Suffering Criticism, Hikvision Keeps Insecure Online Service Up [Now Down]
By: John Honovich, Published on Jan 03, 2017
Login to read this IPVM report.
Why do I need to log in?
IPVM conducts unique testing and research funded by member's payments enabling us to offer the most independent, accurate and in-depth information.
Related Reports
Verint Victimized By Ransomware
on Apr 18, 2019
Verint, which is best known in the physical security industry for video surveillance but has built a sizeable cybersecurity business as well, was...
Security Fail: ASISNYC Auto Emails Passwords In Plain Text
on May 14, 2019
ASIS NYC automatically emails a user with the password the user just entered, in plain text, when one registers for the site / event, as the...
Honeywell Speaks On NDAA Ban, New Non-Banned Cameras and Cybersecurity
on Aug 06, 2019
For years, Honeywell has depended on Dahua, a company with a poor cybersecurity track record and now banned by the US NDAA, for the development and...
Dahua Wiretapping Vulnerability
on Aug 02, 2019
IPVM has validated, with testing, and from Dahua, that many Dahua cameras have a wiretapping vulnerability. Even if the camera's audio has been...
Hikvision OEM Directory
on Aug 13, 2019
The Chinese government-owned and US-government banned Hikvision has become the world's largest video surveillance manufacturer and generally hidden...
Dahua OEM Directory
on Aug 16, 2019
US Government banned Dahua OEMs for dozens of companies. The following directory includes 40+ of those companies with a graphic and links to...
Uniview OEM Directory
on Sep 11, 2019
This directory lists 20+ companies that OEM products from Uniview, with a graphic and links to company websites below.
It does not cover all...
Warning: Windows 7 Update Crashing NVRs
on Aug 26, 2019
Windows 7 updates are causing VMS servers to fail to boot.
After running the update, impacted systems do not boot as normal, instead display this...
3 Weeks Later, Honeywell Still Cannot Say Whether They Are Vulnerable To Dahua Wiretapping [Now Admits]
on Aug 27, 2019
The Dahua wiretapping vulnerability and Dahua's decision to delay disclosing it until IPVM inquired underscored problems with cybersecurity and...
Dahua New Critical Vulnerability 2019
on Sep 23, 2019
Dahua has quietly admitted 5 new vulnerabilities including 1 critical vulnerability with a 9.8 / 10.0 CVSS score and 2 high vulnerabilities (scored...
Most Recent Industry Reports
Breaking Into A Facility Using Canned Air Tested
on Jan 28, 2020
Access control is supposed to make doors more secure, but a $5 can of compressed air may defeat it.
With no special training, intruders can...
ROG Security - Cloud AI For Remote Monitoring
on Jan 28, 2020
ROG Security is offering cloud-based AI analytics to remote guard companies, by touting having "nothing to install" to "add virtual guards."
We...
Brivo Business Profile 2020
on Jan 27, 2020
Brivo has been doing cloud access for more than 20 years. Is the 2020s the decade that cloud access becomes the norm?
CEO Steve Van Till recently...
Favorite VMS / NVR Manufacturers 2020
on Jan 27, 2020
In 2018, a new winner emerged and a former top choice declined. Now, there is a new #1, a new top 5 finisher and 2 major VMSes in decline.
Our...
"Hikvision Football Arena" Lithuania Causes Controversy
on Jan 24, 2020
Controversy has arisen in Lithuania over Hikvision becoming a soccer team's top sponsor and gaining naming rights to their arena, with one local MP...
Axis and Genetec Drop IFSEC 2020
on Jan 23, 2020
Two of the best-known video surveillance manufacturers are dropping IFSEC International 2020, joining Milestone who dropped IFSEC in 2019.
The...
Multipoint Door Lock Tutorial
on Jan 23, 2020
Despite widespread use, locked doors are notoriously weak at stopping entry, and thousands can be misspent on locks that leave doors quite...
Avigilon Shifts Cloud Strategy - Merges Blue and ACC
on Jan 23, 2020
Avigilon is shifting its cloud strategy, phasing out its Blue web-managed surveillance platform as a stand-alone brand and merging it with its ACC...
Verkada Paying $100 For Referrals Just To Demo
on Jan 22, 2020
Some companies pay for referrals when the referral becomes a customer. Verkada is taking it to the next level - paying $100 referrals fees simply...
Camera Analytics Shootout 2020 - Avigilon, Axis, Bosch, Dahua, Hanwha, Hikvision, Uniview, Vivotek
on Jan 22, 2020
Analytics are hot again, thanks to a slew of AI-powered cameras, but whose analytics really work? And how do these new smart cameras compare to top...
Comments (15)
Ethan Ace
In new press releases, Hikvision has given new details on their new Hik-Connect platform. See the North America and Global releases. The releases are mainly the same, but:
Both releases state that the new Hik-Connect app is coming in 4-7 days, awaiting App Store and Play Store approval:
The new Hik-Connect web interface looks like a stripped down EZVIZ device management page:
But there is no actual cloud access, either to settings or live/playback. Instead, clicking on the IP/Port No. opens the device's IP address. Port forwarding is still required.
You can push UPnP/port settings to the device via settings, but this is the only configuration available.
We'll take a look at things again when the mobile app is released.
Create New Topic
Undisclosed #1
With all my due respect,
How many years it took IPVM to have "S" at the end of http?
5-7?
Create New Topic
Jeffrey Hinckley
It took me a couple hours to migrate the systems we had (maybe 20) on this to no-ip, followed by deletion from the hikvision website. This was followed up with new ddns address and instructions to the customers.
This would be a better longterm plan since you can also run the no-ip client on other systems and/or routers/firewalls. Cost is about a buck a year per host from a company whos core offering is secure supported ddns service. Kind of a no brainer.
I tested no-ip and dyndns and chose no-ip because I could assign passwords to groups of hosts (using random password generator). With dyndns, you could assign a long code-key but Hikvision would not accept this many characters in the password field.
To me, this is common sense to make this switch. Just make sure you have a group allocation and system naming scheme before you do this. I used a password generator with all characters 8 in length. (username is "group":"siteusername").
I find it hard to believe that there is such commotion over a service offered for convenience (which no other vendors offered), but should have said "use at your own risk". Now that I look back at it, it was pure laziness on our part not to use a reputable ddns source, especially with all the other systems and firewalls we have deployed (you should be using it on the router/firewall, anyway).
Create New Topic
Undisclosed Integrator #2
Hi
Isn't that what a corporation should do? Listen to its customers and react in kind? They made a decision based on the data available. Data proved to be wrong. Reverse course. That we are so much talking about this means that this is a company to take even more seriously. Not only are they listening, they have the wherewithal to act swiftly upon our desires and perhaps needs. They should be commanded.
Now frankly, we have always made sure of disabling this "feature" and still do heavy firewalling on corporate networks. For the most part we block everything except what's necessary for video recording, camera management and other associated data.
This is somewhat similar to the path taken by Microsoft which for the longest time weren't listening... They are now making great products based on customer feedback (read criticism).. OTOH Apple is moving in a different direction...They removed the so-basic earphone jack from the iPhone and changed not much inthe Macbook except to add a RIDICULOUS touch bar . Meanwhile Micro$oft cannot keep up with the demand for the Ultimate Laptop:The Surface which is not a laptop but a tablet .... or is it a laptop :) Sorry to be OT
if anything this will add to Hikvision bottom-line and sales.
Create New Topic
Undisclosed Integrator #2
John
Again this is what leaders face everyday. Microsoft is the most hacked OS because it is the overwhelming leader.. Hik is criticized for good reasons among these that they're the leader in the industry by a very large margin. The vulnerabilities are real but so are those from many of their competitors Axis especially another leader which faces less scrutiny at this point.
The entire field of IP-based surveillance and security systems needs to take a deep breath and consider cybersecurity as part of what we do. Not a separate field to be handled-off casually to another party. We are whether we admit it or not responsible for the well being and correct behavior of the systems we put in place. While this creates a new level of responsibility and complexity it also will drive more revenues. The Internet Of Things is upon us. This new road will bring new threats. For us Integrator in IP Surveillance it is both an opportunity and a threat. I personally tend to see it as a much needed opportunity when prices of hardware is falling so precipitously. Hik is one small driver in this: The real culprit is Moore's Law. Silicon has been growing cheaper and better by the nanosecond... It wasn't 3 years ago that a 1080p was the TOL now 4 MP are <$200 with WDR....
Create New Topic
John Honovich
Update January 5th, Hik-online.com is now shut down. The site is up and one can login but when doing so, it just displays the discontinuation notice with no other options - e.g., no ability to manage devices or check status. In addition, new devices cannot be added, despite the notice saying that this could be done through February 16th.
Create New Topic
John Scanlan
We confirmed with Hikvision technical support that they will help with retrieving device lists if you contact them with your credentials: URL / username / password.
They also recommended using 3rd party services listed on the DNS tab: noip, peanuthull, or dyndns.
Create New Topic
Undisclosed Manufacturer #3
I guess the ADI flyer is now incorrect - as they do not have a free DDNS service included...
Create New Topic