Hikvision UPnP Hacking Risk

IPVMU Certified

Are the default external/internal port numbers always the same?

What happens to the assignments if there is more than one camera online?

Reactions:

(1)

Ethan Ace

Defaults are always the same (80/554/8000). If there's more than one camera online, the port numbers are incremented, so camera 2 would use port 81, camera 3 uses port 82, etc., etc.

Reactions:

(1)

Sean Nelson

Nelly's Security

Despite Hik-Connect being their cloud service, Hikvision requires open ports for remote configuration.

This is not true for Hik-Connect. They just suggest using UPNP to automatically port forward to make a quicker connection then relying solely on the P2P cloud service. You can click the Skip Icon and the cloud service still works fine. Matter of fact, I wish they would just simply remove the UPNP step, its confusing and UPNP works less than half the time on routers.

An even more annoying feature with the new updated Hik Connect is when the app "senses" there is a poor network connection. It suggests that you "map the ports" to make a quicker connection. This is basically turning on UPNP. I hope they remove that feature because I can just hear my customers calling right now " My app says I have a poor connection, how do I map my ports?"

Reactions:

(1)

(2)

Ethan Ace

This is not true for Hik-Connect. They just suggest using UPNP to automatically port forward to make a quicker connection then relying solely on the P2P cloud service. You can click the Skip Icon and the cloud service still works fine.

So if you skip it, you can configure camera or recorder settings how? Via the app? iVMS? Other? How do I remotely connect to configure a VMD zone without port forwarding, for example?

If this is true I'd like to test it and correct.

Reactions:

Undisclosed #2

Sean is right!

You configure settings locally

and use Hik-Connect to "connect" :)

Reactions:

Sean Nelson

Nelly's Security

U can do it thru ivms for sure, all settings are available thru ivms via p2p. Also, there are more and more settings u can set thru the phone app as well with each update. For example, you can block out motion areas in the image when i was using their new doorbell the other day. I assume these features will get pushed to all devices soon. Btw , are u guys going to test the doorbell soon?

Reactions:

Ethan Ace

Camera settings changes fail via cloud in iVMS. I've tried this on multiple cameras at multiple locations, and the Hik-Connect app itself only includes turning notifications on or off.

You can configure recorders through iVMS, but it's ridiculously slow. Over a minute to load settings initially in all our testing, and 10-15 seconds to switch between settings pages.

Reactions:

(1)

Sean Nelson

Nelly's Security

Confirmed, My Bad. I never tried to get to settings with a cam, only a DVR and assumed it would work on cams.

Reactions:

Undisclosed #1

IPVMU Certified

Hikvision Door Station Tested

Btw , are u guys going to test the doorbell soon?

Excuse me, but it’s a door station;)

Reactions:

Sean Nelson

Nelly's Security

Their is an actual consumer doorbell as well. Different product.

Reactions:

Undisclosed #1

IPVMU Certified

Not seeing any doorbells, just door stations on the u.s. site. Is it available here yet?

Reactions:

Undisclosed #2

HIK OEM Video doorbell

You can buy in USA and Canada

Reactions:

(1)

Ethan Ace

It's in the product quick guide, but not on the website. The Hikvision branded version is not yet available at ADI, Anixter, Tri-Ed, etc. We plan to test it when it's available from these sources, branded Hikvision.

There are OEM doorbells available for awhile now, though. LTS is selling it, and you can find it online elsewhere, but my concern is that the overseas doorbell part number is different from what is in the quick guide, so I'd rather wait and test the model with local support.

Reactions:

(1)

Undisclosed #2

@Ethan,

Can you please do Hik-Connect DVR test for open ports

scan DVR from outside for open ports

before and after connection

Thanks

Reactions:

Undisclosed #1

IPVMU Certified

I wish they would just simply remove the UPNP step, its confusing and UPNP works less than half the time on routers.

I guess were lucky that it doesn’t work so well. Every Cloud has a silver lining.

Reactions:

(1)

David Shepherd

I remember hearing about the security issues with UPnP 10 years ago, it surprises me that its still included on new devices...

Reactions:

(1)

Dennis Ruban

UPnP is just a way how residential customers do their DIY projects. If you have qualified installer and commercial project, all those potential holes will be disabled, including UPnP on your router

Reactions:

John Honovich

IPVM

In reply to Dennis Ruban

UPnP is just a way how residential customers do their DIY projects. If you have qualified installer and commercial project

Dennis, and how many installers are qualified in IP networks? We've already discussed this at length here (for others to review) but I'll simply reiterate 2 points:

Lots of installers are not qualified in IP networks.
Hikvision's auto UPnP tactic is quite uncommon among video surveillance manufacturers so it is not something that most would expect would happen.

Reactions:

Dennis Ruban

In reply to John Honovich

And, as I stated before, don't go to a not qualified installer. When you go to a car shop, would you expect techs to be qualified so you'll stay alive driving your car after tire change?

Reactions:

John Honovich