Hikvision Vulnerability Permits Wi-Fi Attack

Author: Brian Karas, Published on Nov 28, 2017

Hikvision acknowledged a Wi-Fi cyber security vulnerability on November 27, 2017. No special passwords, text strings, or programming knowledge are required. Any attacker within Wi-Fi range of the impacted cameras can exploit this.

IPVM spoke with the researcher who discovered and reported this vulnerability. We examine the limitations, exploit potential, affected products, and Hikvision's problems in responding to the vulnerability.

********* ************* **-** ***** ******** *************** ******** **, ****. ** ******* *********, **** *******, ** programming ********* *** ********. *** ******** ****** **-** ***** ** the ******** ******* *** ******* ****.

**** ***** **** *** ********** *** ********** *** ******** **** vulnerability. ** ******* *** ***********, ******* *********, ******** ********, *** Hikvision's ******** ** ********** ** *** *************.

[***************]

Limited ****** *********

**** ************* ** ******* ** **-** ******* ***** *** **** has *** ********** **-** ********, ********** *** ******** *******. **** limits ** ** * ********** ***** ****** ** ********** *****, as **-** *******, ** ******* *** *** **** *******, *** those ***** **-** ******* *** ****** ** ********* **-**.

Exploit ********

*** ************* ** **** ***** ******* *** ***, ** *******, to ******* * ******** ******* ****** "*******", **** ** ********. An ******** *** ****** * **** ******* **** **** "*******" and * ********** ******* **** ************* ******* ** **, ******** the ******** ** ******* ** *** ******. ********* ** *** researcher, *** ********** ****** **** ** ****** **** * ** DaVinci ******* *** ** ******** **** **** ** ****** *** origin ** *** *************.

********* ****** **** *** ********* ***** *** ********:

**-**********-***, **-**********-***, **-**********-**, **-**********-**, **-********-***, **-********-***, **-*******-**, **-********-**

*** ********* ******* ***** ** ******* ** *** ** ******** can *** *** **-** ******* ****** **** ******* ******** ** a *** ** **** ****** ** ** ******** *******:

Firewalls ***********

******* *** ******** ******** **** *** ****** **-** ******* ********* on *** ******, *** ******** ********, ****, ** ***** ******* used ** ****** ******** *********** ** *** ******** **** ** the ******* ***** *** ** ******* ** *** **-** **** of *** ******, ******* ** **** ** ******.

Exploit *********

********** ** *** ********** (**** ******) ** *********, **** ** ***** ***** ******* **** ******** **** **** prevents ********* *** **-** ********* **** *** ***** **** (** to *.*.*), *** **** *** ********** ** ************ ******** *******, ****** *** ******* ********* **** **** *** ***** ** these ******* **** ******* **-** ********.

*** *********** *** *** ******** ** ** ** **-** ***** of *** ****, *** **** *** **** **** **** ******* Wi-Fi ********, ***** **** ************* **** ****** *************'* ******** *************. ** **, *******, * *********** ********* ** *********'* **** to **** ******** **** **** ******* ********.

Hikvision ***** ******** ******* ************

***** ********* ********** *********** ** ****** ***************, *** *** * specific ***** ******* *** ***** *******, ******** **** ******:

*** ********** ******* **** ******* ********* *********'* ********, ** **** 4 ******, *** ******** ******* ******** ** *** * ******** to **** **********, ***** ** **** ** *** ************* ********** post:

***** ******* ******* ******** **** ***** ********* *** ********* ******* He *** ******** ******************'* ***** ******** *******, ********* ****** ******** ******** *** ******** *********** *******, ***** ****** **** ********** **** ***** ************* ** ***** own. ************,*********'* ***** *** **** ** ***** *********** **** *** *******, ******* *** **** ** ************* **** open ****** *** ******* ******* ********.

Positive ******** **** ***** *****

*** ********** ****** **** *** ******** **** ********* ********** **** from *** ***** ******** ********* *****, **** ** ***** ** ** ******* *** ******** ********** in ********** *** *********. ** **** ***** *** * **** hire *** *********, *** ***** ********* ** **** ** ******* Hikvision's ******* ***** ******** ************** *** ************* ********** ******* *********** such ** ***** ******** ************** ******** *******.

Hikvision ** ********* ************ ** *****

******* ************* *** ****** ** ******* ***, *** ****** ******* firmware *********, ** **** ** *********** *********** ** ***** **** vulnerability, ********* *** *** ********* ****** ***** ****** *** ************* was ********* ******** ** **** **********.

Special ******** ****** ***

********* *** *** ******* ** ****'* ******* *** ********** ****** on *** ************* **********. *******, **** **** * ***** ***** our ***** ** *********, *** ******* ******** * "******* ********", reusing *** ******* **** *** ***** **** **** ***** ******* Bulletin ******** * ***** *** ** ******* ****** ******* ********* *************.:

~** ******* *****, ********* **-**** *** ******** **** * ********* subject **** *** *****:

** *** ********, ******* ** ********** ******* ** *** ************* first, ********* ****** ** ******* ***** **** ****** ******* ****** features, ****** **** *** *********** ********** **** *** ******** ********* on **** ** *** ******** *****.

** ******** ******** ******(***) ********* **** ********, ***** *** ******* ** ** ** "Information ****" ********, **** ** ****** ********:

***, *** *** ******* ******** ******, ************ ******** ****** ******** and/or ********* **-** (*** ***** **** ******** *** ****** ** support ****).

***** *** "****** ********" ******* ***** ************* ** * ***** error, *********'* ****** ** ********* *** ************* ******** *** ******* rushed ** ***** ***** ********* **** **** ****** ***** **** the ************* ***** ** ******** *********, *** ******** **. *** Hikvision **** ********** ** ***** *** ************* ********* ***** *******, and *** * ************* ******** *** ************ ******* ** *****, they ***** **** *** ***** ****** ** ******* "********* *** outreach" ******* ** ******* ** ******* ** *** ********** *** issuing *******-******** *************.

Continued ********* *********** ******

**** ************* ** ** ********* *****, **** ****** ** ********** in ******** *********** ********* ** ******** ***** ******** *****. *********,*********'* ****** *********** ******** ** *******,***** ****** *************, ****** ******** ******** *************, ***** ******, *** **** ***** ** *************** **** **** been *** ****** ** **** ******** ****** ** **************, ** choices **** ** *** ******* ** ************ ***** ******** ******** to ***** ******* ** *** ********.

Communication ************ ******

********* ***** **** ****** ************* **** *******, **** ********* *** less ********* ************* ** ***************.

Comments (15)

Scott Sheldrake

11/28/17 11:15pm

** *** ****** *** ********* **** *** **-*******-***/* *** *** DS-2DE3304W-DE ****** ******** (*** ***** ******* ** ******) ******* ****** a ****** ********. *** **** ** **** ** ******* ** the **** *************.

********* **** *** **** ******** ******* ** ***** **** ****** (xx3304xx *** ******), ** *** ******* (*** ****** ****) ** on ***** ********** *** ****. **** ******* *****'* ****, **** just ***** *** ** *** **** ****** ***** **** *** have *** ****** ******. *** *** **** *** ****** **** doesn't ****.

*** *** ********* ****** ** ** ******* *** ***** **** hacking **** **** ** *** **** **** ** ********??

**** ** ********** ******.

Thumbnail brk1

Brian Karas

IPVM | In reply to Scott Sheldrake | 11/28/17 11:38pm

***** -

**** *** *** ********** ****** **** *** ******* *** ***** hit ** ************ ******** *******, ***** ****** ******* ** ****** ** ****** ****** ******** regardless ** *** ***** ******** ********/**********. *********, **** **** ********, Hikvision ******** * *** *** ********* ** ********** ****** *********.

*** **** *** *****, *** *** *** *****. ** ******** I *** **** *** ************ ******* ***** ***** *** ****** thousands ** ******* **** **** *** *** **** ******* ** "HACKED". ****, ***** *** **'* ** ********* ** ******* **** this ************* ********* ** *** ********. * **** *** ********** how/why *** **** **** *** ***** ****** ** **** "******" are ******** ******** ** *** ****** ***** ******* ****** ** vulnerable *******.

**** ** * *** ** ***** * **** ******* ****** 1,000 ******* (***** ** *** ** ******, ** **** ****** could ** ***) ******* "******" *** *** ****** ****. *** can *** **** *** ******* ************ ** *** **, *** Europe:

Undisclosed #1

In reply to Brian Karas | 11/29/17 12:09am

********: ** **** ********* ****** **** *** **** *** ***** is ********* *** ** *** ***** ****** ***** (*.*. **** have *** **** ******* ********* ** ***** **** ******** ****), how **** *** *** ********** ******* ****** ** ** ** N ******* *** ******?

Thumbnail brk1

Brian Karas

IPVM | In reply to Undisclosed #1 | 11/29/17 12:13am

***** *** *** **** ********** *******, **** *** ********** ******* that **** **** ****** ** ******* *** *******-******** **** "******" (or "******", ** ****-*********** ********).

***** *** ** ******* ** ***** **** ******* *** ******* equivalent ** "******", *** ** ***** *** *** ******* *** alternate *********/*********, ***.

Undisclosed #1

In reply to Brian Karas | 11/29/17 12:14am

**** ***** *****... : )

Undisclosed #1

In reply to Brian Karas | 11/29/17 12:17am

*** ** *** ** ********* ****, ** *** *****?

Thumbnail brk1

Brian Karas

IPVM | In reply to Undisclosed #1 | 11/29/17 01:04am

******* ****** *** **** **** *** ********* ******* ** ***** database, ** *** ** * *** ****.

Undisclosed #1

In reply to Brian Karas | 11/29/17 02:21am

**** **** ********************? ** ***** *******?

** ***** **... ** *** ****** ******* *** ******* ***'* show ** ** **** ****** *** ******* ********* ** ****** (when ***** *** **** ** **** ***** **** ********) ** because **** ****** *** ******* ** *** ******* ******* ** the **** ******, **** *** *** ***** *** **** ****** devices ******* ** ** *********? ***** * ***** ****** **** of ***** ******* **** ***** ** *******?

Thumbnail brk1

Brian Karas

IPVM | In reply to Undisclosed #1 | 11/29/17 11:30am

*** *** ***** *** **** ****** ******* ******* ** ** Australia?

******* *** ****** ******** *** **** *** *** *** ********* cameras ** *********. * ** *** **** ** **** ** because ********* *** *** ****** *********** *****, ******* ****** ****** does *** **** *** ** *********, ** *********** **** ****** firewalls, ** ********* ****.

** *** *** *** *** ** ******, ***** ** ***** I **** ***** ** ******** ********** ******* ****, **** * can *** **** ****.

Thumbnail passfoto 4

Karsten Kirchhof

In reply to Brian Karas | 01/04/18 03:23pm

** *****,

*** ********* ** *********** *** *** ***.

***** *** *** **** ******* **** ******* *** *** ******?

**,

*******

Undisclosed Manufacturer #2

11/29/17 12:05pm

**** *** ** ******* ******** **** *** ***** ******* *** a **** ****, ** *** ***** “*” *** *** ** get *** **** ******* “*”. *** ****** **** ***** “***”.

* **** **** **** ********* *** ********* ***** **** *** audio ***** ******* *** **** ******* ********.

Undisclosed #3

12/04/17 01:19pm

******* ********* **** !!! **** * *****.

John Honovich

IPVM | 12/21/17 08:02pm

******: * *** ***** **** ********** ********* *** *** ****** that *********** ****** ** ****** *** ********:

** ******** ******** ******(***) ********* **** ********, ***** *** ******* ** ** ** "Information ****" ********, **** ** ****** ********:

***, *** *** ******* ******** ******, ************ ******** ****** ******** and/or ********* **-** (*** ***** **** ******** *** ****** ** support ****).

***************** * ********* ******:

Undisclosed Integrator #4

In reply to John Honovich | 12/21/17 08:13pm

*** ****** ********* ***** ***** ******* ******* *** **** ******* when ***'** ******* ** ** ** *** **** *** ****?

Undisclosed Manufacturer #2

In reply to John Honovich | 12/21/17 08:47pm

*** ************ ** *********.

Login to read this IPVM report.
Why do I need to log in?
IPVM conducts unique testing and research funded by member's payments enabling us to offer the most independent, accurate and in-depth information.

Related Reports on VMS

Hanwha Dual Imager Dome Camera Tested (PNM-7000VD) on Oct 18, 2018
Hanwha has introduced their first dual-imager model, the PNM-7000VD, a twin 1080p model featuring independently positionable sensors and a snap-in...
Integrator Laptop Guide on Oct 16, 2018
This 18-page guide provides guidance and statistics about integrator laptop use. 150 integrators explained to IPVM in detail about their laptops,...
Mysterious Patent Troll 'Secure Cam' Targets Industry, Sues Hanwha, Hikvison, JCI, Panasonic, More on Oct 11, 2018
A company named "Secure Cam," who is actively hiding their ownership, has acquired a slew of video patents and is systematically suing video...
Security System Health Monitoring Usage Statistics 2018 on Oct 09, 2018
How well and quickly do integrators know if devices are offline or broken? New IPVM statistics show that typically no health monitoring is...
IACP 2018 Police Show Final Report on Oct 08, 2018
IPVM went to Orlando to cover the 2018 IACP conference, the country's largest police show (about as big as ASIS), examining the 700+...
VMS Mobile App Shootout - Avigilon, Dahua, Exacq, Genetec, Hikvision, Milestone on Oct 01, 2018
Mobile VMS apps are a critical interface for the modern surveillance user. But who does it best and worst? We tested 6 manufacturers - Avigilon,...
Hikvision 4MP Camera Tested (DS-2CD2345FWD-I) on Sep 27, 2018
Hikvision's latest Performance Series / EasyIP 3.0 4MP model, the DS-2CD2345FWD-I, was the top performer in our 4MP shootout, besting rivals from...
ASIS GSX 2018 Show Report on Sep 25, 2018
In the first major US show since the US government ban of Dahua and Hikvision was passed into law, the mega Chinese companies were in retreat and...
4MP Camera Shootout - Axis, Dahua, DW, Hanwha, Hikvision, Uniview, Vivotek on Sep 24, 2018
4MP usage continues to climb, especially for low cost fixed lens models. To see who was best, we bought and tested seven 4MP models from Axis,...
VMS Export Shootout - Avigilon, Dahua, Exacq, Genetec, Hikvision, Milestone on Sep 13, 2018
When crimes, accidents or problems occur, exporting video from one's video surveillance system is critical to proving incidents. But who does it...

Most Recent Industry Reports

Hanwha Dual Imager Dome Camera Tested (PNM-7000VD) on Oct 18, 2018
Hanwha has introduced their first dual-imager model, the PNM-7000VD, a twin 1080p model featuring independently positionable sensors and a snap-in...
Camera Height / Blind Spot Added to IPVM Camera Calculator on Oct 18, 2018
IPVM has added camera height and blind spot estimation to the Camera Calculator. This is especially helpful for those who need to mount cameras up...
Axis Strong US Growth, Flat EMEA - Q3 2018 Financials on Oct 18, 2018
This spring, Axis had its best financials in many years (see Axis Strong Q2 2018 Results). However, over the summer, Axis had many products sold...
Best Alternatives to Banned Dahua and Hikvision on Oct 17, 2018
With the US government ban and a growing number of users banning Dahua and Hikvision, one key question is what to use for low cost? While Dahua and...
Video Quality / Compression Tutorial on Oct 17, 2018
While CODECs, like H.264, H.265, and MJPEG, get a lot of attention, a camera's 'quality' or compression setting has a big impact on overall...
Knightscope Winning Investors, Struggling With Growth on Oct 16, 2018
While Knightscope's new financials show the company only winning 11 new customers in the past 12 months, the company continues to win new...
Integrator Laptop Guide on Oct 16, 2018
This 18-page guide provides guidance and statistics about integrator laptop use. 150 integrators explained to IPVM in detail about their laptops,...
Huawei Admits AI "Bubble" on Oct 16, 2018
A fascinating article from the Chinese government's Global Times: Huawei’s AI ambition to reshape industries. While the Global Times talks about...
ADI's Financials Revealed + W-Box Growth Priority on Oct 15, 2018
  ADI is one of the most powerful distributors in the security industry but how big are they? How much profit do they make? How much do they sell...
Dahua Face Recognition Camera Tested on Oct 15, 2018
Dahua has been one of the industry's most vocal proponents of the value that AI creates: As part of this, Dahua has released a facial...

The world's leading video surveillance information source, IPVM provides the best reporting, testing and training for 10,000+ members globally. Dedicated to independent and objective information, we uniquely refuse any and all advertisements, sponsorship and consulting from manufacturers.

About | FAQ | Contact