Hikvision Backdoor Confirmed

By: Brian Karas, Published on May 08, 2017

The US Department of Homeland Security's Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) has issued an advisory for vulnerabilities to Hikvision cameras, crediting and confirming the work of researcher Montecrypto who originally disclosed the backdoor in Hikvision cameras.

Backdoor Disclosure

On March 5, 2017, Montecrypto declared:

I would like to confirm that there is a backdoor in many popular Hikvision products that makes it possible to gain full admin access to the device.

Confirming one week later that:

One can remotely escalate their privileges from anonymous web surfer to admin.

DHS Advisory On Hikvision

The US Department of Homeland Security gave the Hikvision cameras its worst / highest score - a 10.0 out of 10.0 - confirming that it is "remotely exploitable/low skill level to exploit" for "improper authentication." Moreover, DHS additionally confirmed a "password in configuration file", scoring it a critical 8.8 out of 10.0.

Hikvision Response

Get Notified of Video Surveillance Breaking News
Get Notified of Video Surveillance Breaking News

On March 12, Hikvision sent a notice of a 'privilege escalating vulnerability' and issued firmware upgrades for 200+ Hikvision IP cameras addressing the vulnerabilities. IPVM estimates easily millions of cameras have these vulnerabilities given Hikvision's own regular declarations of shipping tens of millions of cameras.

On May 4, Hikvision sent an update on that notice declaring [link no longer available]:

Hikvision is honored to work with the U.S. Department of Homeland Security’s National Cybersecurity and Communications Integration Center in our ongoing cybersecurity best practice efforts. 

Grey Market No Solution

No solution is available for those who have bought 'grey market' Hikvision cameras as, depending on the variant, upgrading firmware could revert the device, be blocked or brick the camera.

No Fix Yet For Password In Config File

The DHS advisory also notes:

Hikvision has not mitigated the password in configuration file vulnerability.

It is not clear if or when Hikvision will fix this.

No Proof Of Concept Released But Verified

While the US DHS has verified these vulnerabilities, no proof of concept code has been released for them. The lack of one should reduce the amount of exploits.

Hikvision users should certainly take this seriously and upgrade all devices. In describing this exploit to IPVM when it was first discovered, montecrypto stated:

If you can access login screen, you can log in as an admin or event recover admin's password without knowing it.

"No Backdoors" Claim

In early 2017, Hivision declared that:

Hikvision never has, does or would intentionally contribute to the placement of “backdoors” in its products.

The company will likely argue that this backdoor is not intentional though this depends on trusting them since verifying intent is difficult.

Hikvision Previous Hardening Efforts

Since 2015, Hikvision has made multiple statements about its commitment to cyber security, in response to previous incidents [link no longer available], in a special Security Center [link no longer available] Website section, and establishing a Network and Information Security Lab and engaging security audit firm Rapid7. Despite these stated efforts to improve cybersecurity, these vulnerabilities lasted into 2017 and the report of the independent researcher montecrypto.

Track Record of Hikvision Cybersecurity Problems

Hikvision has a long history of cybersecurity vulnerabilities affecting their products: 

In the 2016 Cyber Security For Video Surveillance Study, integrators gave Hikvision the worst cyber security rating among manufacturers. While Dahua's own backdoor will give Hikvision competition, Hikvision's new vulnerabilities here will increase their own challenges.

23 reports cite this report:

Intersec 2019 Show Report on Jan 23, 2019
The 2019 Intersec show, held annually in Dubai, is now complete. IPVM attended for 3 days, interviewing numerous Chinese and Western video...
Huawei Hisilicon Quietly Powering Tens of Millions of Western IoT Devices on Dec 12, 2018
Huawei Hisilicon chips are powering, at least, tens of millions of Western IoT devices, such as IP cameras and surveillance recorders, a fact that...
"New Zealand Govt Uses Chinese Cameras Banned In US", Considers Security Audit on Oct 12, 2018
Newsroom NZ has issued a report: "NZ Govt uses Chinese cameras banned in US": This comes after the US federal government banned purchases of...
Cybersecurity Startup VDOO Disclosing 10 Manufacturer Vulnerabilities Starting With Axis And Foscam on Jun 20, 2018
Cybersecurity startup VDOO has uncovered significant vulnerabilities in Axis cameras along with many others not yet disclosed. In this report, we...
French National Police Buy 10,400 Hikvision Body Cameras on May 31, 2018
France’s national police forces bought 10,400 Hikvision body cameras earlier this year, in a high-profile deal that’s coming into effect as the...
Directory of Video Surveillance Cybersecurity Vulnerabilities and Exploits on May 02, 2018
This list compiles reported exploits for security products, and is updated regularly. We have summarized exploits by date and by manufacturer,...
The 2018 Surveillance Industry Guide on Jan 16, 2018
The 300 page, 2018 Video Surveillance Industry Guide, covering the key events and the future of the video surveillance market, is now available,...
Xiongmai New Critical Vulnerability - Same Manufacturer Whose Products Drove Mirai Botnet Attacks on Dec 12, 2017
The Chinese manufacturer whose products were primarily responsible for the 2016 Mirai botnet attack has a new critical vulnerability, confirmed by...
Hikvision Backdoor Exploit on Sep 03, 2017
Full disclosure to the Hikvision backdoor has been released, allowing easy exploit of vulnerable Hikvision IP cameras. As the researcher, Monte...
Fortune 500 Company Bars Dahua and Hikvision on Aug 30, 2017
A Fortune 500 company has barred Dahua and Hikvision cameras from a large RFP due to cyber security concerns, IPVM has confirmed with the...
Hikvision VMS Password Recovery Vulnerability - Emailing Admin Passwords In Plain Text on Aug 28, 2017
Hikvision iVMS-4200 suffers from a vulnerability that allows anyone local, without authentication, to generate a code that Hikvision will respond...
Hikvision USA Head of Cybersecurity Exits on Jul 18, 2017
Hikvision USA's Head of Cybersecurity has exited the company. In this note, we review the move, share Hikvision's feedback and examine the...
Hikvision Hits Record 'ALL PRODUCTS' Sales Run on Jun 30, 2017
Hikvision has a new record. This one is for the most times a video surveillance manufacturer has put all their products on sale in 2 months....
Hikvision: IPVM Is "Destined To Fail" on Jun 14, 2017
Hikvision has accused IPVM of 'cyberbullying' them, declaring IPVM 'destined to fail.' This is the 3rd anti-IPVM Hikvision post in 2 weeks,...
Morten Tor Nielsen Defends Hikvision on Jun 12, 2017
Morten Tor Nielsen, veteran software developer for Prescienta working for OnSSI, has posted "In Defence of Hikvision". As Nielsen explains...
Hikvision Hardening Guide Recommends Port Forwarding on Jun 09, 2017
Hikvision's Network Security Hardening Guide recommends port forwarding as a 'standard configuration', highlighted below: In this note, we...
Hikvision Gives IPVM An 'F' on Jun 06, 2017
Two weeks after Hikvision called IPVM 'absolutely unethical' and 'anti-everything', Hikvision has given IPVM, in their words, an 'F'. Hikvision...
Milestone Entry Level Mobile Password Vulnerability Disclosed on May 24, 2017
While many manufacturers have only addressed cybersecurity vulnerabilities after public disclosures were made (or threatened), Milestone has...
Hikvision Marketer Caught Spamming, Fails at Coverup, Fired on May 23, 2017
A Hikvision marketing employee was caught by IPCamTalk trying to surreptitiously disparage IPVM and IPCamTalk. This is an outgrowth of Hikvision's...
Forget The Backdoor, "ALL HIKVISION PRODUCTS" On Sale on May 18, 2017
Less than 2 weeks after the Hikvision Backdoor was confirmed, Hikvision has launched a sale "ON ALL HIKVISION PRODUCTS". In this note, we examine...
Cisco: Hikvision Hired Us on May 16, 2017
The day after Hikvision's backdoor was confirmed by the US Department of Homeland Security, Hikvision issued a press release about a...
Hikvision Blaming Backdoor On Others, Cannot Hide From DHS on May 11, 2017
Numerous Hikvision employees are blaming their backdoor on others but Hikvision cannot hide from the US Department of Homeland Security. Blaming...
Hikvision 'Privilege-Escalating' Security Vulnerability, Actually a Backdoor on Mar 13, 2017
Hikvision has disclosed a new security vulnerability that affects 200+ of their IP cameras over the past few years. In this note, we examine the...
Comments (67) : Members only. Login. or Join.

Related Reports

Verint Victimized By Ransomware on Apr 18, 2019
Verint, which is best known in the physical security industry for video surveillance but has built a sizeable cybersecurity business as well, was...
LifeSafety Power NetLink Vulnerabilities And Problematic Response on May 20, 2019
'Power supplies' are not devices that many think about when considering vulnerabilities but as more and more devices go 'online', the risks for...
Honeywell Speaks On NDAA Ban, New Non-Banned Cameras and Cybersecurity on Aug 06, 2019
For years, Honeywell has depended on Dahua, a company with a poor cybersecurity track record and now banned by the US NDAA, for the development and...
Dahua Wiretapping Vulnerability on Aug 02, 2019
IPVM has validated, with testing, and from Dahua, that many Dahua cameras have a wiretapping vulnerability. Even if the camera's audio has been...
Hikvision OEM Directory on Aug 13, 2019
The Chinese government-owned and US-government banned Hikvision has become the world's largest video surveillance manufacturer and generally hidden...
Dahua OEM Directory on Aug 16, 2019
US Government banned Dahua OEMs for dozens of companies. The following directory includes 40+ of those companies with a graphic and links to...
Uniview OEM Directory on Sep 11, 2019
This directory lists 20+ companies that OEM products from Uniview, with a graphic and links to company websites below. It does not cover all...
Critical Vulnerability Across 18+ Network Switch Vendors: Cisco, Netgear, More on Aug 26, 2019
Cisco, Netgear and more than a dozen other brands, including small Asian ones, have been found to share the same critical vulnerability, discovered...
ONVIF Exposure To "Devastating DDoS Attacks" Examined on Sep 06, 2019
ZDnet reported "Protocol used by 630,000 devices can be abused for devastating DDoS attacks", citing exposure of ONVIF devices. And after an...
Dahua New Critical Vulnerability 2019 on Sep 23, 2019
Dahua has quietly admitted 5 new vulnerabilities including 1 critical vulnerability with a 9.8 / 10.0 CVSS score and 2 high vulnerabilities (scored...

Most Recent Industry Reports

Every VMS Will Become a VSaaS on Feb 21, 2020
VMS is ending. Soon every VMS will be a VSaaS. Competitive dynamics will be redrawn. What does this mean? VMS Historically...
Video Surveillance 101 Course - Last Chance on Feb 20, 2020
This is the last chance to join IPVM's first Video Surveillance 101 course, designed to help those new to the industry to quickly understand the...
Vulnerability Directory For Access Credentials on Feb 20, 2020
Knowing which access credentials are insecure can be difficult to see, especially because most look and feel the same. Even insecure 125 kHz...
AI/Smart Camera Tutorial on Feb 20, 2020
Cameras with video analytics, sometimes called 'Smart' camera or 'AI' cameras, etc. are one of the most promising growth areas of video...
China Manufacturer Suffers Coronavirus Scare on Feb 20, 2020
Uniview suffered a significant health scare last week after one of its employees reported a fever and initially tested positive for coronavirus....
Cheap Camera Problems at Night on Feb 19, 2020
Cheap cameras generally have problems at night, despite the common perception that integrated IR makes cameras mostly the same, according to new...
Milestone Launches Multiple Cloud Solutions on Feb 18, 2020
Milestone is going to the cloud, becoming one of the last prominent VMSes to do so. Milestone is clearly late but how competitive do these new...
Video Surveillance Architecture 101 on Feb 18, 2020
Video surveillance can be designed and deployed in a number of ways. This 101 examines the most common options and architectures used in...
UK Stands Behind Hikvision But Controversy Continues on Feb 18, 2020
Hikvision is exhibiting at a UK government conference for law enforcement, provoking controversy from the press, politicians, and activists due to...
IronYun AI Analytics Tested on Feb 17, 2020
Taiwan startup IronYun has raised tens of millions for its "mission to be the leading Artificial Intelligence, big data video software as a service...