Hikvision New Security Vulnerability

Author: IPVM Team, Published on Mar 12, 2017

Hikvision has disclosed a new security vulnerability that affects 200+ of their IP cameras over the past few years.

In this note, we examine the vulnerability, share results of the new firmware's changes and its potential impact.

********* *** ********* * *** ******** ************* **** ******* ***+ of ***** ** ******* **** *** **** *** *****.

** **** ****, ** ******* *** *************, ***** ******* ** the *** ********'* ******* *** *** ********* ******.

[***************]

Vulnerability ********

*********'* ***** *************-********** ************* **************:

**** * ******** ******* **** ** **** ** ****** *** IP ******* **** ********** ******** ******** ********, ** *** ***** attackers ** ****** ** ************ ********* ********** **** ********* ** acquire ** ****** **** *** ****** ***********.

200+ ******** ********

**** *** ** ******* *** ********, **** ******** **** *.* firmware ***** ******* ******** ** ****. ***** ** *** **** from *** ******:

***** *** ****** ********, ** *** **** ** ********, ** these ******* ******** ****** *** ***** ** ** ****** **** of *********'* ** *******.

What **** '********* **********' ****?

**** ** ******* ** **** ***** ** * '********* **********' ** *********. *** *******, ** * ****** ** ****'* 'privilege' ** '*********' ** *****, **** ** ********** ********, ***** it ***** ******* ******* ****** **** ***********. *******, ** ** anonymous *************** ****** ***** ** '*********' ** *****, **** ***** be ********* ******* ** **** ****** *** ***** ****** *** camera ***** **** ******* ** **. ********* *** ******** ******* on *** '********* **********' *****.

Firmware ******* ******* - ****** *******

*** *** ******** (*.*.*) *** **** ******* **** ************* *** it **** ******** ******* ******, *********'* **** *******. *** ********* below ***** *** ** ******** ********* ****** ** ****** ****** for ******:

** *** ***** ***** *** **** ***** ******, **** **** to ****** ******* ********** ** ** ** *** ******** **** vulnerability.

Grey ****** ******* ******

* *********** ****** ** ********* ******* *** ****** ** *************, *** ****** ** ********, ****** *********** ****. **** ** due ** *** **** *** ******* ** ***** ******* ***** disable *** ******** ******* ******** ** *** ******, ** ********* the ******** ** ****** ** '*****' ****, ** *********** ***** them ** ****** ** * ******* ******** **.

No ***** ** '********' *****

***** ** ** ***** ** *** '********' ***** **** *** first******** ** *********** ***** *** *** ************ ** ***** ** ********** ***** ****. *** ******** ** '***********', *** ********* ** the********* ******** *********. ******** ****"***** ** * ******** ** **** ******* ********* ******** **** makes ** ******** ** **** **** ***** ****** ** *** device" *** **** "****** ******** ******** ***** ********** **** ********* *** ****** ** admin."** ****** **** *** ******** ** ******** ** ********* *** fixed ** **** ******** *******. *******, ** *** ******** ** proof ** **** ********. ** ** **** **** *******, ** will ****** *** ******.

UPDATE: ***** ** ******** **** **********

********* ***************** ** ************ **** ********** ** ****** ****** *** ********* ** ******* in *** **** *** *****:

*********Limited *************

********* **** ** ***** ** ******* ******* **** **** *** no ****** ************, ****** ***** *** ***** ************* **** ** have ****.

******

** **, **** ** ****** ** **** * ******** ****** on ***** *** *** ******* ********* ***** ***** ********.

*******, ** *** '******** ******* ****' ******* ***** ** ******* *** *** '********* escalation' ** ***********, ** ***** ****** ** ***** ***** ******* being ******.

Comments (58)

** **** * "*******" ** *** **** ** **** *** have (******) ****** ******** **********?

** *** *** ********* ** ************ ********* ******* ******* ************/****, **** ** **** *********.

********* **** **** ****** *** ***** ****, ** * ******** notification **** ***** ***** *** ****** ***** *** **** ******* hacked.

**** ************* ** ******* ** ***** ** ******* (***** *** no ******* *** ** **** ********* ***/*** *****, *** ******* better ******* **** ********* ***** ***** ****** ** ******* ***** out). ****, **** ***** ** **** ****** ** *** ********* escalation ************* ** *********** ** ** ********* ****.

** *****, **** ** * *** *********.

* ** **** ******* ** ******** **** *** ******** ** HQ ***** **** **** ****.

***** **. * **** * ******* ***** *** **** **** a *** ********* ******* ***** ******** **** ******* *********. ******* charging **** ** ******* ** * ********* ****** **** *** equal * ******** ********** ** *** ********* *******.

**** ** ****, ********* *** ******* *** *** ****** ***********. Genetec ** ****** ******** * *** ** ***** ********** ******* costs ********** ** ********* ******* *** ********* * ******* *** the ********** ** ********* ***************.

*** ***** * **** ** **** **** '*******' *** '*****' regarding ******** ********* *** *********** **********?

* ******* ***** *******'* **********(*) ** **** **** *** **** found. ******* ** *** ***** ****.

***'** ** ******* *** * **** ****. ******* *** ******* on *********, *** *** ***********.

* ***** ******* *** ***** ***** **** **** ***** *** D.C. ******* *******.

*** -

*** **** ** *** *** *** ****** ** ****:******* ******** ** ********** ** *** ****?

** ***** **** *** ******* *** *** *** *********, *** the **** ****** ***** *** * ******* *******. *** *** was ***** ******* **********, ** ***** *** ***** ***** **** Genetec ****** **** ******** ****** ******** *** *** ******* ****, but ***** ******** ******** **** *** ****** ** ** *** entry *****.

**** **** ****** ********* *******, **** *** *********** **** **** chosen ** *******, ***** **** **** **** * ************* ***** that ********* ** ******** *********** ***.

** ********* ****** ** *****, ******* ****** ** *******. **** is ***** ********** *******.

** ***** *** **** ******* *****'* ******* *** *********, ** any ********, ** *****, ***** ***** ********, *** ***** ******, complex *********.

** ******* ** ** * **** *** ** *** ******* fanboys ******* *** ********* ******** **** ***** *** ******* ** quite ******** *** ***** *** ** *** ******** *** ***** imagine.

* *****. *** **** ** ***** ***** ******* * ******** is *******. * **** **** ******* ******, *** * **** product, **** ***** ******* ** *** **** ** ***** ***** to ******** *********. *** *** ****** ******** *** **** ******** details *** **** **** ********** ****?

*** -

***** ** ** ********* *********** ******* *** *** ******* *****/**********.

** *** **** ** *******'* *** *********, *** **** ** more **** * ***-****** ******. ***, ******* ***** **, *** ships ** **** * ******* ******* *************, *** *** ****/********* has **** *********** *** ******* ** ******* ****** **** ******* passwords, ******* **** **** *** **** *********, ***.

** *** **** ** *********'* *******, *** ****/********* *** ** access ** *** ********** ******** ** ******** ********. ** *** can *** **** *********** ******** *************, ***** ** * **** **** ********* ** ** ***** some ********* ******** (** ** ******** ** *** ******** ******, but ** **** *** **** ** ** ** ***** ** this ***). ***** *** **** ********, **** ***, ******* **** the ****/********* *** ** ******* ****. ********* ********** ***** *** relatively ******* ******* **** **** *** *** ** ** ****** the ******, *** ** **** ****** ******* ******* **** *** not **** ******* ***** **** **** ** *** ******* ** vulnerable, ***** ******** ***** **** ********* *** ********* ***/** ************ other ***** ** *** ****** ******* *** ********.

**** ** '*** ** *** ***' ***********, ******* *** ** or ******* *********, ********* *** ** ******* **** ** **** likely ****** ** ****** ********* ** ****** *********.

************, ******* *** ***** *************** **** ** ******** ***** **** likely ********* *** *** ********. ********* ****** *** ** *** a ****** ********, *** ***** ****** * **** **** **** attackers *** *** ** ******* *** ******.

****** **** ******* - **** ***'* **** **** ********* ******* applied ** *** ****** ************* *******?

****** * ********* *****'* ********* **** ***, * **** ***** encountered * *** **** *****'* **** * ***** ** *** the ***** *******.

***** ***** **** - ** ***** **********... :)

***** *** ********, *** ***. ********* **** ******* *********** ** default. ******* *** **** *** *****. * ***** **/** **** for * ******** ****** *******, ** * ******** *********.

*** *** ******, ******, *'* ***** **** *****' ********** ** why ******** ********* *** **** ** * ************* **** ** level ******.

* ***** *** ******* ** *********** - ** * ***** as ****.

*** **** ***** *** *** ***** ***'* ** *** ******?

** **** **** * ******** ******* ********** **** *** ****** Administrator *******?

...** ** ****,***?

*****-

*** ****** '**** ****** *******'...* ****** ***** ******* *** ***% definitively *********?

** ** ******** ***** *** *** **** ******* ****** ** was ******** ***** *****.

***** -

** *** *** * ****** *******, ** *** ********. *** the **** *****, *** ******** ******* ********* ****** *** *** privilege ********** ************* **** ********* ** ***** *** ******* ***** affected * **** ****** ** *******.

** ***** *** '*****' *** '**'* ********' **** ** ** to ********* * ******* ** ***** *** *** **** '********* of *****' ** ** ********** ***. **** *** **** **** documentation ******** **** * ******* ********** * ****** ** ****** that *** ********** ***** *** ******* *** ********?

*** *** ******** ** **** ** ***** ** ** ********** 'honest ******** ********' ** ****** ****** ***** '*****' ** ** issue ** ****** ******** ******** *** *** ***** ** ********* ****.** **** ***** ** *** **** ** ******* ********* ************ ********** **** '*********' **** *** ** ****** ** **** do *** ******** '******* *** **** ***** ******** ******** ******** practices' ***** *** ****. ********* *** ** ******* **** *** Ethernet ******* *** ***** * ******* **. * ******** ***** it ** ******** *** ***** ** ***** ** ****** ** hundreds ** *********, **** ** *** *** ***** *** ******* to *********** ******** * ******** *******.

****** *** ** **** *** **** ****** ** *********'* **** to ****** ** * ******* **** "***** ******" ** ********** anything ***** **** ** ******** ****** ** *** *******. * find ** ********** ** ******** **** *** ***** ************* ** one ***** ** ******* **** *** **** **** **** **** road.

**** ********* **** *** ** *****, ** ****?

**** (***) ******* **** '********' **** *** **** *** **** of **********. ***** ** ** ****** *** **** ****** ***** massive *&* ****** ** ** *************. **'* *** ***** ******* out ***** ******* ** ******* ******* ** *** ** ***** with '*****' ********. **** ****** ***'* **** *** *** ***** they, **** ** *** **'* ********** ***** *** ***'* **** to **** ******...**'* ** ******* ***** ** *****

** #* **** ******** *********** *** *** ******* **** **** would **** *** *** ********** ********* ********* *****-******** ** ** 'low ** * **** ** **********'? **** ***** *** ***** any ******* ***** ********* '**** *** ***** ******* ** *******' that ***** ** '*****'?

"****** **** **** *** *** ***** ****"? *** *** *******? My **** ** ************ ** ** *** *** ** *** page, * ** *** ****** ****** ***********. * ***** *** ever *** **** *** ****** **** **** *** ******* **** as **** ** ********* ** ** ** *** ****** ** the ******** *** **** **** ******** ******** ******** **** ****** or ** ***** *** **** ********* *********** **** *** *********. Who ** ******* ******** *** ** *** *** ** ***** rational?

** ****** ******** ***** ******* **** *** ** ******* ** anything, ******.

**** *** *** ******** ******. *** ** ******* *** ********* to **********, ** ****** *** **** *** ****** **** *** or **** ****. ** **** **** **** **** **** **** better ** **** ** *** ******* ***** *** ***** ******** time ***** ***** ** *******. **'* ***** ** *** **** between *** *** ******** **** **** ***** ********* ** ****** what. **** ********* ***** ******** *** ****** *********, *'* *** sure ***. **'* *** ***** **** ************ *** ******* **** priorities ***** *** *** *** ** ******* ** ***** ***********.

***** *** *** **** ************* *** * *** ****** *** I ** *** * "********" ** ****** ** *** **** makes ********* ******* *********** *** ******. ** '*********' ****** *** be ********** ******** ** * *** **** ****** **** * differing ******* ** *** ******* ** *******. ******* *** ****** consider ****** * ****** *** *********** **** ******** ** *** world **** *** ******* ** ****** ****** ****** *** ********. There *** ***** ******** ** *** ***** **** *** ********** and *********** *** ******* **********. ** *** ***** '**********', **** I ***** *** * ****** **** **** ** **** *** just *** ** ********* * **** ***** ********** ** *********. Dont ** ******** * ** * ** ******* *** ***% believe ** *** ****** *** *** *******, *** ***** *** others, * **** ** **** ****.

**** ** ******** * ** * ** ******* *** ***% believe ** *** ****** *** *** *******

*** ****'* *** *** **** ********* ***** ********** ************ ******* to *** ** ********. *****, *** *** **** ** ******** customers ******* ** *** ********** **** **** ****** ******** ************* to ****?

**** *******, ****** ***** ******* ********* ********* ************ *******. * would ** ********* ** *** ******* **** ******* ********** ************* cameras. * ********** **** ******* *** * ******* *** *** singling *** ********* ** * ****** **** ** ****** ** a ****** ******* ** ***** **** **** ** ******* **** it ** ***. *** *** *** *** ******** *** *** Germans? ** ** ********* ******** **** ********* *** ********** ** those"factories" *** **** ** ****. **** ** **** ***** *** cameras ********, ** ***** **** ** ********** ******* **. ********* products *** **** ** ***** ***** ********** ****** ************* **********, not **** **** **** **** ** *********. ****- ** * have ********* ** ******* ********* ****** ****** ******* *** ******** proof- *** *********- **** ********* *** **** *** *** ******** into *** ****** **** ***** ** **** *** * ******* other **** **** *** ****** ** **** ***? *** *** do ****? *** *** "******" **** *** ***** **** ***** and ** ***** ** ****? ***** ** *** *****? *** have ****** ** *** **** **** **** **** **** ** its *********** **** *********, ************* *******, ******* **** ********? ****** can **** *****, *************** ****** ** ***** ******** ** '**** the ******' *** **** *** ****** **** *** **** **** FACTUAL *********** ** *** ****** **** ?

** ** **** * **** *** ** ***, **** ** done ** ** ****** *** ************ ***. * **** ***** deceived ** ********* ** ******* ****** *** **** *.* ******* that *** ** ** ********* *** ****** ** *******, **** have ************ # * *** #*'* *********, **** ****** # 1, * **** ** *********. * ** ********* **** ** Americans ****** *** **** *** ***** ** ***** * ****** economy *** *** *** ******* **** ******** ** ************* ******* is *** *** **** ***. ***** *** ***** ********* ** this ***** **** *** **** ***** * ****** *** *** can ******* ** ***** ******* ** * *** **** ****** them ** **** ** *** ** ****** ** **** ** consider '***********'. *********** ** ********* ** ****** ******** **** '*****', two ********** ********* ******. **** ** *** ******, ***, **** as * **** ****** ****** "******* ** ******** *** *** way ** *** ****. *** ****** **** *** ******** **** the *******, *** ****** *** *** ******* *** ** * culture ********* **** ****, **** ** ****** **** *** **** them '******' ** **-***********. *** *** *** ********** ** ******* or ******* ****** ******* ******* ********* ****** ******* **** ******* allows *** ********** ** *** '*' ****** ** ***** ********. They **** *** *** **** *** *** *********, ** ****? Their ******* ** *** *** *******, **** *** ** * different *******. *** **** **** ** ****** **** **** *** bad ***? **** **** ******* ********, **** **** **** *** a **** ********** ***** *****.

****, **** ** **** *****, *** **** ***** ***** ** announce ** *** ***, *** ******** *** ******* **** *** differing **** ** *** *** ****** *** *** **** ** honesty *** ** ******* *** ******, ******* *** ********, ******** proof **** ********* ****** *** *** ********** **** * ******, an *** ** * ***** **** **** ** **** *** nefarious ******** *** * **** ** *** ***** *** ***.

****** **.

***** *** *** *** ** ***** ** **** ***** * pass **** *** ******** *** *** ******* *** *** **** nothing ** *** ******* *** *** ********** ***** **** ********* or ******** *******. * **** **** ** ***** ** ***** acknowledges *** ************ ****** ** ***** **** *** ********* ** the ******* ******** *** *** ** *********** ***** ******* **********. Even *** ********** **** ********** *********** ****** *** ***** *** spreading *** ********* **** ** ***'* **** **** ***** *** businesses.

***'* ** *****, **** *** ****** ** *** ***** ********** with ******* *** *********'* ****** *****, ********* ********* ******, *** LITERALLY ***** ********** ******** ********** *** ******* ** *** ***** AND *** ****** ** ***** *** *****! ** ****** ***** through ***'* ******** ********** **** ** **** *** **** ******* in *** ****** ******** **** ***! ***'* *** ****** ******** verified ********* ***** ** **** ****** **** ****** *** ******* against ** *** *** ********** **** ****** (*** **** ********** them ** ********* ** *********** ***** *** ********). **** *** the ******* ******** ***** ************.

***** ** ** ******** ** ******** *** ********** **** *** Chinese ********** *** ***** *********, **** ***** *** ***** **** John ******** *** ***** ** ********* ** ***** **** *********? Hell, ***'* *** ****** *** ****** *** ******** **** **** playing *** **************. **** ***'* ***** ******* ** *** ***** can **** ** ********* ***** **** ****** **** *** ***** be ********* ****. **** ** ***** *** **** **** ** this ** **** ******* **** ************* *** ** ** **** against **, **'** ** *** **** ** **. ** *** global ***** ** ******** *********, *** *** ******* *** ***** win.

** ******** ** **** *********. ** *** **** ** *** condone *** ******* ** *** ***/** ******* ********* ** ******** your ****** *** *** **** ****. ** ******** ******* * dont *** *** ******** ***** ***** ** *** ****** ** worse.

*** ** * *****-***** ******* ***** ********** ********** ** *** party ******** ** * ***-**** ******'* ****** ***** ************* *****-*********, the ***** ** * ******* *******. ***** ** ** *********** between *** *** ** ***** *******, **** ****** ** ****** one ** "******* ** ***" *** *** ** ****** ** worse **** *** ***** ** *** ******* ** * ******** security *****.

*** ** **** *** ******* **** **** ***** ** **** dont ***?

**** ****** ** **** ** * ***** * **** ****** before. ***** ** **** ****** ***** ** *** ******* **********. Do *** *** ***** **** *** ******* ********** *** **** as **** ******* **** ***** ** **** ** *********. **** Dahua **** ** **** ** * ************* "******" ** *********. History ***** ***** **** ****.

***, *** ***** ** ***** **** *** ** ** ******** product *** ** *** ******* **** ********* ** *** **** and ** *** ***** **** ***** **** ***** ** * much ***** *********** **** ******* **** *** **** ****** *****. Whats ***** ** ***** **** *** **** * ***** ************* track ****** ** ********** **** ***** ******.

*** ** **** *** ******* **** **** ***** ** **** dont ***?

****'* ********* *****. ***** ******** ** **** **** *****.

**** *** ************* ** *****, **** *** *** ***********:

  • ********* *** ******* ** *** **********, ***** ***.
  • ********* *********** *********** ** *** **********, ***** ***.
  • ********* ******** ** ********* ***** *********, ***** ***.

* ** ** '***' ** ***** *** * ***** ** is ****** ** *** **** *** ******* **** **** *****. I ** ********* *** *** ** **** ****** * ***** owned ********** ***** **** * ****** *.**% ** ***** *** that's * ******* ******** ** *** * ****** ****** ***** for *********.

** ** ******** *** ******** ** *** ***** ** ******* he *** ** ******** ******** **** ***** ******** * ***** of *********'* ********** ** ************ *********. * **** ********* ***, who **** ***** ** *** *******, (**** ** **** ****** mattered).

**. ****- *** *** ******* *** ******** ******** ******** **** HIKVISION *** ******** ** ******** **** *********** *** *** ********** of *** ******* ****** ** ******** **** *** **** **** for * ******* **-********? ** *** **** **** ********? **** your **** ***** *** **** *** *****. ******, *** **********, human ****** ***** *** *** ***** ******** *** **** ********** ZERO ** ** **** ******* ** ** ********* *** *** IP ***** ********. ********, *** **********, *** *** ****** ******** to ***** *** ***** ** *** **********. *** ********** *** been **** **** ********* *** **** * '**** *** *****' on *** ******** ****** *** ***** ****** **** ** "**-******" Un-substantiated" *** ****, **** ** ** **** ** *** ***** un-fairly ******* *** ********** **** **** **********. *** *** *** not ********* ***** ***** **** *** **** ** * ****** corporation *** *** ********** ********* ** ******? **** **** ******** in *** ******** ******* ** ********** ** **** ** *** Mao **********. **** ******** ** *** ******* ****, *** **** made ***** **** ***** *** **** ****** ** ******** ****** definitive ***** ** *********'* *****. * **** ***** ** *** anyone **** * **** ** ***** ******* ** * ****** I **** *** ********** *** ********* ** **** *********. *** and ****** *** ********** ** ****** ***** ******* **** *** at *** **** ***** *********. "******* *** ***** ***", **** is * *******, ******** *********, ***** ** ** *****, ** owe ***** ****** ** ******** ******* **** ** **** "********' on *** **** ***** *** *** ***** **** *** *** enemy? ***** ***** *** ****** ****** ** ******* ***** *****? How ***** ********* **** ** *** **** ** ***** *** subject ** ******* ********** ** *********. ***** ********* ******* ** the ****** *** **** *** ***, * ** *** ********* the **** **** ** ***** *** * **** ****** * company **** *** *** ********* ********* ***** ******* **** ** intelligence *********. * ** **** **** ******* *** ******** ** he ** * ************ ******* * ***** ************ **** ****** nothing ** ***** ** ** *****, **** ** ** **** it **** *** # *. *** * ******* *** ****** roping *** ** ***** ********** ******** ******* *********, *** *********.

**** ****** ** ***** '*****' *** ***** *** *****, ** was ***** *****.

*****, **** ******** ** ********* ******. **** '**** ** *** historical ********' ** * ******** **** *** **** ***'* *** beyond.

*** *** ******** ** ****** *** ** *** **** ******** that ****** **** **** **** ********** ************ *** **** ** good ** *** **** ** ***** **... *** ******* **** everyone ****'* ******** *** ******* ******* * ********* * *** has *** ******* ** ************ ******* * ***** *** ** at ***** *** ********* ******* *** ***** **** ** ******** or ***.

****: * ** ******* *********** (*'* *******) *** * **** ignore ******** ******* *** **** ** *** ** *** ******* of **** ************.

*****, *** ******* *** ********, ** * **** ******:

*****, *** *** **** ** ******** ********* ******* ** *** disclosing **** **** ****** ******** ************* ** ****?

** *** **** ******* ********** ********:

**** *******, ****** ***** ******* ********* ********* ************ *******. * would ** ********* ** *** ******* **** ******* ********** ************* cameras.

********* ** *** ********** ************ ***** * ********* ***** ************ ***** *** *********. *** ****** *** ********** ************ ** sell ******* *** ****** ********* ****** **** *** ***** (*.*. Government) **********.

** ***** ** ******, ******* ******* ******** ** *** ** government **** * ******* ***** ** *** ******* ********** ****** be ** ******** ***-*******, ***** ** ** ********** ***** ***** the ************ ********* ** *** *** *** *** ******* **********'* overall ***** ****** ** ************ ******* *** ** ********** *** US ************.

**********:* **** ***** ********* ** ***** *** **** ****** *** any *** **** ** **** *** *** **** ***** ******* either *** ** ** *** ******, *** **** ** ***** at *** ****** *** ** ***** ****. * ********** ***** both ********* *** *****.

**** ********:
"****'* ********* *****. ***** ******** ** **** **** *****."

**** ******:
"* ** ********* *** *** ** **** ****** * ***** owned ********** ***** **** * ****** *.**% ** *****"

* **** ********* **** *****, ********* ** "***" **** ***** by ***** **** ***** **. *** **** *** *** **** others *** *********** ***** ** ********** **** *** **** ** accept *** "****** ****". * ***** *** **** **** ** tout **** **** ******* ******** *** *** **** ****** **** Hikvisions. ** *** ****** ****** ** "*** ******* *** *****" then ** * ******* *** ******* *** ******* *********** ******** altogether

*** ******* *** *** ** ** ******* **** ** ** analogies:

- ** *** **** * **** **** *** ***** (***** Govt), ** ****** *** ***** *** **** **, *** *** the ********* **** ******* ** ****** *** *****.
(**** ****** ** ***** **** ** *** ******* **** ****** Dahua ** ******** ***** ******* ** ******, **** ***** **** to ** **.)

-* ****. *** *** ***** * ***** ** ***** ****** lies, **** **** ***** **** *********, ****** **** ******* ***** but ****** **** ***** *************. ***** **** *** ***********, ***** feels *** ***** **. *** ***** *** ******* ******* *******, never **** *** ***********, ***** ***** *** ***** **. **** both *** *** ***, ***** **** **** ***** ** ****?
(*** ******* * ****, *** ** ***** ** **** **** if *** ****** ******* **** ***** ** *** ***** ** any ****, *** *** *** ******* **** **** ***** *** less "***" ** ***** ******** **** * ******* **** *** a ***** ********** ** ********* ******** ** * ******* **** is ***** ** * ****** **********. ***** ***** ** ***** owned. *.*., **** *** **** ** ******* ** ***** * point, **** *** *** ******** ** **. *.*.*., ** **** not ****** ****** ** ***** ** **** *** ****** **** any *** ******* ******!

- ***** *** ** ******** **** *** ******* **** *** 1.84% ***** ** * ***** *** ***** ***** ********** *****? Same ******** ** ****.

- ***** *** ** ******** **** *** **** *** * fact *** ***** **** **** *** *****? **** ******** ** Isis.

*** ** ****** **, * ***** *** ***** **** ******* touts *** ***** ******* **** ******* **** **** ** ********* is *** ***** **** ******* ******* **** *******. ** ** were ** *** **** *****, **** *** ***** ***** ***** commission *** ** ***** ********* ** *** ***** ******** ******* us, ******* **** **** ***** ***** ** ***. *** *** like *** ******* ******* ** ***** ** *** "**" ** the ******* **********.

***** ****** ** ***** ** ** *****. ** *** ****** think ***** ** *** ***** ** *********** ****** ** ********, then *** ******* *** ******* *** ******* **** *******-**** ********?

***** **** *** ***** ***********. *'* ** ****-******, *** * still ***'* ** ****** ****** **** ************ **, ** *** core **********, *** ********** ** ********** **** ***** ** ***** I **** *** ********** ** ****** ********. **** ****** *********** they *** ****** *** **** ********* ***, *** ******* ** different ** ****** ** *** ******* **. *** *** ** God. ***** ******* *** ********* **** ********* ********* ******* ******** the ***** **** **** ** *** *****, ************ ** ******** by ****** *** ** *** **** ********* ******* ** **** as *****' ******* ******.

***** ** * **** ********** ******* ***** **** ** * what ** ** ******* ******* ********** ****** ** ******* ** by * ******* ******** **** **** **** *% ********* ** that **********. **** ** ** ******** ** *** **** **** Dahua **** *** ********* * ********* ***** ******* *** *** majority ** *** ******* ****, ****** *********. ****, ***** ***'* even **** **** ******* ** *** ********* ***** *** ** the ***** ***** **'* **** ** **** ****** ****** ** its ***** ***** ***.

* **** ********* **** *****, ********* ** "***" **** ***** by ***** **** ***** **.

****, ***'** ************* ************** ** *****. ** ** *** ***** the '******' ** ********* ** ***.

** ** ***** *** **** ** ********* (*********'*********************** ** *** ******* **********, ***** ** ***), *** ***** of ********* ********** (*********'********* ** * ******* ********** ********, ***** ***), *** *** ****** ** *** ******* (********* was ******* ******** **** *** **********, ***** *** ***).

** *** ********* ******** ** *** ************ ** *** ******* of ****** *** ****** ******* **** ******** ***** *** *****.

"** ** ***** *** **** ** *********"

* ***** **** **** ***** ***** *** "****" ** *********, your *****, *** ***** *** *****, *** **** ***** "********** the ****** ****".

"***** ** * **** ********** ******* ***** **** ** * what ** ** ******* ******* ********** ****** ** ******* ** by * ******* ******** **** **** **** *% ********* ** that **********."

* *****, *** *** *** **** "********** *** ****** ****."

*** *** ********* ******, "* ** *** **** **** ***% ownership *** ** ********* **** **** ******** ****** **** *%"

** *** **** ***** **, **** * ***** ***** ***** I ************ ************** ********.

*** *** ********* ******, "* ** *** **** **** ***% ownership *** ** ********* **** **** ******** ****** **** *%"

*% '*********' **************. ** ** * ******* **********. * *% ***** *** no ***** ** ******* **** * *******.

** *** ****** ********** *** ********** ******* * '*********** ***********' and * *% ***********, **** *** ************* ** *** ********** investing *** ********* **********.

"*% '*********' **************. ** ** * ******* **********. * *% ***** *** no ***** ** ******* **** * *******."

*** *** ******** ****** **** ******* ********** *** ******** **** to **** **** ********* **? *** ****** *** ***** *** just ********* *** ** *********.

*** ** ****** **, ** *** ******* **** ******* ***** to ******** * ***** ******* ****** ** *** ***, ** you ****** ***** **** *** ***** ** *** "**"

* **** ***** **. **** **** *** **** **** ***** like **** **** ** *** **** ** *** ***.

*****, ** *** *** ** ********* ***** *** ******* ******* threat, **** *** *** **** ******* *** ******* **** ******** so ** *** ***** *** ***** *******?

****, *** ********* ***** ********** *** ******* ********* *** *** easily **** ******* *** ** **** ** **** * ******** on *** ******** *****. ***** ***'* ********* ** *** ** a ******** ***** ******** *** *** ******* ********** *** *** deny **** ****** ** ****** *** **** *** ****** ** the ***** *****. **** ** ******* ** **** *** ***** easily ** **** ***** ********** ** ******* ************ ********* ** the ***** *****, ******** **** ** *** *** ********* ***** and ******* ********* ********* ********* **** *** *** ******** ** anyone ****.

**** ***'* ***** ********* ************* ** ******* *** ******* ********** through ** *% *********, *** *** ******* *** ************ ************ of * ***** ***** ********** ******* **** ************* ******* **********. This ***'* ** *********** ** * ****** ****** **** ****** A ** ****** *. ****** * (*****) ****** ***'* ****** itself ** ***** *** ******* ********** *** ********** ** ****** their ******* ** *** **** ** * **** *** *** sake ** ***** ******* ** *** ********** ***** **** **'* a ******* *******.

"***** ***'* ********* ** *** ** * ******** ***** ******** for *** ******* ********** *** *** **** **** ****** ** simply *** **** *** ****** ** *** ***** *****"

*** ****: ** **** ****** **** ********* ****** **** **** comfortable ******* ***** ******** **** ** *** ******** ********** **** Dahua *** ****** **** * ******* ******** ** *** ********.

***, ** *** ******* ** *** ** *****, * ***** your * ***** *** *** * ***** ***** ** * great *******. * **** ***** *** ***** **** *** *** touting **** ***** ** * **** ****** ****** **** *********. No *** ***.

****, *** **** **** ***** ***** **** * ** *********. But **** *** ***** ***** ***** ** ********* ** *** a ******** ** ***** ******** ** *** ******* **** **** them **. * **** *** *** ****** ******* ******* *** govt ** ***** **** *** *** ** *** ***?

****'* * **** ** ** ** ******* ********: * ***** don't **** *** *** *** *** ***'* **** ** ********. Even ****** ** ******* ***'* ** ***, *'* *** ******* for ******* ** ** ** ********** **** * ** ***** have ** ****** **** *********** ************** ** ***** ********* ** the *** *****. * ******* ** **** *** * ****** that ** ********** *** ** *********** ** ******* *******.

** *** ** ******* ** *** ***** *** ***** ********* with *** ******* **********, * ******* **** *** ** ****** it ****** *** ******* ******** *** ************* *********. ****** *** a ********* ********* *** ******** ** ******* *********** ** *****'* own ******** ** *** **********. ********* **'* **** ** ***** something **** **** **** ** ***** **** ******** ***** *** are. ****'* *** ** ** ****** ** ******* ** ****** Dahua **** *** ****** ** ****** ***** ********* ***** **** part ** ******.

"**** ****** ** ******* ***'* ** ***, *'* *** ******* for ******* ** ** ** ********** **** * ** ***** have ** ****** **** *********** ************** ** ***** ********* ** the *** *****. * ******* ** **** *** * ****** that ** ********** *** ** *********** ** ******* *******."

** **** ********* * ***** **** * *** ********* ** the ******* **** *** **** *** ******* *** * ****** product ** ***. *** **** **** **** ******* ** ** American *********** *** **** ** ********** ** *** ***** ********** and *** *****, **** *** ********?

** *** ****, * ******* **** ******* *** ** *** looking ** ** **** *** *****. *** ***** ******* ******** with ******* ***** ****** ** **** ** ****. * **** dont ********** ** ** ***. ***** ** ****, ** ***** to ********.

"* **** ***** ********* ** ***** *** **** ****** *** any *** **** ** **** *** *** **** ***** ******* either *** ** ** *** ******"

****://***.*********.**.**/****/******-****/******/*****-***-*******-**-****-*****-********-******

**** * **** ***** '*******' **** *********. * ****** *** customers, ******** *** ***** **** **** *** *** *** *********** they ******* ** *** **** ******, ****** *** ***** *** bid ** ************. ** ******** ********* **** ********* ** ** some ** *** ********* *** **** ****** ** ****. ** explanation ** **** ** *** **** ** ***, ** **********. The ******* **** ** ****: ********* ** *** **** ****, where ** *** ******* *********** **** ********** ****** ******* *** question ********* *** ************ *** ****** **** ** ************ ** the ** ** *** ** *** ********? ****** ****** **** not **** *****. **** *********** ** *** '****' ********* *** to *** ** ****** ** ****. ********* ** **** ***** does *** **** ****** ******* ** ******** ****. ** *** Chinese ******* *** ********** **** *** **** ***, **** ** their *** ** ****. * ****** ******* **** ******** ******* cultural ****** ** * ********* ******* ** ***** ** *********** in *** ***. ** **** ** ***** **** **** **** anything ****** **** * ******* **** *** **** ******** ******* times ** * ******* *******, ******* ********* ******* *** **** to *** ****** ** * ********** ***** ***** **** *** "Flip=Flop" *** ******** **** *** **** ***** **** **** *** a ******* ** ******** ** ** **** *************. ** *** really ***** *** *** ** *** *** ***** **** '********** message' **** ** ******* ** ***** ** **** ****** ****? If *** ** ***** **** ** **** **** *** ******* in *** ***** ***** ** ****. * ** *** ******** that *** ******* ** ****, **** ******* ************* **** **** bullish ******* *********** **** ** ***** ********* *** ********* ** not *** ** ***** **** *************.

***** ** * **** ********** ******* *** ******* ********** ****** "some" *****, *** *** ******* ********** ***** *** ******* *********** (and *** *** ** ********* ***** * **** ******* ***** official)

****** ******* **** ***** **** *** "******* ***********" *** **** mentioned *** ** *** ******** ********** ** *********, ** ***? Where ** *** *** **** *********** ** ** *** ********** of **** *******?****** ** *** ***** ******* ********** ******** ** the ******** ** **** ** * ******* *******.

*** **** *** *** ******* *********** ** ** **********, *** fact **** *** ********** ** * ******* *********** ***'* * point **** ** ** *** ******.

**** ** **** **** ** * ******* ******* **** *****'* have ******* ********** ********; **** ** ******** *** ********* **** for **. ***** ** ******* ****** *** ******* ********** ** would **** ** ****** ********* ** ***** ******** ** * policy ****** ****** **** * ****** ****** *****.

*******, **** ** ** ******* ******* ****** **** * ****** that *** * **** **** ** ********* *** ************ ******** espionage (*****://***.***********.***/*****/****/***/**/*****-**********-********-*******-************-******** ****://***.************.***/******/***************************.***) *** *** * **** ****** ****** ***** battle ***** ** **** *** ** ** ** *****.

*** ******* ****, *** ******* *********** ** **** **** *** a **** *** ** *** *** ** *** ********* ** the ******* ******* ** *** * **** ******* ****** ** it ** ********* *** *** ** *** *******...

** *** **** *** ******* ********** *** ****** ** ** with *** ********* ** *** ******* **** *** ********* ***** secretary ** ********* *** *** ** ********* ** *** **********

'******* *** ****** ******** ****** * ****** *** *********** **** everyone ** *** ***** **** *** ******* ** ****** ****** values *** ********.'

**** *****'* ***** ** ** ** *** ***** ** ****. I'm *** ********. *'* ******** **** * ********** *** ******* that ** ***** ** ** *** **** ******* *** **** minded ** *** *****. ***'* **** ** *********** ****** **** facts *** ***% ******* ** '********'.

**** ** *** ******** **** * **** *********** ** ******** have **** **** ******** ** *** **** ** ******* ** other ******** ** ********.

* *** **** ********* *** **** *** ****** * **** with (* ***'* **** *** ******) *** **** ********** ** producing *** ********* ******* ******** **** *** **** ****, ***** on ***** ******* ***** ******. *'* ********** ** **** ****** to *** ***** ******** ** **** ** ****.

**** *** *** '***** ******' ** *** **** ''***** ** possibilities ** ****** **** '*****' ** '*****' ******.*** *** ******** of ****** **** "*****" **** ***** *** ** **** ** proper ******* ******** ******** *** ** *** ********** * **** of ********* ** ****** ** *** *******? ** ****** **** have ******** *** *** ****** ** ** ************ ** ********* directly? ** ** ** *** ***** ** ************* **** *** are ******* ** ******* **** ***-*********** *** ** **** ** written ** ************* ** *************** ** ********* ********* **** *** 'grabbing *** ******' *** ** **** ** ********? ** *** have ******** *********** **** ** ******** ** ********* ****** ** a ****** **** ***** ******* *** ****** ** ****** ** to ************* **** ***** ***** *********** ** *** ** ** US ******** ********? ****** ********* ** ****'*****'? * **** *** been **** ***** ** ****** *********** ** **** *** ****** opinion ** *** ******** ***** ** *** ********* ** ************** staff ** ********* ** **** *** ****** ** ** ***** effort ** ******* ******** **** *** ** ****** '********'. ** so * ***** ** ****** **** ** **** ******** ** folks *****-**** ***** ** ********** **** *** ********** ** ** so. * *** **** ** ** ** *********** *** ******** to *** ************. * **** ** **** ** *** ********* instead ** ******* ****** *** *** **** ******** ******* ***** their ******** **** *** *** **** *** ***** **********. * understand **** ***** *** ***** ** ******* ****** **** ******* I ** ******** **** ** '********.' * *** ****** *** that ** *** **** *** *****.

** ******, **** ** ***** ******* ***** ****** * **** to ****** *** *** *** ******** *** *****. *'** **** in **** ******** *** ** ***** ******* *** ************* *** distributors *** * **** ***** **** *******, ******* *** ********* representatives ** **** ******. **** ******** *** ******* ********* ******** are ********** *** * ***** *** **** **** **** ****** stuck ** *** ****. *** ** *** *** ******* *** end ***** ** *** ********* ** ****, **** **** ***** it **. *** **** ******* **********, ****** ** ***** *****, sure... *'** ***** ** ** **** ** * **** *** your ******* *** ****** ** ********* *******.

*** ** *** *** ******* *** *** ***** ** *** Hikvision ** ****, **** **** ***** ** **

#*, * ******** **** ***. ****, *** ** *** *** reasons ** **** *** **** ** *** *** ****** ***** for *********.

*** ***** **** ** *** ******* *****, ******* *** ***** engineering ********* **** ********* ** ******* ** ****. **** ** the ***** '**********' **** ** *** ******** *****. ***** **** treated **** **** ** *********.

*** ***** ** - *** *** ********* ****** ** (*) offer **** *** ********(*) **** ******* ***** ** *****, *********, ******* *** ***** engineering **** **** **** ** ***** *** *** ***** *******? That ** *** ****** ** *** ******* ********** **** ******, which ** *************, *** * ********** **** ***** **** *** benefits ** ****** ** *** **** ** ** *****.

* **** ** ***** **** *** ** **** ******** *** support ******** *** ***** ***** *** **** ******* ** **** shape ******** ** *** ****** *** ** **** ***** *** products **** ******* ******* ****** ** **'* ****** ** *****. Many **'* * **** ***** ****** *** ** **** ********* as **** *** ** ********** *** ***** **** *** **** use ********* ******* **** * ***** ***** ***** ***. *** clearly ********** *** ** ** * ****** **** ******* ********* for ***** ******** *** ***** ********* **** ***** ** ************ treatment. ** *** *** *** **** *** ****** **** ***** expansion ** *** **** ********* **** ** ** ** ****. What ***** ********** ******* * ******* *** ** ** * camera ************.

** *** ** **** **** *** **** *** ***** ***** of ********** ** ******* ** ***** ***** **** **** **** citing ************ ******* *** *****-******* ***********. ***** **'* *** *** that ****...

"*** ***** ** - *** *** ********* ****** ** (*) offer **** *** ********(*) **** ******* ***** ** *****, *********, ******* *** ***** engineering **** **** **** ** ***** *** *** ***** *******? "

*** ** *** ****/***** **** *******

*** **** ****** *******?

**** ****,****** *** ***...

******

*** **** ****** *******?

* ** *** **** ********* ***'* ******* ********* *******. ** both **** ****, ** ***** *** *** *** ********** *****.

** ** **** * **** ************* *** ********* ** ***** cost ********* ***** ** ** ***** ** ****** ** *********, spending ** ** ******, ** *********, ******* ** ** ************, that ** **** **** ****. ***** ** ****, ********* *** is ****** ************* ************.

**** ****** *** **** ** **********. ********* *** ******* ********** market ***** *** *** **** ****** **** ************* (*.*., *** repeated **-**% ****** *** ***** ***** **** **** *** **** year).

* ** *** ****** *** ****** *** **** ********* ** it. * *** **, ** **** ********, ** ***** **** sense. ** ********* ***** ** **** ******* ***** *** ** cents, *** *******'* *** **** **?

*** **** **** *** **** *** ******** ** ***** ** being ***********.

******: ********* ***************** ** ************ **** ********** ** ****** ****** *** ********* ** ******* in *** **** *** *****:

Login to read this IPVM report.
Why do I need to log in?
IPVM conducts unique testing and research funded by member's payments enabling us to offer the most independent, accurate and in-depth information.

Related Reports on Hacking

Last Day Save $50 - IP Networking Course on Mar 30, 2017
Last Day to Save $50 on the May IP Networking Course. This is the only networking course designed specifically for video surveillance...
Dahua Manager: Lots of Backdoors Beyond Dahua or Hikvision on Mar 29, 2017
A Dahua technical manager has fired back at criticisms of Dahua's backdoor, posting publicly what many at Dahua have privately been saying for the...
Uniview Weak Local / Strong Remote Password Policy Tested on Mar 14, 2017
With the continuing onslaught of cyber-security breaches (see Dahua backdoor recently discovered, Hikvision defaulted devices getting hacked)...
Genetec Comments on Washington DC MPD Hack on Mar 13, 2017
This January, the Washington DC police video surveillance system was hacked with ransomware, impacting 123 of 187 cameras. Last month, IPVM...
FLIR Responds to Dahua Backdoor on Mar 10, 2017
FLIR is the first Dahua OEM partner to issue a statement following Dahua's backdoor disclosure: Certain FLIR and Lorex branded products that...
Hikvision Firmware Decrypted on Mar 09, 2017
A developer has decrypted Hikvision's firmware, allowing examination of Hikvision's device source code and contents. In this report, we overview...
Dahua Backdoor Uncovered on Mar 06, 2017
A major cyber security vulnerability across many Dahua products has been discovered by an independent researcher, reported on IPVM, verified by...
Who Is Hacking Hikvision Devices? on Mar 06, 2017
Someone or organization is mass hacking Hikvision devices, actively and systematically running a script / program across the Internet that looks...
Hikvision Defaulted Devices Getting Hacked on Mar 02, 2017
Hikvision devices with default passwords and remote network access enabled (via DDNS, public IPs, etc.) have experienced wide spread hacking over...

Most Recent Industry Reports

Last Day Save $50 - IP Networking Course on Mar 30, 2017
Last Day to Save $50 on the May IP Networking Course. This is the only networking course designed specifically for video surveillance...
Dahua Manager: Lots of Backdoors Beyond Dahua or Hikvision on Mar 29, 2017
A Dahua technical manager has fired back at criticisms of Dahua's backdoor, posting publicly what many at Dahua have privately been saying for the...
$10,000 Free VMS Licenses For New Dealers IPConfigure on Mar 29, 2017
Another gimmick or a real deal? The company that brought 'Unlimited' Enterprise VMS License for Just $32,000 and a cannon to ISC West are back with...
Genetec and Axis Power Comcast's SmartOffice on Mar 29, 2017
Comcast has more than 20 million subscribers and $80 billion in revenue. Now Comcast is partnering with Genetec and Axis to deliver a...
IP Cameras Lose Buy America Protection on Mar 28, 2017
IP Cameras have lost the US government's 'Buy America' protection as the Security Industry Association (SIA) successfully lobbied the government to...
2Gig Intrusion Megatest (GC2 & GC3 Panels Tested) on Mar 28, 2017
2Gig is one of the most widely used intrusion systems, with two product lines that are the main offering of many alarm companies, huge national...
Anixter Favorability Results on Mar 28, 2017
Anixter's direct sales and integrator anger about it has been in the news recently: Anixter / Bosch Sells Direct to Amazon Anixter Touts...
Chinese Government Spies on Churches With Video Surveillance on Mar 27, 2017
The Chinese government is using video surveillance to spy on churches in China, reports UCANews, explaining: The [Chinese government]...
Hanwha Wisenet X Tested on Mar 27, 2017
Hanwha has released their latest generation, the Wisenet X series, powered by their new Wisenet 5 processor. This new series claims improvements...
Burglar Alarm Sirens Guide on Mar 27, 2017
Sirens are used to alert users to an alarm condition. In this note, we examine how to choose, locate, and install alarm sirens, including Siren...

The world's leading video surveillance information source, IPVM provides the best reporting, testing and training for 10,000+ members globally. Dedicated to independent and objective information, we uniquely refuse any and all advertisements, sponsorship and consulting from manufacturers.

About | FAQ | Contact