Suffering Criticism, Hikvision Keeps Insecure Online Service Up [Now Down]

Author: John Honovich, Published on Jan 03, 2017

Hikvision suffered severe criticisms for its abrupt plan to discontinue its Hikvision Online service, with 3 core functions to be removed on Dec 30th.

However, all of those functionalities continue to run in 2017, including the security vulnerabilities, and Hikvision has no explanation of what will happen next.

Update January 5th, Hik-online.com is now shut down. The site is up and one can login but when doing so, it just displays the discontinuation notice with no other options - e.g., no ability to manage devices or check status. In addition, new devices cannot be added, despite the notice saying that this could be done through February 16th.

********* ******** ****** ********** *** ********* **** ** ************** ********* ****** *******, **** * **** ********* ** ** removed ** *** ****.

*******, *** ** ***** *************** ******** ** *** ** ****, including *** ******** ***************, *** ********* *** ** *********** ** what **** ****** ****.

****** ******* ***, ***-******.*** ** *** **** ****. *** **** is ** *** *** *** ***** *** **** ***** **, it **** ******** *** *************** ****** **** ** ***** ******* - *.*., ** ******* ** ****** ******* ** ***** ******. In ********, *** ******* ****** ** *****,********** ****** ****** **** **** ***** ** **** ******* ******** 16th.

[***************]

Dec **** ***

*** **** *** ******** ** ** *** *** *** *** user ************, *** ****** ****** *** ********** ************. **** ** the *********** **** ********* *****:

*** ******* *** **** ********* ***:

******, **** ** ***** ******* ******** ** ** *********, ** is, ** *********'* *****.

Running *****

*** *** ************ ********* ** **** *** **** ****** **, device ****** *** ********** ******* ****** ** ***** *****:

No ***********

********* *** *** ******** *** ****** *********** *** ******** ** IPVM's *******. ******, **** ******* ** ** *** *******, *** interstitial ********* ** *** *** **** ** *** **** ** end ***** * *********, *** **** *********** ******* *** **** to ***** ****** *********.

Fix *** ******** ***************

** ********* ******* ** ******* ***** ******** **** *** **** Hik ****** ***** **********, **** ** ************** ***** *** *********** and ********** ********** **** **** *****.

*******, ** ********* ** ******* ***** ***** ***** ******** ********* claims *** **** ** ****** ********** ******* **** ***** **** track ******, *** ******** *************** ** ********* ****** **** ** fixed.

*** *******, *** ****** **** *** ******* ***** ** ***. Ironically, ***** *** *** ******** **** *** **** ***** **** their **** ******* *** **** ***** ** ******* ***** **** called ** ***. *********, ******* ***** ****-********** *,*** '*********' *** not **** **** **** ***'* *********.

********, *** ****** ***** ******* **** ** *********** **** (***** ******** ****) ***** *** ****** ** ******* ** ***** ****** ********* to *** ******* *** ****** ** ********** ** ********* ****** the *********** *** ********* **** ******, ********** *** *********** ***** devices **** ** ****** ** ******.

Communication ******** ********

**** ** *** ***** ** * ****** ** ************* ******.

  • *****, ********* ***** ***** * ****** ** *************** **** ******* in. ** *** * **** ***** **** ********* *** ********* it, *** **** ********* ******* *** ********* *** ***********.
  • ******, ********* *** ******* **** **** *** ****-**** *** ***** discontinued *** ** *** *** ***** * **** ***** **** Hikvision ********** ******** **** **** ***** ***
  • ***, ********* ****** ******* ** **, ******** ** *********'* ***** notice, **** ********* ***** **** ***** ****.

***** ********* ***** **** ***** *************** ********, ** ** * week ***** *** ******* ***********. ***** **** **** ** ************ yet ***** *** ******** *************** *******. ** ** ** *********** situation *** ********* ******* ** ********* ********* ** ****** ****** and **** ***** **********.

Comments (15)

In new press releases, Hikvision has given new details on their new Hik-Connect platform. See the North America and Global releases. The releases are mainly the same, but:

  • The USA release is dated today, global is dated December 30th.
  • The USA release informs users that they may continue using their HiDDNS URLs for existing devices, not mentioned in the global release.
  • The USA release links to several how-to guides for creating accounts, adding devices, etc., on iVMS-4200 and iVMS-4500.

Both releases state that the new Hik-Connect app is coming in 4-7 days, awaiting App Store and Play Store approval:

The new Hik-Connect web interface looks like a stripped down EZVIZ device management page:

But there is no actual cloud access, either to settings or live/playback. Instead, clicking on the IP/Port No. opens the device's IP address. Port forwarding is still required.

You can push UPnP/port settings to the device via settings, but this is the only configuration available.

We'll take a look at things again when the mobile app is released.

With all my due respect,

How many years it took IPVM to have "S" at the end of http?

5-7?

We have had HTTPS support for login / billing / payment for many many years, since January 2009.

We added HTTPS for the rest of the site, e.g., reading articles, in 2016.

Hikvision still does not have HTTPS for anything on Hik Online, including logging in and managing device information for dealers / customers.

They don't take credit cards like you do :)

They have a master database of hundreds of thousands or millions of devices that can easily be scraped / downloaded because of an ongoing enumeration vulnerability. If you do not mind, that is certainly your prerogative but surely many dealers do not want that exposed.

Was IPVM hacked before or after "S" :)

IPVM was not hacked. There was a leak in 2014. We changed how we handled information after that and there has not been a recurrence.

It took me a couple hours to migrate the systems we had (maybe 20) on this to no-ip, followed by deletion from the hikvision website. This was followed up with new ddns address and instructions to the customers.

This would be a better longterm plan since you can also run the no-ip client on other systems and/or routers/firewalls. Cost is about a buck a year per host from a company whos core offering is secure supported ddns service. Kind of a no brainer.

I tested no-ip and dyndns and chose no-ip because I could assign passwords to groups of hosts (using random password generator). With dyndns, you could assign a long code-key but Hikvision would not accept this many characters in the password field.

To me, this is common sense to make this switch. Just make sure you have a group allocation and system naming scheme before you do this. I used a password generator with all characters 8 in length. (username is "group":"siteusername").

I find it hard to believe that there is such commotion over a service offered for convenience (which no other vendors offered), but should have said "use at your own risk". Now that I look back at it, it was pure laziness on our part not to use a reputable ddns source, especially with all the other systems and firewalls we have deployed (you should be using it on the router/firewall, anyway).

Hi

Isn't that what a corporation should do? Listen to its customers and react in kind? They made a decision based on the data available. Data proved to be wrong. Reverse course. That we are so much talking about this means that this is a company to take even more seriously. Not only are they listening, they have the wherewithal to act swiftly upon our desires and perhaps needs. They should be commanded.

Now frankly, we have always made sure of disabling this "feature" and still do heavy firewalling on corporate networks. For the most part we block everything except what's necessary for video recording, camera management and other associated data.

This is somewhat similar to the path taken by Microsoft which for the longest time weren't listening... They are now making great products based on customer feedback (read criticism).. OTOH Apple is moving in a different direction...They removed the so-basic earphone jack from the iPhone and changed not much inthe Macbook except to add a RIDICULOUS touch bar . Meanwhile Micro$oft cannot keep up with the demand for the Ultimate Laptop:The Surface which is not a laptop but a tablet .... or is it a laptop :) Sorry to be OT

if anything this will add to Hikvision bottom-line and sales.

Not only are they listening, they have the wherewithal to act swiftly upon our desires and perhaps needs. They should be commanded.

Presuming they intend to keep it long term. But there is still no clarity.

I will definitely agree with you if they keep it and fix the security vulnerabilities and announce it publicly. Otherwise, it is just not clear what they are doing.

if anything this will add to Hikvision bottom-line and sales.

Mitigating this problem will definitely help reduce lost sales. However, the whole episode, starting with the move on Dec 8/9th, is definitely a negative to bottom-line and sales.

I do agree that if they can resolve it well over the next month or two, it will repair things over time but I do not believe that this will ever be a net benefit to Hikvision (or any company that goes through an episode like this).

John

Again this is what leaders face everyday. Microsoft is the most hacked OS because it is the overwhelming leader.. Hik is criticized for good reasons among these that they're the leader in the industry by a very large margin. The vulnerabilities are real but so are those from many of their competitors Axis especially another leader which faces less scrutiny at this point.

The entire field of IP-based surveillance and security systems needs to take a deep breath and consider cybersecurity as part of what we do. Not a separate field to be handled-off casually to another party. We are whether we admit it or not responsible for the well being and correct behavior of the systems we put in place. While this creates a new level of responsibility and complexity it also will drive more revenues. The Internet Of Things is upon us. This new road will bring new threats. For us Integrator in IP Surveillance it is both an opportunity and a threat. I personally tend to see it as a much needed opportunity when prices of hardware is falling so precipitously. Hik is one small driver in this: The real culprit is Moore's Law. Silicon has been growing cheaper and better by the nanosecond... It wasn't 3 years ago that a 1080p was the TOL now 4 MP are <$200 with WDR....

Axis especially another leader which faces less scrutiny at this point.

I know you are aware of this but I want to emphasize that we were the only ones to cover the Axis critical security vulnerability and we covered it repeatedly, including tests, e.g.: Axis Critical Security Vulnerability, Axis Camera Hack Tested, Axis Exploit Allows Changing Camera Root Password Confirmed, etc.

Things that I believe helped Axis:

  • Timing, it happened at the beginning of summer, when many people were on vacation
  • The difficulty of the vulnerability - it was very hard to find and took some skill / effort to exploit
  • Axis strong historical reputation

The other factor is Hikvision's government ownership. Certainly we played a major role in scrutinizing this but we did similarly with the Axis vulnerability. Some things catch on and some do not, depending on what integrator overall concerns and experiences are.

Update January 5th, Hik-online.com is now shut down. The site is up and one can login but when doing so, it just displays the discontinuation notice with no other options - e.g., no ability to manage devices or check status. In addition, new devices cannot be added, despite the notice saying that this could be done through February 16th.

We confirmed with Hikvision technical support that they will help with retrieving device lists if you contact them with your credentials: URL / username / password.

They also recommended using 3rd party services listed on the DNS tab: noip, peanuthull, or dyndns.

I guess the ADI flyer is now incorrect - as they do not have a free DDNS service included...

Login to read this IPVM report.
Why do I need to log in?
IPVM conducts unique testing and research funded by member's payments enabling us to offer the most independent, accurate and in-depth information.

Related Reports

Winter 2019 IP Networking Course on Jan 10, 2019
Today is the last day to register for the Winter 2019 IP Networking course. This is the only networking course designed specifically for video...
Bosch VDOO 2018 Vulnerability on Dec 20, 2018
Security research firm VDOO has discovered a critical vulnerability in Bosch IP cameras. Inside, we cover the available details of this new...
Genetec UL Cybersecurity Certificate (2900-2-3) Examined on Dec 19, 2018
Proving a company is cybersecure has become a major concern for security companies. But how trustworthy are these certificates? Earlier in 2018, a...
Scam Research And The $86 Billion IP Camera Market on Dec 19, 2018
Scam. The most widely cited research numbers in many, if not most, industries come from a growing number of Indian 'market research firms'. We...
No GDPR Penalties For UK Swann 'Spying Hack' on Nov 20, 2018
The UK’s data protection agency has closed its investigation into Infinova-owned Swann Security UK, the ICO confirmed to IPVM, deciding to take “no...
Axis: "No One Wants To Buy A Camera" on Nov 09, 2018
Axis has, in its own description, made a bold declaration: The industry is changing so rapidly that the following statement might seem bold but...
HID: Stop Selling Cracked 125 kHz Credentials on Nov 05, 2018
HID should stop selling cracked 125 kHz access control credentials, that have been long cracked and can easily be copied by cheap cloners sold on...
"New Zealand Govt Uses Chinese Cameras Banned In US", Considers Security Audit on Oct 12, 2018
Newsroom NZ has issued a report: "NZ Govt uses Chinese cameras banned in US": This comes after the US federal government banned purchases of...
China Hacks Video Servers Causing Uproar on Oct 05, 2018
An incident causing an international uproar is hitting home in the video surveillance industry as a Bloomberg report, "The Big Hack: How China...
Genetec Takes Aim At 'Untrustworthy' 'Foreign Government-Owned Vendors' on Sep 24, 2018
Genetec is taking aim at 'untrustworthy' 'foreign government-owned vendors'. This is not a new theme for Genetec as nearly 2 years ago, Genetec...

Most Recent Industry Reports

Testing Bandwidth vs. Frame Rate on Jan 23, 2019
Selecting frame rate has a major impact on surveillance bandwidth and storage consumption. But with smart codecs now common and cameras more...
Camera Course January 2019 on Jan 23, 2019
This is the only independent surveillance camera course, based on in-depth product and technology testing. Lots of manufacturer training exists...
Bosch Favorability Results 2019 on Jan 23, 2019
Bosch's favorability moderately strengthed, in new IPVM integrator statistics over their results from 2017, with 2019 results showing strong net...
Intersec 2019 Show Report on Jan 23, 2019
The 2019 Intersec show, held annually in Dubai, is now complete. IPVM attended for 3 days, interviewing numerous Chinese and Western video...
2019 Camera Book Released on Jan 22, 2019
This is the best, most comprehensive security camera training in the world, based on our unprecedented testing. Now, all IPVM PRO Members can get...
Milesight Company Profile on Jan 22, 2019
Milesight Technology, a Chinese company building an International branded business, says they are slowly building their presence through a series...
Cable Trenching for Surveillance on Jan 21, 2019
Trenching cable for surveillance is surprisingly complex. While using shovels, picks, and hoes is not advanced technology, the proper planning,...
Milestone Favorability Results 2019 on Jan 21, 2019
Milestone's favorability moderately strengthed, in new IPVM integrator statistics over their results from 2016. While the industry has been...
The IP Camera Lock-In Trend: Meraki and Verkada on Jan 18, 2019
Open systems and interoperability have become core features of video surveillance systems, as virtually all professional IP cameras integrate with...
NYPD Refutes False SCMP Hikvision Story on Jan 18, 2019
The NYPD has refuted the SCMP Hikvision story, the Voice of America has reported. On January 11, 2018, the SCMP alleged that the NYPD was using...

The world's leading video surveillance information source, IPVM provides the best reporting, testing and training for 10,000+ members globally. Dedicated to independent and objective information, we uniquely refuse any and all advertisements, sponsorship and consulting from manufacturers.

About | FAQ | Contact