Hikvision Defaulted Devices Getting Hacked

By: Brian Karas, Published on Mar 02, 2017

Hikvision devices with default passwords and remote network access enabled (via DDNS, public IPs, etc.) have experienced wide spread hacking over the past month locking out users, IPVM has confirmed.

This is new, and from what has been reported by those affected, appears to be different than Mirai. During the Mirai botnet attacks in 2016, there were no reports of Hikvision devices being hacked.

[UPDATE: 4 hours after IPVM's report was released, Hikvision sent an email to its dealers admitting this.]

Reported Infections

US, UK and New Zealand integrators have all reported cases of Hikvision recorders being attacked, at least hundreds of devices in the past month from just these reports:

Today lots of Hikvision customers dvr/nvrs, used till now with default password (12345), seem to have changed password by themselves.

We are HiKVision OEM partner. These DVRs will have been hacked. Over the last week we have had over 150 customer DVRs that have been hacked and the password changed.

I just experienced my first one this week. Symptom was DVR not accessible via browser or app, password didn't work. I had to go on site and run the password reset. Was an older firmware and it let me. When I got back in I found this: I never created a "system" account.

I have had a couple Interlogix cameras (same thing as Hikvision renamed) do the same thing and we had to go out and physically factory default the camera. The weird think about it is that they are attached to an Avigilon VMS and not open to the Internet. Something very odd going on here and I can't figure it out.

We've had four customers in the last couple of weeks locked out of their Hikvision recorders by what looks like bot. All clients were on old firmware with default admin password of 12345 and default ports -I know, I know, they were all installs from years ago who we hadn't visited since. In all cases the admin password has changed and a new SYSTEM user has been added. Our Hikvision distributor has been inundated with pw reset code requests.

Get Notified of Video Surveillance Breaking News
Get Notified of Video Surveillance Breaking News

Most of our calls (20-30) were HIK OEM’s (KT&C rebrands TVL series) HD-TVI recorders.

In every case reported so far, the recorders were using the default admin password "12345", and had remote access to the web interface on port 8000. Firmware versions affected are unknown, but are likely older versions before Hikvision forced users to set their own admin password.

The attack changes the default admin password, and adds a new account, "system" to the device. So far there is no evidence the recorders have been used in any kind of botnet attack.

Stopping / Handling This

Botnets move fast across the Internet - iterating over the finite number of public IP addresses is straightforward, and tools like Shodan plus Hikvision's Online still unfixed enumeration vulnerability make it easy to find devices that may be susceptible to a known exploit. Chances are, if your Hikvision recorder has an admin password of "12345", or an easily guessed password, and is accessible via the public Internet, it has already been hacked.

If your recorder has a "system" account in the user list that was not added on purpose, it has been affected:

If you have been hacked, you will need to restore the admin password to gain access to the device. One integrator reported success using Hikvision's password reset function, others have done a physical restore/reset on the device.

If you have not been hacked, ensure the admin password is set to something uncommon and not easily guessed. Additionally, ensure firmware is kept up to date, check Hikvision's firmware directory [link no longer available] for latest versions.

Attack Details

Because affected devices have not had ports like telnet or SSH open, or were running firmware builds known to have these services disabled, the most likely scenario is that the attack utilizes the web UI to create the new account and alter the admin password.

The attack can most likely try passwords other than "12345", similar to how Mirai has a list of common username/password combinations it tries on each device it attacks.

This attack also has the potential to infect many more devices than Mirai did, as it only requires remote access to the standard user interface, and does not require telnet or SSH access. Where Mirai relied on devices with no firewall, or poorly configured firewalls, this attack can target devices that are behind a firewall, as long as they have basic remote access enabled.

Purpose/Extent Of Exploit Unknown

What the attack does that may not be visible, such as upload scripts or files intended to be called later, after enough devices are infected to create a strong botnet army, is not yet known. Because of this, the best course of action would be to completely reset the device, upgrade to latest firmware, and set a strong admin password before putting it back online.

Responsibility

While Hikvision is responsible for making such equipment, the integrators and users involved are responsible, both for not having upgraded their equipment in 2 years or more since these risks were made clear by Hikvision, and by incidents like the Mirai botnet that relied on poorly secured devices.

Market Impact

While Hikvision can rightfully point to its efforts to improve in the past 2 years, they will still suffer from the various integrators and end users who are impacted by this botnet hacking, and having to spend time resetting or restoring affected units.

UPDATE: Hikvision Admits

Hikvision has obviously known about this for weeks. If IPVM is getting a half dozen reports, that means Hikvision must have gotten 500 or 5,000 reports. However, instead of doing the right thing and letting people know immediately about this, they choose to hide it until IPVM's report forced them to acknowledge it. By delaying, they have put more users at risk.

4 hours after IPVM's report was released, Hikvision (USA) sent an email to its dealers admitting this:

Here is Hikvision's full "Defense' statement about the attacks.

Vote / Poll

10 reports cite this report:

Canon Responds To IP Camera Hacks on May 30, 2018
Canon cameras made international news earlier this month, with reports of them being hacked in Japan (e.g., Hackers disable scores of Canon-made...
Hikvision Happy With Bad Security Unless Hit With Bad Press on Aug 28, 2017
Hikvision is happy to have bad cyber security unless they are hit with bad press, as we detail inside. When you look at the pattern of their...
Hikvision Responds To Cracked Security Codes on Aug 15, 2017
Hikvision has responded to IPVM's report on Hikvision's security code being cracked, both with a 2 page update to dealers and communication...
Morten Tor Nielsen Defends Hikvision on Jun 12, 2017
Morten Tor Nielsen, veteran software developer for Prescienta working for OnSSI, has posted "In Defence of Hikvision". As Nielsen explains...
Hikvision Backdoor Confirmed on May 08, 2017
The US Department of Homeland Security's Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) has issued an advisory for...
Manufacturers Cheer ISC West 2017 Performance on Apr 11, 2017
ISC West 2017 showed strong satisfaction results from manufacturers, similar to 2016's ISC West. 100 manufacturers rated their impressions of ISC...
Q1 2017 Video Surveillance Market Review on Mar 30, 2017
These are the most notable moves and events for January - March 2017 in the video surveillance market. Cybersecurity Rising Cybersecurity, once...
Uniview Weak Local / Strong Remote Password Policy Tested on Mar 14, 2017
With the continuing onslaught of cyber-security breaches (see Dahua backdoor recently discovered, Hikvision defaulted devices getting hacked)...
Who Is Hacking Hikvision Devices? on Mar 06, 2017
Someone or organization is mass hacking Hikvision devices, actively and systematically running a script / program across the Internet that looks...
Dahua Backdoor Uncovered on Mar 06, 2017
A major cyber security vulnerability across many Dahua products has been discovered by an independent researcher, reported on IPVM, verified by...
Comments (82) : Members only. Login. or Join.

Related Reports

China DVR/NVR Backdoor Discovered, Huawei Refutes on Feb 07, 2020
A backdoor was found in Chinese-produced DVRs and NVRs that secretly allowed access to the recorders. While it was first attributed to Huawei...
Remote Access (DDNS vs P2P vs VPN) Usage Statistics 2019 on Oct 25, 2019
Remote access can make systems more usable but also more vulnerable. How are integrators delivring remote access in 2019? How many are using...
Dahua New Critical Vulnerability 2019 on Sep 23, 2019
Dahua has quietly admitted 5 new vulnerabilities including 1 critical vulnerability with a 9.8 / 10.0 CVSS score and 2 high vulnerabilities (scored...
Uniview OEM Directory on Sep 11, 2019
This directory lists 20+ companies that OEM products from Uniview, with a graphic and links to company websites below. It does not cover all...
ONVIF Exposure To "Devastating DDoS Attacks" Examined on Sep 06, 2019
ZDnet reported "Protocol used by 630,000 devices can be abused for devastating DDoS attacks", citing exposure of ONVIF devices. And after an...
Critical Vulnerability Across 18+ Network Switch Vendors: Cisco, Netgear, More on Aug 26, 2019
Cisco, Netgear and more than a dozen other brands, including small Asian ones, have been found to share the same critical vulnerability, discovered...
Dahua Wiretapping Vulnerability on Aug 02, 2019
IPVM has validated, with testing, and from Dahua, that many Dahua cameras have a wiretapping vulnerability. Even if the camera's audio has been...
LifeSafety Power NetLink Vulnerabilities And Problematic Response on May 20, 2019
'Power supplies' are not devices that many think about when considering vulnerabilities but as more and more devices go 'online', the risks for...
Subnetting for Video Surveillance on Apr 30, 2019
This guide explains when subnetting is used on security networks, and how it works. We explain how to add or remove IP addresses to your range,...
HTTPS / SSL Video Surveillance Usage Statistics on Apr 01, 2019
HTTPS / SSL / TLS usage has become commonplace for websites to improve security and, in particular, to help mitigate attackers reading or modifying...

Most Recent Industry Reports

ISC West 2020 Cancelled Again, Rescheduled For October 2020 on Apr 09, 2020
ISC West March 2020 was canceled. Now ISC West July 2020 has been canceled. SIA and Reed hope to run it in October 2020. This is a masterclass...
Sunell "Panda Cam" Thermal Body Temperature System Examined on Apr 09, 2020
Sunell's Panda Cam is the most visually recognizable coronavirus camera, sold by numerous OEMs around the world. But who is Sunell? This company is...
Use Access Control Logs To Constrain Coronavirus on Apr 09, 2020
Access control users have included capabilities that are not commonly used that can help zero-in and discover potential Coronavirus hotspots in a...
Cisco Acquiring Fluidmesh on Apr 09, 2020
Cisco announced it is acquiring niche wireless manufacturer Fluidmesh. Both Cisco and Fluidmesh have been offering video surveillance solutions...
Junk Debt Laden Convergint Facing Coronavirus Crisis on Apr 09, 2020
Convergint has $1+ billion in junk debt putting significant pressure on the company. While the rapid debt buildup enabled the company to go on an...
Embedded Logix Thermal Temperature Detection System Examined on Apr 08, 2020
Embedded Logix has been producing thermal temperature measurement systems for industry and fire detection for over 10 years. Now, they are entering...
Micron 1 TB SD Cards Aim To Eliminate NVRs on Apr 08, 2020
Micron has boldly proclaimed their latest 1TB microSD "eliminates the need for network video recorders", targeting the growing market of...
US DoD Declares "Can No Longer Do Business" With Contractors Using Dahua, Hikvision, Huawei on Apr 08, 2020
The US Department of Defense has confirmed to IPVM that they fully support and intend to proceed with the NDAA 'blacklist clause' covering Dahua,...
IPVM's 12th Anniversary - Thank You! on Apr 07, 2020
IPVM is proud to celebrate it's 12 anniversary expanding our commitment to providing the industry independent and objective information on video...
Mobotix Thermal Body Temperature Detection Examined on Apr 07, 2020
Mobotix has jumped into the Coronavirus temperature detection market, but how do they compare to thermal incumbents like FLIR or ICI who have been...