Hikvision Critical Cloud Vulnerability Disclosed

By IPVM Team, Published Apr 25, 2018, 09:36am EDT

Security researchers Vangelis Stykas [link no longer available] and George Lavdanis [link no longer available] discovered a vulnerability in Hikvision's HikConnect cloud service that:

just by knowing the email,phone or username they used while registering, after that you can view the live feed of the cam/DVR, manipulate the DVR, change that user’s email/phone and password and effectively lock the user out

The researchers detail the process and the issues in this post. Hikvision HQ has acknowledged the vulnerability and released a fix.

Inside this note, we examine what the issue was, compare it to 2017's Hikvision IP Camera backdoor and explain why this one was a coding error and not anything to do with Hikvision's Chinese government ownership.

HikConnect **********

********** ** *********'* ****** cloud **********/****** *******. ** has ******* *** * number ** *****, ***** in ***** ** *****, and ***** ***** ******** ************* *** found ** ***** ********* DDNS ******************* ************ *********, ********* *** **** promoting **********.

**** **********, * ****** connection ** **** **** one's ********* ******* (*********, cameras, ***.) ** *********'* cloud *******. ** ** so, *** ******* * HikConnect *******. **** ****, the ********* ****** ** remotely ********** ***** *** cloud *******.

Vulnerability *********

*** ************* ** ******** since ** ****** **** access ** ******* ********* to **********. *** *********** found * *** ******:

(*) **** **** **** to ****** * ****** that **** **** *** logged ** ** ** changing *** **** ** on *** ****** *** their *******, ** **** note:

***** ******** *** *** user ** **** *** first ***** ****** ** the ****** ***** ** AS_UserID ***…****, ** *** see *** ***** *******.

(*) ***** *****'* '******' feature **** **** **** to ***** ***** "***** or *****" ** *** the **** ** *** then ****** *** ******:

** ***** **** ***** you **** * **** as * ****** *** can ***** *** *** you *** * ******* which **** *** *** (wanted) **** **!

**** **** *** **** user **, **** ***** return ** **** (*) and ****** **** ******** person's ******.

3 *** ***

*** ********** **** **** Hikvision ***** *** ************* within * **** ** them ******* ********* *** vulnerability ******. ********* **** they *** "*** ***** of *** ****** ** malicious ***" ** *** vulnerability.

***** ********* *** *** explain *** **** ***** it, ****** ********* ** IPVM **** ***** ********* the *************, *** ******** guess ** **** **** are ******** *** ****** server ****, ****** **** simply ******** *** **** ID ** ** ********.

Not ******* ********** *******

***** ***** *** *********** concerns ***** *********'* ******* government *********, **** ** certainly *** * ****** in ****. ***** **** is * ***** *******, Hikvision *** **** ****** to *** ******* *** any ****** *********. ** they **** ** ****** those *******, **** ** not **** *** '********', they ****** *** ****** directly. **** ** *** unique ** *********, ** that ** * *********** design ******** ** ***** services (******* ******* ** Hikvision). *******, ***** *** Chinese's **********'* *********, *** concerns *** **** ***********.

Compared ** **** ********

*******-**** *********** ***** ** **************, in **** ** ******** direct ***** ****** ** devices **** * ****** command ******. **** *************, by ********, ******** ********* issues. ** *** ***** hand, *** ******** ******** having ******* ****** ** the ****** (***** ** the ****** *** *** exposed ** *** ******** would ** *******). **** HikConnect, *** ************* *** be ******** ****** *** device *********.

Risks ** ***** ********

************, ************ ************* **** recommended **** **********, ***** has *** *********** ******** of ****** ******* ******* to ****** *******. ***** services *** **** ****** that, ** *** ****** that **** ******* **** forwarding (******, ****,********* ********* ** ********* port ***************** ********** **** **********'* ***********/*****).

*******, ** **** ******** shows, ***** ******** **** their *** *****, ** creating * ****** ***** of ******* / *************. Instead ** ****** ******* IP ********* ****** *** world, ** ******** ***** concentrate *** ******* ** a ****** ****** *** get ****** ** ******** of ********* ** *******. Stykas *** ******** *** white *** *********** *** responsibly ******** ****. ****** could ** ***** *** found **** ************* *** used ** ** ******* devices.

Comments (12)

This morning, 2 emails featuring Hikvision USA about the same time.

Special Bulletin:

And another sale:

Certainly, today's timing is coincidental but also fitting.

If I pay standard prices can I get something that is not full of security holes? Would gladly even pay a bit extra for that.

No.  All is "holy".

 

 

:)

Seems to me that cloud and security are a contradiction in terms, kind of like Hikvision and security for that matter.

I felt the heat from that one.

The picture displaying the "HACKED" cameras is a Dahua NVR, not Hikvision.

Yes, the CSO's article's picture is incorrect.

We actually emailed CSO Online when they first used the incorrect picture/labeling last fall:

They never responded to us.

Wonder why they never responded John? Seems that when a deliberate defamatory action is perpetrated, it’s just ok not to be held to account. 

Tim,

Also we actually tweeted this at / to CSO Online, see below:

Again, I think they should fix it and that they did not is definitely a mark against them.

On the other hand, as for defamation, there are plenty of Hikvision cameras that were hacked and labeled 'hacked' so it is not as if the fundamental point was bogus, just the example they used. 

I don’t disagree John, but however this is dressed up and peddled it IS defamation and they should be held to account for it.

it is either an error of uneducated stupid editors, or a calculated misrepresentation - but either way it is a wrong and defaming and certainly worthy of deeper scripting of the entire article based upun the truth that the publisher, aside from being ignorant, is also exceeding irresponsible.

You are focussed on holding publishers to account for similar articles, the fact they have purpose ignored you demonstrates their ignorance and arrogance. If you so it John, I will - they have willfully and knowingly published an wholly inaccurate and defamatory article - and not sought to correct it, thus proving their malicious intent. But hey - let’s blame Hikvision because it’s obviously their fault and that of the Chinese ownership.

Im left wondering what else these liars publish in the name of “responsible” journalism - CNN and Fox BS all over again......

 

Good find!

Continue the research and include also other vendors, I'm sure you will find more.

 

Read this IPVM report for free.

This article is part of IPVM's 6,728 reports, 907 tests and is only available to members. To get a one-time preview of our work, enter your work email to access the full article.

Already a member? Login here | Join now
Loading Related Reports