Hikvision Happy With Bad Security Unless Hit With Bad Press
Hikvision is happy to have bad cyber security unless they are hit with bad press, as we detail inside.
When you look at the pattern of their behavior, it is clear that anyone concerned about cyber security is taking significant risks with Hikvision. Hikvision's marketing claims to care but Hikvision's actions show otherwise.
#1 - Emailing Admin Passwords Plain Text
Hikvision has been emailing iVMS-4200 admin passwords in plain text. And they do not even attempt to verify who requests it, anyone unauthorized just presses a button on the client and Hikvision will immediately email the admin password in plain text, e.g. how they responded to one of our requests:
Today, Hikvision finally did something.
Why? Because IPVM published Hikvision VMS Password Recovery Vulnerability.
Hikvision emailed its dealers a [Special Bulletin] Security Structure Update to iVMS-4200. That 'structure update', which they did not even explain, was to stop allowing people to request admin passwords emailed in plain text.
And this is, unfortunately, commonplace with Hikvision.
#2 - Cracked Security Codes
Hikvision has known for more than a year that its 'security codes' to reset its IP cameras and recorders were cracked and available as unauthorized online 'tools'. Many of their recorders still had no firmware upgrade fix available for this crack.
On August 8, 2017, IPVM published Hikvision Security Code Cracked.
Hikvision responded on August 10th with a [Hikvision Special Bulletin] Password Reset Update. The convoluted post misled their dealers, dismissing "so-called Hikvision 'security code' being 'cracked'". But that is what Hikvision called them - 'security codes' as shown from their own documentation:
And Hikvision did not have enough respect for their dealers to let them know that working generators for these security codes are still available online.
Worse, Hikvision is still allowing these unauthenticated resets with a new generator that they hope will not get cracked.
#3 - Hikvision Backdoor
On March 5th, 2017, a researcher announced a Hikvision camera backdoor (who later DHS gave credit to in Hikvision's worst 10.0 vulnerability advisory).
On March 10th, we emailed Hikvision telling Hikvision we planned to release an article on Monday, March 13th. And on Sunday, March 12, Hikvision again issued a [Hikvision Special Bulletin] Update on Privilege-Escalating Vulnerability. Again, Hikvision obscured the risk with the vague statement "obtain an unauthorized escalated additional user privilege". It was only until the DHS advisory was released that the public learned the true severity of the vulnerability.
#4 - Hikvision Defaulted Devices Mass Hacked
On March 2, 2017, IPVM published Hikvision Defaulted Devices Getting Hacked after weeks of ongoing reports from Hikvision dealers saying that their systems had been hacked. Hikvision knew well that this was happening but they said nothing to their dealers.
Until IPVM published, and then Hikvision immediately issued another [Hikvision Special Bulletin] Defense Against Scripted Application.
Public 'Proclamations'
Hikvision's poor practices occur despite their claims that Cisco 'recognized' their cybersecurity or that they hired Rapid7 to do vulnerability assessments. It is hard to imagine that Cisco or Rapid7 would approve of emailing admin passwords in plain text. It, evidently, is not so hard to imagine Hikvision accepting such practices.
Lessons Learned
These incidents show that Hikvision's actions fall far behind their marketing claims and even their communication to their 'partners' is focused on doing damage control and spinning bad press.
If you are serious about cyber security, you cannot seriously use Hikvision.