Hikvision Critical Cloud Vulnerability Disclosed

By IPVM Team, Published Apr 25, 2018, 09:36am EDT

Security researchers Vangelis Stykas [link no longer available] and George Lavdanis [link no longer available] discovered a vulnerability in Hikvision's HikConnect cloud service that:

just by knowing the email,phone or username they used while registering, after that you can view the live feed of the cam/DVR, manipulate the DVR, change that user’s email/phone and password and effectively lock the user out

The researchers detail the process and the issues in this post. Hikvision HQ has acknowledged the vulnerability and released a fix.

Inside this note, we examine what the issue was, compare it to 2017's Hikvision IP Camera backdoor and explain why this one was a coding error and not anything to do with Hikvision's Chinese government ownership.

HikConnect **********

********** ** *********'* ****** cloud **********/****** *******. ** has ******* *** * number ** *****, ***** in ***** ** *****, and ***** ***** ******** ************* *** found ** ***** ********* DDNS ******************* ************ *********, ********* *** **** promoting **********.

**** **********, * ****** connection ** **** **** one's ********* ******* (*********, cameras, ***.) ** *********'* cloud *******. ** ** so, *** ******* * HikConnect *******. **** ****, the ********* ****** ** remotely ********** ***** *** cloud *******.

Vulnerability *********

*** ************* ** ******** since ** ****** **** access ** ******* ********* to **********. *** *********** found * *** ******:

(*) **** **** **** to ****** * ****** that **** **** *** logged ** ** ** changing *** **** ** on *** ****** *** their *******, ** **** note:

***** ******** *** *** user ** **** *** first ***** ****** ** the ****** ***** ** AS_UserID ***…****, ** *** see *** ***** *******.

(*) ***** *****'* '******' feature **** **** **** to ***** ***** "***** or *****" ** *** the **** ** *** then ****** *** ******:

** ***** **** ***** you **** * **** as * ****** *** can ***** *** *** you *** * ******* which **** *** *** (wanted) **** **!

**** **** *** **** user **, **** ***** return ** **** (*) and ****** **** ******** person's ******.

3 *** ***

*** ********** **** **** Hikvision ***** *** ************* within * **** ** them ******* ********* *** vulnerability ******. ********* **** they *** "*** ***** of *** ****** ** malicious ***" ** *** vulnerability.

***** ********* *** *** explain *** **** ***** it, ****** ********* ** IPVM **** ***** ********* the *************, *** ******** guess ** **** **** are ******** *** ****** server ****, ****** **** simply ******** *** **** ID ** ** ********.

Not ******* ********** *******

***** ***** *** *********** concerns ***** *********'* ******* government *********, **** ** certainly *** * ****** in ****. ***** **** is * ***** *******, Hikvision *** **** ****** to *** ******* *** any ****** *********. ** they **** ** ****** those *******, **** ** not **** *** '********', they ****** *** ****** directly. **** ** *** unique ** *********, ** that ** * *********** design ******** ** ***** services (******* ******* ** Hikvision). *******, ***** *** Chinese's **********'* *********, *** concerns *** **** ***********.

Compared ** **** ********

*******-**** *********** ***** ** **************, in **** ** ******** direct ***** ****** ** devices **** * ****** command ******. **** *************, by ********, ******** ********* issues. ** *** ***** hand, *** ******** ******** having ******* ****** ** the ****** (***** ** the ****** *** *** exposed ** *** ******** would ** *******). **** HikConnect, *** ************* *** be ******** ****** *** device *********.

Risks ** ***** ********

************, ************ ************* **** recommended **** **********, ***** has *** *********** ******** of ****** ******* ******* to ****** *******. ***** services *** **** ****** that, ** *** ****** that **** ******* **** forwarding (******, ****,********* ********* ** ********* port ***************** ********** **** **********'* ***********/*****).

*******, ** **** ******** shows, ***** ******** **** their *** *****, ** creating * ****** ***** of ******* / *************. Instead ** ****** ******* IP ********* ****** *** world, ** ******** ***** concentrate *** ******* ** a ****** ****** *** get ****** ** ******** of ********* ** *******. Stykas *** ******** *** white *** *********** *** responsibly ******** ****. ****** could ** ***** *** found **** ************* *** used ** ** ******* devices.

Comments (12)

John Honovich

IPVM | 04/25/18 01:45pm

This morning, 2 emails featuring Hikvision USA about the same time.

Special Bulletin:

And another sale:

Certainly, today's timing is coincidental but also fitting.

Agree
Disagree
Informative: 1
Unhelpful
Funny: 7

Undisclosed #1

In reply to John Honovich | 04/25/18 01:50pm

If I pay standard prices can I get something that is not full of security holes? Would gladly even pay a bit extra for that.

Agree: 3
Disagree
Informative
Unhelpful
Funny: 9

Undisclosed Distributor #2

In reply to Undisclosed #1 | 04/25/18 01:59pm

No.  All is "holy".

 

 

:)

Agree
Disagree
Informative: 1
Unhelpful
Funny: 2
Avatar

Michael Gonzalez

Integrated Security Technologies, Inc.
04/26/18 01:57am

Seems to me that cloud and security are a contradiction in terms, kind of like Hikvision and security for that matter.

Agree: 3
Disagree: 2
Informative
Unhelpful: 1
Funny: 4

Nathan Causby

IPVMU Certified | In reply to Michael Gonzalez | 04/26/18 12:31pm

I felt the heat from that one.

Agree
Disagree
Informative
Unhelpful
Funny: 2

John Honovich

IPVM | 04/26/18 10:47am

CSO Online article: Critical Hikvision flaw could be remotely exploited to hijack cameras, DVRs and accounts

Agree: 1
Disagree
Informative: 1
Unhelpful
Funny

Ryan O'Daniel

IPVMU Certified | In reply to John Honovich | 04/27/18 01:49pm

The picture displaying the "HACKED" cameras is a Dahua NVR, not Hikvision.

Agree
Disagree
Informative
Unhelpful
Funny

John Honovich

IPVM | In reply to Ryan O'Daniel | 04/27/18 02:07pm

Yes, the CSO's article's picture is incorrect.

We actually emailed CSO Online when they first used the incorrect picture/labeling last fall:

They never responded to us.

Agree
Disagree
Informative: 2
Unhelpful
Funny
Avatar

Tim Pickles

Mitie Fire & Security Systems
In reply to John Honovich | 04/27/18 03:49pm

Wonder why they never responded John? Seems that when a deliberate defamatory action is perpetrated, it’s just ok not to be held to account. 

Agree: 1
Disagree
Informative
Unhelpful
Funny

John Honovich

IPVM | In reply to Tim Pickles | 04/27/18 07:05pm

Tim,

Also we actually tweeted this at / to CSO Online, see below:

Again, I think they should fix it and that they did not is definitely a mark against them.

On the other hand, as for defamation, there are plenty of Hikvision cameras that were hacked and labeled 'hacked' so it is not as if the fundamental point was bogus, just the example they used. 

Agree
Disagree
Informative: 1
Unhelpful
Funny
Avatar

Tim Pickles

Mitie Fire & Security Systems
In reply to John Honovich | 04/27/18 08:11pm

I don’t disagree John, but however this is dressed up and peddled it IS defamation and they should be held to account for it.

it is either an error of uneducated stupid editors, or a calculated misrepresentation - but either way it is a wrong and defaming and certainly worthy of deeper scripting of the entire article based upun the truth that the publisher, aside from being ignorant, is also exceeding irresponsible.

You are focussed on holding publishers to account for similar articles, the fact they have purpose ignored you demonstrates their ignorance and arrogance. If you so it John, I will - they have willfully and knowingly published an wholly inaccurate and defamatory article - and not sought to correct it, thus proving their malicious intent. But hey - let’s blame Hikvision because it’s obviously their fault and that of the Chinese ownership.

Im left wondering what else these liars publish in the name of “responsible” journalism - CNN and Fox BS all over again......

 

Agree
Disagree
Informative
Unhelpful
Funny

bashis mcw

04/26/18 03:56pm

Good find!

Continue the research and include also other vendors, I'm sure you will find more.

 

Agree: 2
Disagree
Informative
Unhelpful
Funny
Read this IPVM report for free.

This article is part of IPVM's 6,910 reports, 923 tests and is only available to members. To get a one-time preview of our work, enter your work email to access the full article.

Already a member? Login here | Join now
Loading Related Reports