Hikvision Vulnerability Permits Wi-Fi Attack

By Conor Healy, Published Nov 28, 2017, 05:36pm EST (Info+)

Hikvision acknowledged a Wi-Fi cyber security vulnerability on November 27, 2017. No special passwords, text strings, or programming knowledge are required. Any attacker within Wi-Fi range of the impacted cameras can exploit this.

IPVM spoke with the researcher who discovered and reported this vulnerability. We examine the limitations, exploit potential, affected products, and Hikvision's problems in responding to the vulnerability.

Limited ****** *********

**** ************* ** ******* ** **-** ******* where *** **** *** *** ********** Wi-Fi ********, ********** *** ******** *******. This ****** ** ** * ********** small ****** ** ********** *****, ** **-** cameras, ** ******* *** *** **** popular, *** ***** ***** **-** ******* are ****** ** ********* **-**. 

Exploit ********

*** ************* ** **** ***** ******* *** set, ** *******, ** ******* * wireless ******* ****** "*******", **** ** password. An ******** *** ****** * **** ******* **** **** "davinci" *** * ********** ******* **** automatically ******* ** **, ******** *** attacker ** ******* ** *** ******. According ** *** **********, *** ********** camera **** ** ****** **** * TI ******* ******* *** ** ******** that **** ** ****** *** ****** of *** *************.

********* ****** **** *** ********* ***** are ********:

**-**********-***, **-**********-***, **-**********-**, **-**********-**, **-********-***, **-********-***, **-*******-**, DS-2CD2432F-IW

*** ********* ******* ***** ** ******* of *** ** ******** *** *** the **-** ******* ****** **** ******* settings ** * *** ** **** access ** ** ******** *******:

Firewalls ***********

******* *** ******** ******** **** *** unused Wi-Fi ******* ********* ** *** ******, any ******** ********, ****, ** ***** methods **** ** ****** ******** *********** on *** ******** **** ** *** network ***** *** ** ******* ** the Wi-Fi **** ** *** ******, ******* it **** ** ******.

Exploit *********

********** ** *** ********** (**** ******) on *********, **** ** ***** ***** ******* with ******** **** **** ******** ********* the Wi-Fi ********* **** *** ***** **** (up ** *.*.*), *** **** *** ********** to *** ********* ******** *******, ****** *** ******* ********* **** high *** ***** ** ***** ******* with ******* **-** ********.

*** *********** *** *** ******** ** be ** **-** ***** ** *** unit, *** **** *** **** **** with ******* **-** ********, ***** **** vulnerability less ****** **** *********'* ******** *************. ** **, *******, * *********** ********* on *********'* **** ** **** ******** with **** ******* ********. 

Hikvision ***** ******** ******* ************

***** ********* ********** *********** ** ****** vulnerabilities, *** *** * ******** ***** address *** ***** *******, ******** **** months:

*** ********** ******* **** ******* ********* Hikvision's ********, ** **** * ******, and ******** ******* ******** ** *** a ******** ** **** **********, ***** as **** ** *** ************* ********** post:

***** ******* ******* ******** **** ***** Hikvision *** ********* ******* ** *** actively promoting*********'* ***** ******** *******, ********* ****** ** ****** ******** and ******** *********** ******* [**** ** longer *********], ***** ****** **** ********** this ***** ************* ** ***** ***. ************, *********'* ***** *** **** ** ***** Security *** **** *** *******, ******* *** role ** ************* **** **** ****** the ******* ******* ********.

Positive ******** **** ***** *****

*** ********** ****** **** *** ******** from ********* ********** **** **** *** cyber ******** **** ***** ***** [**** ** longer *********], **** ** ***** ** be ******* *** ******** ********** ** addressing *** *********. ** **** ***** was * **** **** *** *********, and ***** ********* ** **** ** improve *********'* ******* ***** ******** ************** and ************* ********** ******* *********** **** as ***** ******** ************** ******** *******. 

Hikvision ** ********* ************ ** *****

******* ************* *** ****** ** ******* 3rd, *** ****** ******* ******** *********, as **** ** *********** *********** ** close **** *************, ********* *** *** proactive notify ***** ****** *** ************* *** disclosed ******** ** **** **********.

Special ******** ****** ***

********* *** *** ******* ** ****'* request *** ********** ****** ** *** vulnerability **********. *******, **** **** * ***** ***** our ***** ** *********, *** ******* released * "******* ********", ******* *** subject **** *** ***** **** **** their ******* ******** ******** * ***** ago ** *** **** ****** ******* ********* *************.:

~** ******* *****, ********* **-**** *** Bulletin **** * ********* ******* **** *** intro:

** *** ********, ******* ** ********** details ** *** ************* *****, ********* starts ** ******* ***** **** ****** disable ****** ********, ****** **** *** technically ********** **** *** ******** ********* ** many ** *** ******** *****.

** * ******* ******** ****** (***) ********* **** ********, ***** *** advised ** ** ** "*********** ****" document, **** ** ****** ********:

***, *** *** ******* ******** ******, ************ updating ****** ******** ***/** ********* **-** (for ***** **** ******** *** ****** to ******* ****).

***** *** "****** ********" ******* ***** misclassified ** * ***** *****, *********'* errors ** ********* *** ************* ******** the ******* ****** ** ***** ***** responses **** **** ****** ***** **** the ************* ***** ** ******** *********, and ******** **. *** ********* **** responsive ** ***** *** ************* ********* email *******, *** *** * ************* response *** ************ ******* ** *****, they ***** **** *** ***** ****** of ******* "********* *** ********" ******* of ******* ** ******* ** *** researcher *** ******* *******-******** *************.

Continued ********* *********** ******

**** ************* ** ** ********* *****, **** should ** ********** ** ******** *********** processes ** ******** ***** ******** *****. Similarly,*********'* ****** *********** ******** ** *******, ***** ****** *************, *** *** ******** ******** *************, ***** ******, *** **** ***** of *************** **** **** **** *** result ** **** ******** ****** ** implementation, ** ******* **** ** *** company ** ************ ***** ******** ******** to ***** ******* ** *** ********. 

Communication ************ ******

********* ***** **** ****** ************* **** *******, more ********* *** **** ********* ************* on ***************. 

Comments (15)

Scott Sheldrake

11/29/17 01:15am

We are seeing the HIKVision mini PTZ DS-2DE2103-DE3/W and HIK DS-2DE3304W-DE hacked remotely (OSD names changed to HACKED) despite having a strong password.  Not sure if this is related to the same vulnerability.

HIKVision does not have firmware updates on their tech portal (xx3304xx not listed), or the website (404 broken link) or on their unofficial FTP site.  Tech support doesn't know, they just point you at the tech portal which does not have the camera listed.  The one they say should work doesn't work.

How can HIKVision expect us to protect end users from hacking when they do not even give us firmware??

This is absolutely insane.

Agree: 1
Disagree
Informative: 1
Unhelpful: 1
Funny
Avatar

Brian Karas

IPVM | In reply to Scott Sheldrake | 11/29/17 01:38am

Scott -

What are you describing sounds like the cameras are being hit by the Hikvision Backdoor Exploit, which allows someone to access or change camera settings regardless of the admin password strength/complexity. Basically, with this backdoor, Hikvision provides a way for attackers to circumvent strong passwords.

For what its worth, you are not alone. An analysis I did over the Thanksgiving weekend shows there are likely thousands of cameras that have had the name changed to "HACKED". Also, there are 10's of thousands of cameras with this vulnerability reachable on the internet. I have not determined how/why the ones that are being hacked to show "HACKED" are selected relative to the fairly large overall number of vulnerable cameras.

Here is a map of where I have located nearly 1,000 cameras (based on geo IP lookup, so some points could be off) showing "HACKED" for the camera name. You can see they are heavily concentrated in the US, and Europe:

Agree
Disagree
Informative: 3
Unhelpful
Funny

Undisclosed #1

In reply to Brian Karas | 11/29/17 02:09am

Question:  If Hiks explosive growth over the last few years is primarily due to big deals within China (i.e. they have far more cameras installed in China than anywhere else), how come all the vulnerable cameras appear to be in N America and Europe?

Agree: 1
Disagree
Informative
Unhelpful
Funny
Avatar

Brian Karas

IPVM | In reply to Undisclosed #1 | 11/29/17 02:13am

These are not just vulnerable cameras, they are vulnerable cameras that have been hacked to display the English-language text "HACKED" (or "Hacked", or case-insensitive variants).

There may be cameras in China that display the Chinese equivalent of "HACKED", but my check was not looking for alternate languages/spellings, etc.

 

Agree
Disagree
Informative: 1
Unhelpful
Funny

Undisclosed #1

In reply to Brian Karas | 11/29/17 02:14am

that makes sense...  : )

Agree
Disagree
Informative
Unhelpful
Funny

Undisclosed #1

In reply to Brian Karas | 11/29/17 02:17am

why so few in Australia then, do you think?

Agree
Disagree
Informative
Unhelpful
Funny
Avatar

Brian Karas

IPVM | In reply to Undisclosed #1 | 11/29/17 03:04am

Because Shodan has very very few Hikvision devices in their database, as far as I can tell. 

Agree
Disagree
Informative
Unhelpful
Funny

Undisclosed #1

In reply to Brian Karas | 11/29/17 04:21am

very very few Australian devices?  or total devices?

my point is... if the reason Chinese Hik cameras don't show up on your search for devices reporting as HACKED (when there are more of them there than anywhere) is because your search was limited to the English version of the word HACKED, then why are there not more HACKED devices showing up in Australia?  Since I would assume most of their systems were based in English?

Agree
Disagree
Informative
Unhelpful
Funny
Avatar

Brian Karas

IPVM | In reply to Undisclosed #1 | 11/29/17 01:30pm

why are there not more HACKED devices showing up in Australia?

Because the shodan database has very few IPs for Hikvision cameras in Australia. I do not know if that is because Hikvision has low market penetration there, because Shodan simply does not scan IPs in Australia, if Australians have better firewalls, or something else. 

If the IPs are not in shodan, which is where I pull lists of publicly accessible cameras from, then I can not scan them.

 

Agree
Disagree
Informative: 1
Unhelpful
Funny
Avatar

Karsten Kirchhof

In reply to Brian Karas | 01/04/18 05:23pm

Hi Brian,

you published an interactive map for USA.

Could you pls also publish some similar map for Europe?

 

BR,

Karsten

Agree
Disagree
Informative
Unhelpful
Funny

Undisclosed Manufacturer #2

11/29/17 02:05pm

This may be farther reaching than you think because for a long time, to get sound “S” you had to get the WiFi version “W”. The models were often “IWS”. 

I know with near certainty the customers using them for audio never touched the WiFi default settings. 

Agree: 1
Disagree
Informative: 2
Unhelpful
Funny

Undisclosed #3

12/04/17 03:19pm

Another Hikvision hack !!! What a shock.

Agree
Disagree
Informative
Unhelpful
Funny

John Honovich

IPVM | 12/21/17 10:02pm

Update: A day after IPVM criticized Hikvision for its notice that erroneously stated no action was required:

In a Product Advisory Notice (PAN) Hikvision also released, users are advised it is an "Information Only" document, with no action required:

Yet, the PAN clearly requires action, recommending updating device firmware and/or disabling Wi-Fi (for units with firmware new enough to support this).

Hikvision released a corrected notice:

Agree
Disagree
Informative: 2
Unhelpful
Funny

Undisclosed Manufacturer #4

In reply to John Honovich | 12/21/17 10:13pm

Why should Hikvision worry about quality control and copy editing when you're willing to do it for them for free? 

Agree: 2
Disagree
Informative
Unhelpful
Funny: 4

Undisclosed Manufacturer #2

In reply to John Honovich | 12/21/17 10:47pm

The incompetence is maddening. 

Agree: 2
Disagree
Informative
Unhelpful
Funny
Login to read this IPVM report.
Why do I need to log in?
IPVM conducts reporting, tutorials and software funded by subscriber's payments enabling us to offer the most independent, accurate and in-depth information.
Loading Related Reports