Hikvision USA Misleads Dealers On Backdoor

Author: John Honovich, Published on Oct 03, 2017

Hikvision USA emailed their dealers overnight with their 5th cyber security 'special bulletin' of the year.

Misleading

Unfortunately, they have misled their dealers by omitting critical information:

  • Details of how to exploit the vulnerability were published last month. This is new, significantly increasing the risk to Hikvision dealers and not mentioned by Hikvision at all.
  • The vulnerability can be easily exploited. This is new and important since it further increases the risk to Hikvision dealers.
  • Hikvision IP cameras are being actively hacked using this exploit and Hikvision is well aware of this. However, Hikvision does not mention this to their dealers.

Hikvision USA is clearly concerned about scaring or upsetting their dealers. And some dealers will never find out the truth. But many others will and it will rightfully reduce their trust in Hikvision.

One general pattern that has emerged is that dealers can understand vulnerabilities occurring (though certainly not as bad as Hikvision's backdoor) but they want their manufacturers to be up front and clear about risks. Hikvision does not need to call this a backdoor but they certainly can be clear about critical details like the exploit being publicly known and that attacks against vulnerable Hikvision devices are now ongoing.

Vote / Poll

Video Demo

The video below demoing the Hikvision backdoor exploit:

5 reports cite this report:

Hikvision Covers Up Racial Profiling And AI Error on Jun 25, 2018
Faced with global scrutiny, led by the US government-funded Voice of America (VOA), Hikvision has covered up evidence showing their racial...
Hikvision Corrects False Cybersecurity Announcement on Jun 18, 2018
Hikvision has corrected a false cybersecurity announcement that claimed a British government-sponsored program endorsed the cybersecurity of...
The 2018 Surveillance Industry Guide on Jan 16, 2018
The 300 page, 2018 Video Surveillance Industry Guide, covering the key events and the future of the video surveillance market, is now available,...
Dahua Trying, Struggling To Respond To Hacking Attacks on Oct 04, 2017
Now, 2 weeks since large-scale hacking attacks commenced against Dahua vulnerable devices, we analyze Dahua's response. On the positive side,...
Hikvision Europe Warns Of "A Wave of Cyberattacks" on Sep 28, 2017
Hikvision Europe has issued a "Hikvision Security Advisory" press release and emailed an e-newsletter with the advisory at the very top: ...

Comments (39)

Only IPVM PRO Members may comment. Login or Join.

Maybe, if Hikvision starts another big discount-week, will everybody forget about this disturbing IT-Security-Thing?

Edit: Misssing - - > :)

I doubt it.

I swear every time I log into ADI, Hik is on sale. Its the norm now. Now if Milestone or AXIS ran a 20% off sale, that might distract.

I swear every time I log into ADI, Hik is on sale. Its the norm now

I was wondering if you were exaggerating so I went to ADI's homepage:

I am a Hikvision Dealer, I dont feel exploited, I do not think I have been tricked or mislead by the company. I buy a substantial quantity of equipment and converse with the company often so please to keep this honest put it in print (Black & White) the Dealer's name , their Dealer # and where they are located that has told IPVM directly that they feel mistreated or tricked, please.

That's because you read IPVM every day and know about their issues through us. You're welcome.

As for asking for the dealers name, #, and location, shouldn't every seller or installer of Hikvision product also list that Hikvision is majority owned by the Chinese Communist Government? Just guessing, I have no statistics here, but I feel confident a majority of end users and corporate purchase managers would feel "exploited", tricked", or "mislead" if later discovering what they bought.

Hikvision needs to learn how to get ahead of issues like this and to promote a more proactive approach to fixing and marketing/communicating the fix to their integrator network.

I also think IPVM loves to pile on a bit. I appreciate hearing about the issues within the IPVM forum, but the coverage doesn't need to be a new headline everyday about how stupid and untrustworthy Hikvision continues to be.

The software industry and specifically Microsoft have been fighting OS security vulnerabilities for decades. No one really pay attention to forced Microsoft updates any longer. Just a matter of business/upgrades as usual.

This is my first post, I'm sure I'll get ripped to shreds....

Brian, thanks for the feedback!

I definitely think reasonable people can disagree about the amount of coverage of any one company or topic. We posted positively last week on Hikvision when Hikvision Europe did a better job of communicating. We posted negatively today on Hikvision when Hikvision USA did a poor job.

Agree, equal important to acknowledge positive as negative, no matter what subject it has.

One day, I hope and believes (?) it will be acknowledged and easy to keep these things updated as well.

It's software written by humans, humans do errors, it's all about how you own the errors, learn from them and not to be ashamed to fix them.

It's software written by humans, humans do errors, it's all about how you own the errors, learn from them and not to be ashamed to fix them.

I have to call BS on this.This is not simple human error. This is pure laziness, and sloppy work. I am not sure I am ready to say it was done on purpose.

Hik and Dahua should step up, hire a 3rd party if necessary and fix this once and for all.

Neither one has done a decent job of addressing the issues or fixing them. They just get away with bare minimum, if that

I think they are both pretty big POS right now.

I would say both yes and no in this
This is pure laziness, and sloppy work. I am not sure I am ready to say it was done on purpose.
But I can do (and I have done so too), and I'm still convinced.
In this i totally agree with you.
Hik and Dahua should step up, hire a 3rd party if necessary and fix this once and for all. Neither one has done a decent job of addressing the issues or fixing them. They just get away with bare minimum
With one exception.
fix this once and for all.
If you want to stop all development, yes - then I can agree, if not - I won't agree.
In the end, it's all about how you own it, putting your head down in a hole and hoping it will disappear is defiantly not the right way, for sure.
Both HIK (Except HIK Europe) and Dahua have shown good examples of trying to make things disappear by dipping their heads into a (another) hole.

There was an article published in the States on the 25th by a Hik representative in which they brushed over mostly everything and branded it as rubbish. The same article in which IPVM was accused of 'tabloid' tactics and JH got a sneer or two as well (supposed he's used to that now anyway). Unfortunately I lost the link but I'm sure someone else will have it. It again underlines the arrogance and denial within Hikvision and their sheer incompetence when it comes to dealing with the issues disclosed.

There was an article published in the States on the 25th by a Hik representative in which they brushed over mostly everything and branded it as rubbish. The same article in which IPVM was accused of 'tabloid' tactics

Yes, this is the Hikvision blog post you are alluding to: Hikvision North America’s Jeffrey He Talks Company’s Progress, Cybersecurity, Growth, Partner.Win. including:

In recent years an online blogger has sought to gain blog subscribers with tabloid-style attacks on Hikvision and by promoting offensive rhetoric about China and the Chinese people.

Hikvision is under a lot of pressure and it might feel good momentarily to respond like this but it is a poor counter to legitimate issues raised.

It would be alot easier on Hikvision and Dahua to allow the user to receive push notifications to notify the user to upgrade their equipment of some sort as opposed to putting a notice every 2 months on their website reminding people to upgrade their firmware. Hopefully the take this into consideration as a feature for future firmwares. I would like to see a press release announcing this.

I spoke with HikVision USA about "Cyber Security" at ASIS 2017 last week and it sounds like their new Director of Cyber Security is at least aware of the situation.

He said two things that gave me some hope as an integrator.

Step 1:

He wants to update the EULA to include forced updates on HikVision's devices so that if a situation like this were to occur again they could push firmware to the device.

Step 2:

He wants to enable the NVR/VMS Software to push firmware over the LAN to make firmware updates more manageable in the future.

That being said words mean little in this industry. Hopefully he can actually accomplish what he has set out to do.

1. "Want to do" and "achieve what to do" is two totally different things.

2. "Forced updates" I don't like, but notification about new updates along with easy "update" I do like (and not by using P2P)

3. "Updates more manageble" I also like (Dahua ????)

I agree. What they want to do versus what they will do are probably two very different things. All I can do at this point is hope for the best and prepare for the worst. Not much else to say.

I spoke with HikVision USA .... their new Director of Cyber Security is at least aware of the situation.... He wants to update the EULA

Updating the EULA would be good idea. While they are at it, they should re-examine this: Hikvision EULA Rejects Responsibility for Hacked Hikvision Cameras (Hi Chuck).

John - what do you mean, "Hi Chuck"?

Maybe this deserves it's on thread, and 'misleading' might be a bit strong here, but I recently came across this in the description posted by a Hik employee in the UK;

Providing professional services to integrators and end users, demonstrating HikVisions hardware with 3 times the low light performance of other leading brands, easy to use licensed software and demonstrating how Hikvision can offer the industries lowest Total Cost of Ownership and Business Intelligence to take your business to the next level of site management.

I wasn't aware of Hikvision offering licensed software...did I miss something?

easy to use licensed software

Even free software (like the iVMS-4200) has a license technically. And Hikvision has paid software like the iVMS-5200 and HikCentral, which he could be alluding too.

How could anyone vote no on either of those questions? Of course their dealers should be made as fully aware as soon as possible in any security issue.

How could anyone vote no on either of those questions?

  1. Hik employee
  2. Fat finger

Must... resist... compulsion to... add a third option.

We all know who the third option is :)

Hmm.. are you the "third option"? o_O

I can assure you I am not. Not enough commas.

....Ma....Ma... Never mind, it's too early.

I believe that honesty is the best policy. If a company as large as Hikvision wants to retain its customers then it should do all it can to provide information on possible security threats and also provide fixes to these issues in a timely manner.

I agree, but it really doesn't matter if its big manufacture or small, mistake has been made - take the pain as a grown up, do something about it, admit it - folks will appreciate that better then sticking the head into a hole and hoping it going away.

Sure, it's some pain and some efforts, but it's surely a lot better to have customers relying into to have security issues fixed, and fixed fast - than never.

I remember in the beginning of Microsoft issues with security fixes, they did the same - and even back then asked for money to have fixes issued to customers, especially in the NT4 period, there was lots of hassle to get Microsoft get this kind of issues fixed.

But not to long time until they started to release HotFix'es.

Why I bring this up here, I see exactly the same tendency here - ignore and hope it will go away.

Frankly speaking, it is somewhat true, keep quiet - do absolutely minimal, and it will actually not be any "no new news" anymore, and sort of "forgotten" - until what's happen the last weeks with Hikvision and Dahua globally hacked, only to what I can guess as reminder - Install your patched firmware now!

Hikvision, Dahua, whoever... don't be ashamed - shit happens!, take the pain, fix it by new release and easy update for customers.

Ok, I know you are not there in any of it, but you will need to start - if you not already have, you loosing money by not doing so - simple math.

Each IPVM thread critical of manufacturer antics should have a counter until someone brings out the buried head meme. I am guilty of it, too.

What should the counter be set to (10....20...50...100...1000)? @Undisclosed Integrator #7

I am always puzzled by the fact that these articles promote sensationalism and conflict related to the current most popular camera manufacturer.

i remember the days when IPVideo Marketplace was an educational forum for discussions regarding how to solve problems in the industry. Now the posts and responses are on par with National Enquirer.

Maybe we should discuss how to not make these devices vulnerable to security threats in the first place. If IPVM and others who respond would discuss how to create a secure network for these systems, we would not have to cry in the model of "Trumpism". (I am a longtime member and contributor to this service). Why not help the integrators and customers create secure systems that are not vulnerable?

I can only see these threats existing when the devices are given a public address or by designation of them or DVR/NVR/Servers as DMZ via port forwarding. Who does this? For those that do, why not respond with advice with technical know-how on the proper way to secure the networks and devices.

Stop the witch hunts against Dahua, Hikvision, etc. You have bred a new generation of IPVM members who are posting non-constructive critisizm, without providing needed education, which was the original intent of this service.

I used to read the content of this site daily, and the responses in the discussion section were highly valuable. Now. I find myself visiting maybe once a week, and I wince at the negative and non productive content that is occurring.

This is an exciting field for those that are new and old to the technology. In the last decade we have seen, since h.264 megapixel in 2008, a product that has become highly valuable to our clients. Lets change course back to the original intent of IPVM, and do away with the nonsense and constant attacks on manufacturers that make this, and our careers, possible. You have scared away many from making valuable input to this site.

Identifying "undisclosed" contibutors by IPVM staff in posts is also a new low.

I can only see these threats existing when the devices are given a public address or by designation of them or DVR/NVR/Servers as DMZ via port forwarding. Who does this? For those that do, why not respond with advice with technical know-how on the proper way to secure the networks and devices.

Jeffery, Hikvision and Dahua both tell customers to use port forwarding. You can certainly say it is unprofessional but it is being driven by those manufacturers.

1 - Hikvision Hardening Guide Recommends Port Forwarding,

2 - Dahua How-to remote access through port forwarding

What do you have to say about that? Is that a National Enquirer smear or is that a genuine issue that Dahua and Hikvision need to address?

As for:

Identifying "undisclosed" contibutors by IPVM staff in posts is also a new low.

What undisclosed poster did IPVM staff identify?

Why not help the integrators and customers create secure systems that are not vulnerable?

I think that is the point of all of these posts. Bring attention to these security issues so manufacturers have to focus on making security hardware more secure.

I do agree with Jeffrey about helping integrators.

To that end, it is worth noting we have a VPNs for Video Surveillance Guide and we teach that in each of our IP networking classes to help integrators better understand the importance and steps to using VPNs.

A suggestion would be to use the P2P option with the qr code and an app such as easy4ip. I have heard that the refresh rate is slower than accessing your NVR via port forwarding but this solution I believe is far safer.

http://www1.dahuasecurity.com/products_category/easy4ip-587.html

I would appreciate your thoughts and experience on using this option.

Related Reports on Hacking

Spring 2019 IP Networking Course- Register Now on Apr 04, 2019
Register now for the Spring 2019 IP Networking course here. Just $299 for the course. This is the only networking course designed specifically...
Silicon Valley Cybersecurity Insurance Startup Coalition Profile on Mar 20, 2019
Many industry people believe cybersecurity insurance is not worth it, as the voting and debate in our Cybersecurity Insurance For Security...
Hikvision Favorability Results 2019 on Mar 18, 2019
Hikvision favorability results declined significantly in IPVM's 2019 study of 200+ integrators. While in 2017 Hikvision's favorability was...
Bosch VDOO 2018 Vulnerability on Dec 20, 2018
Security research firm VDOO has discovered a critical vulnerability in Bosch IP cameras. Inside, we cover the available details of this new...
Genetec UL Cybersecurity Certificate (2900-2-3) Examined on Dec 19, 2018
Proving a company is cybersecure has become a major concern for security companies. But how trustworthy are these certificates? Earlier in 2018, a...
No GDPR Penalties For UK Swann 'Spying Hack' on Nov 20, 2018
The UK’s data protection agency has closed its investigation into Infinova-owned Swann Security UK, the ICO confirmed to IPVM, deciding to take “no...
HID: Stop Selling Cracked 125 kHz Credentials on Nov 05, 2018
HID should stop selling cracked 125 kHz access control credentials, that have been long cracked and can easily be copied by cheap cloners sold on...
"New Zealand Govt Uses Chinese Cameras Banned In US", Considers Security Audit on Oct 12, 2018
Newsroom NZ has issued a report: "NZ Govt uses Chinese cameras banned in US": This comes after the US federal government banned purchases of...
China Hacks Video Servers Causing Uproar on Oct 05, 2018
An incident causing an international uproar is hitting home in the video surveillance industry as a Bloomberg report, "The Big Hack: How China...
Genetec Takes Aim At 'Untrustworthy' 'Foreign Government-Owned Vendors' on Sep 24, 2018
Genetec is taking aim at 'untrustworthy' 'foreign government-owned vendors'. This is not a new theme for Genetec as nearly 2 years ago, Genetec...

Most Recent Industry Reports

Hikvision Admits USA Sales Falling on Apr 22, 2019
Hikvision, in a new Chinese financial filing, has admitted that its USA sales are now falling. Less than a year after the US government passed a...
Speco Ultra Intensifier Tested on Apr 22, 2019
While ISC West 2019 named Speco's Ultra Intensifier the best new "Video Surveillance Cameras IP", IPVM testing shows the camera suffers from...
Arecont Favorability Results 2019 on Apr 22, 2019
Arecont's net negativity remained the same in IPVM's 2019 integrator study, though integrator's feeling became relatively more neutral compared to...
H.265 Usage Statistics on Apr 19, 2019
H.265 has been available in IP cameras for more than 5 years and, in the past few years, the number of manufacturers supporting this codec has...
ACRE Acquires RS2, Explains Acquisition Strategy on Apr 19, 2019
ACRE continues to buy, now acquiring RS2, just 5 months after buying Open Options. One is a small access control manufacturer from Texas, the...
Access Control Course Spring 2019 - Last Chance on Apr 19, 2019
Register for the Spring Access Control Course. IPVM offers the most comprehensive access control course in the industry. Unlike manufacturer...
Riser vs Plenum Cabling Explained on Apr 18, 2019
You could be spending twice as much for cable as you need. The difference between 'plenum' rated cable and 'riser' rated cable is subtle, but the...
Verint Victimized By Ransomware on Apr 18, 2019
Verint, which is best known in the physical security industry for video surveillance but has built a sizeable cybersecurity business as well, was...
Milestone Drops IFSEC on Apr 18, 2019
Milestone has dropped out of Europe's largest annual security trade show (IFSEC 2019), telling IPVM that they "have found that IFSEC in EMEA no...

The world's leading video surveillance information source, IPVM provides the best reporting, testing and training for 10,000+ members globally. Dedicated to independent and objective information, we uniquely refuse any and all advertisements, sponsorship and consulting from manufacturers.

About | FAQ | Contact