvision is promoting as their cloud service/interface, continues to suffer from serious problems. One key problem is slow video streams that are frustrating customers and impairing the system's usability.

Since Hikvision is unable to fix that, they have now taken the unprecedented step of directing users, in the app itself, to set up port mapping (forwarding) to overcome their problem, as shown in the screenshot below:

Security Risks of Port Forwarding

Those Hikvision IP cameras getting hacked are not just because of their backdoor, it is because Hikvision continues to tell people to port forward, which exposes the device to the global public Internet, making it easy for hackers around the world to attack their devices.

And it is surreal that they are directing users to port forward when one of the core benefits of a cloud service like Hik-Connect is to stop exposing devices to the public Internet via port forwarding.

But Hikvision continues to do this, e.g., in this March 2017 guide from Hikvision corporate:

Get Video Surveillance News In Your Inbox
Get Video Surveillance News In Your Inbox

In this June 2017 Hikvision 'hardening guide':

In this summer 2017 Hikvision partner presentation that again recommends port forwarding because of Hik-Connect problems:

Cybersecurity may be 'tops' in Hikvision marketing but when it comes to Hikvision actual technical recommendations, it is ignored.

Angry Hikvision Dealers

And Hikvision dealers are rightfully angry about this, as a new LinkedIn discussion highlights:

These dealers understand the irony of Hikvision directing them to use port forwarding:

And even this prominent dealer gets no response to their concerns:

Disproves the Dealer's Fault Defense

The most popular Hikvision loyalist defense is that even though Hikvision ships insecure products, it is the dealer's responsibility and fault to cover for Hikvision's problems, as this dealer declared in response to Hikvision's UPnP security risks:

The reality is simple, though. Hikvision is directing integrators and end users to do insecure things, now even inside their app. When the manufacturer is telling customers to do insecure things, the manufacturer has to take blame.

Worse, Hikvision targets small dealers with their ongoing sales and no training requirements. This results in dealers who lack IT skills depending on a company that claims to be "#1" in R&D, with 10,000 "engineers". Despite this literal legion of "engineers", Hikvision cannot fix the Hik-Connect app nor can they control themselves from directing customers to insecure actions.

Where is Chuck Davis?

Chuck Davis is Hikvision's newest tactic in their cybersecurity PR campaign. He is supposed to bring his expertise to fix these types of basic cybersecurity errors. But, instead, to date, Hikvision is using him as a 'white monkey', parading him around.

Is Hikvision going to give Chuck Davis the power to do his real job of improving Hikvision's own cybersecurity issues? We hope so and are rooting for him.

Do Not Let Critics Win

Hikvision is very sensitive to not let their critics 'win'. They do not want to acknowledge nor give satisfaction to those who criticize them (in their minds 'bullied') that they were right. And perhaps they will keep up this trend here.

Customers Lose

The irony, of course, is that their customers are the ones losing and the rest of us are understanding their 10,000 'engineers' and the commitment to cybersecurity is just more deception.

6 reports cite this report:

Hikvision Critical Cloud Vulnerability Disclosed on Apr 25, 2018
Security researchers Vangelis Stykas and George Lavdanis discovered a vulnerability in Hikvision's HikConnect cloud service that: just by...
JCI / Tyco Security Acquires Smartvue on Apr 03, 2018
Johnson Controls (Tyco Security) has acquired cloud provider Smartvue (see recent IPVM Smartvue profile). Smartvue will join Exacq and VideoEdge...
P2P 'Fail To' 'Quick And Steady Access' - Hikvision Defends Port Forwarding on Apr 02, 2018
Following criticism of Hikvision's ongoing port forwarding recommendation (e.g., Hikvision Hardening Guide Recommends Port Forwarding and Hikvision...
Hikvision HQ Contradicts Cybersecurity Director on Mar 07, 2018
Hikvision HQ has contradicted Hikvision USA's Director of Cybersecurity, Chuck Davis. Davis - Don't Put Cameras On The Internet Davis made a...
The 2018 Surveillance Industry Guide on Jan 16, 2018
The 300 page, 2018 Video Surveillance Industry Guide, covering the key events and the future of the video surveillance market, is now available,...
Hikvision NA Biggest Sale of 2017 (Twice) on Dec 28, 2017
Hikvision North America has been relatively disciplined the past 5 months, reducing the number of sales and the breadth of what is on sale. No...
Comments (63) : PRO Members only. Login. or Join.

Related Reports

IP Camera Cable Labeling Guide on Sep 14, 2018
Labeling cables can save a lot of money and headaches. While it is easy to overlook, taking time to label runs during installation significantly...
VMS Export Shootout - Avigilon, Dahua, Exacq, Genetec, Hikvision, Milestone on Sep 13, 2018
When crimes, accidents or problems occur, exporting video from one's video surveillance system is critical to proving incidents. But who does it...
Door Fundamentals For Access Control Guide on Sep 12, 2018
Assuming every door can be secured with either a maglock or an electric strike can be a painful assumption in the field. While those items can be...
IP Camera Cable Termination Guide on Sep 06, 2018
Terminating cables properly is critical to network performance, but it can be a tricky task with multiple steps. Fortunately, this task is easy to...
IP Camera Cabling Installation Guide on Aug 29, 2018
IPVM is preparing the industry's first Video Surveillance Installation book and our upcoming Video Surveillance Installation Course. We have...
Hikvision FIPS 140-2 Cybersecurity Certification Examined on Aug 27, 2018
A week after the US government passed a law banning Hikvision, Hikvision announced it had obtained a FIPS 140-2 certification from the US...
Inputs/Outputs For Video Surveillance Guide on Aug 24, 2018
While many cameras have Input/Output (I/O) ports, few are actually used and most designers do not even consider them. However, a good understanding...
France Political Scandal Reveals Video Surveillance Problems on Aug 22, 2018
In what French media describes as "the most damaging crisis yet for" French President Marcon, a political scandal has revealed major gaps in the...
SNMP / Network Monitoring For Surveillance 2018 on Aug 21, 2018
Surveillance systems typically rely on the the VMS to report issues, but this most often just means knowing a camera is "down" with no warning or...
Backup Power For Maglocks Guide on Aug 20, 2018
When the main power fails, many believe maglocks must leave doors unlocked. However, battery backed up maglocks are allowed according to IBC /...

Most Recent Industry Reports

Avigilon Announces AI-Powered H5 Camera Development on Sep 19, 2018
Avigilon will be showcasing "next-generation AI" at next week's ASIS GSX. In an atypical move, the company is not actually releasing these...
Favorite Request-to-Exit (RTE) Manufacturers 2018 on Sep 19, 2018
Request To Exit devices like motion sensors and lock releasing push-buttons are a part of almost every access install, but who makes the equipment...
25% China Tariffs Finalized For 2019, 10% Start Now, Includes Select Video Surveillance on Sep 18, 2018
A surprise move: In July, when the most recent tariff round was first announced, the tariffs were only scheduled for 10%. However, now, the US...
Central Stations Face Off Against NFPA On Fire Monitoring on Sep 18, 2018
Central stations are facing off against the NFPA over what they call anti-competitive language in NFPA 72, the standard that covers fire alarms....
Chinese Government Praises Hikvision Following Xi Jinping on Sep 17, 2018
The Chinese government council responsible for managing China's state-owned companies praised Hikvision’s obedience to China’s authoritarian leader...
Amazon Ring Spotlight Cam Tested on Sep 17, 2018
Amazon's Ring has released their latest camera entry, the Spotlight Cam, which we bought and tested in our Consumer IP Camera Analytics...
European Mega Security Firm Verisure Pushing Security Fog on Sep 17, 2018
The European mega security firm Verisure (Securitas Direct), with a reported 2 million customers, is pushing security fog, as shown in this BBC...
IP Camera Cable Labeling Guide on Sep 14, 2018
Labeling cables can save a lot of money and headaches. While it is easy to overlook, taking time to label runs during installation significantly...
Favorite Intercom Manufacturers 2018 on Sep 14, 2018
Intercoms are certainly increasing in popularity, driven by the integration of video and IP networking. But who is the favorite? On the one side,...

The world's leading video surveillance information source, IPVM provides the best reporting, testing and training for 10,000+ members globally. Dedicated to independent and objective information, we uniquely refuse any and all advertisements, sponsorship and consulting from manufacturers.

About | FAQ | Contact