Hikvision Happy With Bad Security Unless Hit With Bad Press

By: John Honovich, Published on Aug 28, 2017

Hikvision is happy to have bad cyber security unless they are hit with bad press, as we detail inside.

When you look at the pattern of their behavior, it is clear that anyone concerned about cyber security is taking significant risks with Hikvision. Hikvision's marketing claims to care but Hikvision's actions show otherwise.

#1 - Emailing Admin Passwords Plain Text

Hikvision has been emailing iVMS-4200 admin passwords in plain text. And they do not even attempt to verify who requests it, anyone unauthorized just presses a button on the client and Hikvision will immediately email the admin password in plain text, e.g. how they responded to one of our requests:

Today, Hikvision finally did something.

Why? Because IPVM published Hikvision VMS Password Recovery Vulnerability.

Hikvision emailed its dealers a [Special Bulletin] Security Structure Update to iVMS-4200. That 'structure update', which they did not even explain, was to stop allowing people to request admin passwords emailed in plain text.

And this is, unfortunately, commonplace with Hikvision.

#2 - Cracked Security Codes

Get Notified of Video Surveillance Breaking News
Get Notified of Video Surveillance Breaking News

Hikvision has known for more than a year that its 'security codes' to reset its IP cameras and recorders were cracked and available as unauthorized online 'tools'. Many of their recorders still had no firmware upgrade fix available for this crack.

On August 8, 2017, IPVM published Hikvision Security Code Cracked.

Hikvision responded on August 10th with a [Hikvision Special Bulletin] Password Reset Update. The convoluted post misled their dealers, dismissing "so-called Hikvision 'security code' being 'cracked'". But that is what Hikvision called them - 'security codes' as shown from their own documentation:

And Hikvision did not have enough respect for their dealers to let them know that working generators for these security codes are still available online.

Worse, Hikvision is still allowing these unauthenticated resets with a new generator that they hope will not get cracked.

#3 - Hikvision Backdoor

On March 5th, 2017, a researcher announced a Hikvision camera backdoor (who later DHS gave credit to in Hikvision's worst 10.0 vulnerability advisory).

On March 10th, we emailed Hikvision telling Hikvision we planned to release an article on Monday, March 13th. And on Sunday, March 12, Hikvision again issued a [Hikvision Special Bulletin] Update on Privilege-Escalating Vulnerability. Again, Hikvision obscured the risk with the vague statement "obtain an unauthorized escalated additional user privilege". It was only until the DHS advisory was released that the public learned the true severity of the vulnerability.

#4 - Hikvision Defaulted Devices Mass Hacked

On March 2, 2017, IPVM published Hikvision Defaulted Devices Getting Hacked after weeks of ongoing reports from Hikvision dealers saying that their systems had been hacked. Hikvision knew well that this was happening but they said nothing to their dealers.

Until IPVM published, and then Hikvision immediately issued another [Hikvision Special Bulletin] Defense Against Scripted Application.

Public 'Proclamations'

Hikvision's poor practices occur despite their claims that Cisco 'recognized' their cybersecurity or that they hired Rapid7 to do vulnerability assessments. It is hard to imagine that Cisco or Rapid7 would approve of emailing admin passwords in plain text. It, evidently, is not so hard to imagine Hikvision accepting such practices.

Lessons Learned

These incidents show that Hikvision's actions fall far behind their marketing claims and even their communication to their 'partners' is focused on doing damage control and spinning bad press.

If you are serious about cyber security, you cannot seriously use Hikvision.

5 reports cite this report:

Hikvision Admits Backdoor 'PR Issue' on Oct 24, 2017
Hikvision is admitting a problem. The backdoor itself is evidently not the...
FLIR Thermal Camera Multiple Vulnerabilities, Patch Released on Oct 03, 2017
Multiple cyber security vulnerabilities exist in FLIR thermal cameras, which...
80+ OEMs Verified Vulnerable To Hikvision Backdoor on Sep 22, 2017
Over 80 Hikvision OEM partners, including ADI, Interlogix, LTS, and Northern...
Hikvision Backdoor Exploit on Sep 03, 2017
Full disclosure to the Hikvision backdoor has been released, allowing easy...
Fortune 500 Company Bars Dahua and Hikvision on Aug 30, 2017
A Fortune 500 company has barred Dahua and Hikvision cameras from a large RFP...
Comments (30) : Members only. Login. or Join.

Related Reports

Faked Coronavirus Fever Detection, Athena Used Hikvision; Responds - Selling NDAA Compliant Cameras, Pledging 50% Of Profits to Victims on Mar 24, 2020
US company, Athena Security, faked its coronavirus fever detection marketing,...
Vulnerability Directory For Access Credentials on Feb 20, 2020
Knowing which access credentials are insecure can be difficult to see,...
Anixter Runs Fake Coronavirus Marketing Using Shutterstock Watermarked Images on Jul 24, 2020
Coronavirus faked marketing is regrettably commonplace right now but Anixter...
"He Is An Idiot!" Exclaims SIA Director John Mack on Mar 23, 2020
Here is another inside look into the "leaders" of the security industry. SIA...
Breaking Into A Facility Using Canned Air Tested on Jan 28, 2020
Access control is supposed to make doors more secure, but a $5 can of...
Add Door Operators To Fight Coronavirus on Mar 31, 2020
IPVM recommends that integrators advocate and end-users consider adding door...
Fever Cameras Are Medical Devices, Per The FDA, Dahua, Feevr, Hikvision, InVid Contrary Claims Are False on May 28, 2020
Fever cameras are medical devices, despite what euphemisms various sellers...
Hikvision Illicitly Uses Back To The Future In Marketing on Jul 03, 2020
NBCUniversal told IPVM that Hikvision UK's ongoing coronavirus marketing...
Wrong Dahua Australia Medical Device Approved on Jul 20, 2020
Dahua's body temperature system is now in Australia's medical device...
Hikvision Hides Xinjiang R&D Activities on Apr 22, 2020
Hikvision has systematically deleted evidence showing their R&D base and...
Access Visitor Management Systems Guide on Jul 22, 2020
"Who are you, and why are you here?" Facilities that implement Visitor...
Faked Convergint Fever Camera 'Expert' Marketing on Jun 16, 2020
Convergint touts they are "THERMAL CAMERA SOLUTION EXPERTS" while faking...
Convergint Refuses To Fix Faked Fever Marketing, FTC Complaint Filed on Jun 19, 2020
Since Convergint has refused to fix their faked fever camera marketing, IPVM...
UK Firm Markets False Fever Screening, Hikvision Disavows on Jun 30, 2020
A UK security firm falsely claimed its Hikvision-based thermal solution could...
Dahua Faked Coronavirus Camera Marketing on Apr 01, 2020
Dahua has conducted a coronavirus camera global marketing campaign centered...

Recent Reports

Dangerous Hikvision Fever Camera Showcased by Chilean City on Aug 07, 2020
Deploying a fever camera outdoors, in the rain, with no black body, is...
"Grand Slam" For Pelco's PE Firm, A Risk For Motorola on Aug 07, 2020
The word "Pelco" and "grand slam" have not been said together for many years....
FLIR Stock Falls, Admits 'Decelerating' Demand For Temperature Screening on Aug 07, 2020
Is the boom going to bust for temperature screening? FLIR disappointed...
VSaaS Will Hurt Integrators on Aug 06, 2020
VSaaS will hurt integrators, there is no question about that. How much...
Dogs For Coronavirus Screening Examined on Aug 06, 2020
While thermal temperature screening is the surveillance industry's most...
ADT Slides Back, Disappointing Results, Poor Commercial Performance on Aug 06, 2020
While ADT had an incredible start to the week, driven by the Google...
AHJ / Authority Having Jurisdiction Tutorial on Aug 06, 2020
One of the most powerful yet often underappreciated characters in all of the...
SIA Coaches Sellers on NDAA 889B Blacklist Workarounds on Aug 05, 2020
Last month SIA demanded that NDAA 899B "must be delayed". Now that they have...
ADI Returns To Growth, Back To 'Pre-COVID Levels' on Aug 05, 2020
While ADI was hit hard in April, with revenue declining 21%, the company's...
Exposing Fever Tablet Suppliers and 40+ Relabelers on Aug 05, 2020
IPVM has found 40+ USA and EU companies relabeling fever tablets designed,...
Indian Government Restricts PRC Manufacturers From Public Projects on Aug 04, 2020
In a move that mirrors the U.S. government’s ban on Dahua and Hikvision...
Directory of 201 "Fever" Camera Suppliers on Aug 04, 2020
This directory provides a list of "Fever" scanning thermal camera providers...
Face Masks Increase Face Recognition Errors Says NIST on Aug 04, 2020
COVID-19 has led to widespread facemask use, which as IPVM testing has shown...
Dahua Loses Australian Medical Device Approval on Aug 04, 2020
Dahua has cancelled its medical device registration after "discussions" with...
Google Invests in ADT, ADT Stock Soars on Aug 03, 2020
Google has announced a $450 million investment in the Florida-based security...