Hikvision Security Code Cracked

Author: IPVM Team, Published on Aug 08, 2017

Hikvision's 'security code' feature has been cracked and a program generating security codes is being distributed online. IPVM has obtained and tested this program, verifying that it works.

Hikvision 'security code' allows unauthenticated users to access Hikvision recorders locally regardless of the admin password strength. Hikvision has used this as a tech support feature, as we covered and explained in this report.

Hikvision has historically called this 'security code' or 'security codes', e.g.:

Now, anyone with this program can generate a security code that resets the admin password and takes over the Hikvision recorder. Hikvision does not allow disabling this 'security code' feature.

Inside this note, we show how the program works, what it does and what risks it poses.

*********'* '******** ****' ******* *** **** ******* *** * ******* generating ******** ***** ** ***** *********** ******. **** *** ******** and ****** **** *******, ********* **** ** *****.

********* '******** ****' ****** *************** ***** ** ****** ********* ********* locally ********** ** *** ***** ******** ********. ********* *** **** this ** ***** ******* *******, ** ** ******* *** ********* ** **** report.

********* *** ************ ****** **** '******** ****' ** '******** *****', e.g.:

***, ****** **** **** ******* *** ******** * ******** **** that ****** *** ***** ******** *** ***** **** *** ********* recorder. ********* **** *** ***** ********* **** '******** ****' *******.

****** **** ****, ** **** *** *** ******* *****, **** it **** *** **** ***** ** *****.

[***************]

Cracked ******* ********

*** **** ********* ** *********** ** * ***** (****) ******* executable. ** **** *** ******* *** ************ *** *** ** run ******** ******* ************* ****** ** *** ******* ************. ** are *** ************ *** *******, ** ** ******** * ******** risk ** ********* *****.

** *** ******* ** *** **** *********, *** ****** **** entering *** ** ******* ** *** ********* ********:

****, **** *** ** ******* ** ******** ** ***** * Hikvision ****** *** *** ***** *** ****** ****** ** *** unit, *** *** **** *** **** ** ******** * ***** code ***. **** **** ****, *** ******** ******* * ******** code **** *** ** **** ** ***** *** ***** ********:

*** **** *** **** ** **** ** *** ********* ******* to **** *** *** ***** ******** *** *** * *** one, ** ***** ***** ** *** **** ****:

* ******* ** *** ******** ** ************ ** * ******* video:

[******] - *** ******** ****** ******* *** *****, ** *** not ******* * ***** *********** ****** *** ****** *** ***** so.

***** **** *****, *** ****** ***** *** ******* ** ******* the ****, ** ******** ***** *** ****** *****, ** ** case *** ****** **** ** *** **** *** *********.

Feedback **** ******* ******* ******

*** ****** ** *** ********,***********, **** ** *** *** ****** *** **** *** *******, but ******* ** **** ******, *** **** *********** *** *** YouTube *******. ** **** ** ** ******* ** ******** *** software ** ******* ***** ***** *** **** ********* *******, ** it ********* **** ***** *** *********. ** **** ****** **** support ********** *** ********* ****[****** - *** ****** ******* *** ******** **** ** ****].

Works ** *** *-***, ****** ***** ****

**** ******** **** *** ******** **** ***** ******* ***** ** an *** *-*** ******** ***** **-*******, ********* ******* **** *** local ******* / **** ** ***** ******** ** ***** ** the ********** *****:

** *** ****** *-*** ******** (*.*.*) *** ***** **** ******, but ******* ** *** ********* ******** ** *** ** ** entered ** *** ********* ***** *******.

** ******* **** ************** **** (** ***** ***** *** ****** **+)*** ******** ** **** ** ****.

[******: *-*** ***** **** ****.*.* ***** ****** (******** ****). *** ****** ** ******* *** **** *** **** *******.]

Benefits ** ********* ******* / ********

********* ******* *** ******** *** ****** ***** **** ******* ***** and **** ** ********* **** ******* *** ***** ******** ****** by **********, ****** **** ****** ** ******* *** **** *** Hikvision ** *******.

Benefits ** ********* ***********

********* ***********, **** *********** *** *************, *** **** *** ***** how ******** ********* ** ** ***** **** ******* ** ****** Hikvision *********. ** ***** *** * ******** **-**** *************, ********** since ********* *** ******** *** *********** ** ****** ********* **** can *** ** ****** **********.

Detrimental ** ********** ********* *****

*********'* ** *** ****** ********* ******** **** ****-****** ******* (******, Alibaba, ***.) ***** ******** *** **** ********* ** ***** ******. One ********* *********'* ********** **** ****** ** *** ******* ** get ******** ********* ******* *******, **** ** *** ***** ******** resets. ** ********* **** ****, ******* *** ******* ***** *** password ****** *** ********* ******* ******* ** ******* ********* *******, reducing ***** ********* ** *** ******* ********** ********.

Cannot ** ********

*************, *** '******** ****' ******* ** **** ***** **** ********* recorders *** ****** ** ********. ** **** ******** **** ********* if ** **** **** ***** *** **** ****** ** ***** users ** ***** **** *************.

Atypical *** ******* *************

*** ***** ******** ***** ******* ** **** ******* ** ******* companies. ***** *** * ******* '***** ********' *******, *** ** enterprising*********** ******* *** ******** ****** ******** *****, *** ********* **** ********, *******, *********, ***. ** *** allow * ****** ** **** ** ** *** ******** *** wipe *** *** ***** ******** **** ******* *****.

Cybersecurity ******** *** *********

************* *** **** ** ******* ***** *** *********. *** *********** for ***** ********* ** ** ***** ** ***, *** ******* any ********* **********, ** ** ***** ******. ****** *** ***** code ********* ****** ********* ***** *** ******* **** **** ******. Hikvision *** ************************** **** **** ************* *********, *** **** ***** ******** **** their ******** **** ***** ***** ********* ** ** ***** *** easily, *** ******* **** ********* ***** **** **** ********.

********** *********, ***** ********* ** ****** ** ****** ***** ********, view *************** **** ****** ***** ******** ****** ** ****** ***********, and **** ***** ****** *** ******* **** ****** **** **** security.

UPDATE - **** ******* ** ******** *****

**** ****, ****** *** *** ******** ** *** **** ** a ******* ********** ********* ********** ** ******** **********-***** ********, ******** of *****:

*** ******* ****** **** *** ** ***** ***** ******** *** same ****** **** * ***** ****** ******/**** ******. ****** *********** ** *** ********* **** ********* ** *** *** **** on ***** ********, *** ***** ***** **** ** **** ***** **** ** recent ******** ********, ** ** ****** ** **.*.*.

*** ******* *** ********** ***** (*** ********** *** *******-***** ****) use ** ******* ***** ***** ***** ** ***** *****, ********** some **** **** *** ******'* ****** ****** *** **** ******** is ********** ** * '***** ******', **** *** ****** ** the '***** ******' **** ********* ** ***** ********** **** *** be ******* ** * ******** ********:

Update * - ********* ******** **** "******** ***** ******"

** ****** **, ****, ********* **** * '******* ********' ***** * **** ******** ******** "********* ***/*** ******** ***** ******". ** ******** * ******* ** ******** ********** ** ******** passwords ****** ******* *********. ** **** ********* * **** **** Hikvision ********* *************** ** ** ******* *** ******* *** **** to ****** *** **** ***********.

*** ********* *****:

(*) ********* ****** ** *** ******** ***** ** "**-****** ********* 'security ****'". ** ** *****, ** *** *** **** '******** code' ******* **** ** *********'* *** **** *** **** *******, e.g., *** ******* ** ********* ********* ******* ** * '******** ****'.

(*) ********* ******* ****** *** ******** **** ***** ******** **** was *******. ****** **** ********* * ***** ******** **** ***** overcome **** *******. **** ******** ** **** ** **** ** reviewing ** ****** **** ********* *** **** ******* ** ******.

Update * - ****/*** ******** ** ********* ******** *** *** ******

*** ******** ** *********'* ******** *** **** ********:********* ******** ** ******* ******** *****

Comments (59)

Thumbnail newheadshot

Sean Nelson

Nelly Security | 08/08/17 05:28pm

* ***** ****** ** *** ******** *********** ***** ** *** best ****** ** ********* **** *****. ** ***** ** ******, effective, *** ***** ****** **** ******* ***** ** ****

Undisclosed Integrator #1

08/08/17 06:08pm

** ** *****, **** **** **** **** ******* ** *** LAN ** ** ***** * *** ** *** **** ******** as ****? * ***'* ***** *** **** **** ***** ******** but * **** ** **** **** * ********** **** **** accurately

Thumbnail brk1

Brian Karas

IPVM | In reply to Undisclosed Integrator #1 | 08/08/17 06:26pm

**** ********* ****** ** ********* *** ********* *******, ** *** are ******* ** ***** ** ** * *** (** ***).

Thumbnail brk1

Brian Karas

IPVM | 08/08/17 09:04pm

****** -

***** **** ********** ****** ** *** ******* ******* ******** *******:

*** **** ********* ** *********** ** * ***** (****) ******* executable. ** **** *** ******* *** ************ *** *** ** run ******** ******* ************* ****** ** *** ******* ************. ** are *** ************ *** *******, ** ** ******** * ******** risk ** ********* *****.

Undisclosed Integrator #2

08/08/17 09:15pm

*** *****,

*** **** **** ******* ****** **** ***"********* ******** ***** ****" that ** ********* ** *********? **** **** * *** ********* it ***** **** ** ** **** * ********* *** **** what **** **** ****** ** ***** *******.

*****://*********.***/*****/*********-********-*****-****/

Thumbnail brk1

Brian Karas

IPVM | In reply to Undisclosed Integrator #2 | 08/08/17 11:33pm

** *** **** ***** ** **** ***** **** *** *** previous ******* *** **********. **** ******** *** **** ****** **** the ****** *******/***** ** ****** ****. *** *** ******* **** they *** ********* ********* ***'* ********* *** **** *******.

*** ********* ****** *** ***** ** *** ****** ** ******* this:

UPDATE - **** ******* ** ******** *****

**** ****, ****** *** *** ******** ** *** **** ** a ******* ********** ********* ********** ** ******** **********-***** ********, ******** of *****:

*** ******* ****** **** *** ** ***** ***** ******** *** same ****** **** * ***** ****** ******/**** ******. ****** *********** ** *** ********* **** ********* ** *** *** **** on ***** ********, ***** ***** **** ** **** ***** **** ** ****** recorder ********, ** ** *** ****** ** ******* *.*.*.

*** ******* *** ********** ***** (*** ********** *** *******-***** ****) use ** ******* ***** ***** ***** ** ***** *****, ********** some **** **** *** ******'* ****** ****** *** **** ******** is ********** ** * '***** ******', **** *** ****** ** the '***** ******' **** ********* ** ***** ********** **** *** be ******* ** * ******** ********:

Undisclosed Integrator #1

In reply to Brian Karas | 08/09/17 12:32am

* ******* *** ***** ********* ** *** ***** **** *** older ******** *** ****'* **** *******. *** ***** **** ***** work ** ****?

Thumbnail brk1

Brian Karas

IPVM | In reply to Undisclosed Integrator #1 | 08/09/17 12:38am

**** *** *****, *** ********* *** ***** ** ***** **** these *****, ****** *** ****** *** ****, ** **** ***** the ***** *** ** ** **** **** *** ********* ***** console. *****, **** ****, *** ******* * ******** ****.

Thumbnail newheadshot

Sean Nelson

Nelly Security | In reply to Brian Karas | 08/09/17 01:13pm

****** ** *** ******* *********, ** ***** *** **** ********* on **** ***** ******** ******** *** ** ***** ****. ** will *** ***** ** *******.

Thumbnail brk1

Brian Karas

IPVM | In reply to Sean Nelson | 08/09/17 01:28pm

**** - *** *** ******* ******* ** **** ********/******** ******** you ******? ****, *** *** *** *** ***** ***** **** via **** ** **** **** *** ***** *******?

R OD

IPVMU Certified | In reply to Brian Karas | 08/09/17 05:33pm

*** ***** **** ***** ** *** *** ****** ** "*****" firmwares **** **** *** ****** **** **** ****** *** ** enter * ****** ****. *** ***** ********* ***'* **** *** hidden **** ** ****/****, ******* ****** *** * **** ******** file **** ** ******** ** ** ******* ****** *** ******* setup.

**** ******* * ****** ** ** * ****** **** ******** 5.4.0, * ****** **** ******** *.*.*, *** *.*.* *** **** of **** ******.

*******, ** **** ***** ******* **** ******** ***** *.*.*. * tested ** ** ** *** **-*******-* **** ******** *.*.* *** it ******.

Thumbnail brk1

Brian Karas

IPVM | In reply to R OD | 08/09/17 06:58pm

**** ******* * ****** ** ** * ******

** ********* ******** ***** ** *** ******, **** *** ******** at *********, *** *******. **** ********* **** ****** ******** ***** be ******** ***** *** ***** *********.

*******, * ******** ********* ** ** * ****** **** **** cameras *** ****. ** *** *** ********* * ********* ********, the ******* *** ********* ***** ** ** "****** **" **** a ******* ***********, *** **** ****** *** ******** **********. ************, the ******* ***** ********* *** ***** *** *****.

*** ********, *******, *** ****** *****, *** ******** ****** ** all *** ******* ********* ** **. ********* *** ********* ************** opens ** *** **** ** * **** ****** ******* ****.

Steven Burman

08/09/17 03:07pm

** ** ****, *** ** *** ** **** ************ **** a **** **** ****** * ********. * *** * ****** lose *** ******** ** ***** ***** ***** ***, *** *** factory ******** * ****-****** ***** ******* ** ** ***** ** default. *******, **** *** ****** **** ** **, *** *'* sure **** ************* ***** ** ****** **** ***.

Thumbnail brk1

Brian Karas

IPVM | In reply to Steven Burman | 08/09/17 03:20pm

*** *** ******* **** ********* ** *** *** **** ******* with * **** **** ********, ** ******* *** ***** *** XiongMai ** *** ***** ********* **** **** **** **** ********. It *** **** ***** **** **** ** *** **** ****** among ***-******* *************, *** ** ****** *** ******** ******* ********** (e.g.:a **** ******** ** *** * ***** *******) ** ***** be ********** ** ******* **** ***** ************* **** **** ********.

************, ***** ** * ********** ******* * "***** ** ********" and ** ***** ******** *****. **** * ******* *****, *** situation ****** ** **** **** *******, *** ***** ********* ******* wiping *** ****** ***** ** ****** ** *************. **** ** least ***** ** ****** ** ****** **** *** **** *** been ***********, *** ********* ***** ** ** **** ******* ****** retrieve **** **** *** **** ** ** ** ***********. ** also ******* *** *** ***** ** ******* ***, ********* ******** access ** * ****** ** ****** ****** *** **** **** makes ** **** **** ********* *** ** ******** ** ** this ******* ***** *******.

Steven Burman

08/09/17 03:27pm

***, ** ********* ** ** ****, * **** ********* ********* has ************ ******** ** ****, *******, * ******'* ** ********* to **** **** ** ***** * ******** **** *** ***-******* companies. *** * ** ****** **** *** **** ****** ** the ***** **** *** * ********* ** *** ********, *** data *** **** ******. * ***** ****, ****** **** ***** is * ********** ***** **** **** "****** **" *** "*********" is ********* *****'* ******** *** **********.

Undisclosed Integrator #3

08/09/17 03:43pm

**** **** ** ** *** ***. * ** ****** **** that **** ****** ***** *** **% ** *** ********* ******* out ** *** *****. * **** **** *********'* **** ****** to ***** ***** ******** *** ****** **** ***** *********'* ********, 5.4.x(these *** *** *******), *** ****** ********* **** ** ****** works.

** * ***** ********* ********, *** ***** **** ** ****** a *** **** **** *** ******/*** ***** **** ** * local *******, ****, **** ** **** ** ********* ***********. ********* Techsupport ***** ***** *** **** * *** **** ***** **** that *** *** ****** **** ***** ****, **** *** ***** password ***** ** *****.

********* *** **** **** **** ** ******* **** ********* ******* authoirzed ** ******* **** ** *** ****** ********* ** *******.

John Honovich

IPVM | In reply to Undisclosed Integrator #3 | 08/09/17 03:46pm

*****, ****** *** *** ********.

********* *** **** **** **** ** ******* **** ********* ******* authoirzed ** ******* **** ** *** ****** ********* ** *******.

********: *******, *** *** **** **** **** ** ****?

Myung Kim

In reply to John Honovich | 08/09/17 03:51pm

********* *** **** **** ** *********** ** *** ******** **** sold ** ***,***-** ****** *** **** *****.

**** **** **** ****** ** *********'* ***** ****** ******** ** some ****. * ***** **** ** *** *********** ** * Winic ********* ***, *** **** ******* **** **** *** **** to *****. **** **** ****** ***** ***** ** ***, *** understandable. **** ** ** **** **** ******* **** ** *** Hikvision, *** ********* *****.

Undisclosed Integrator #1

In reply to Myung Kim | 08/09/17 06:23pm

********* ******** *** ** ****** *** ****** ****** ** *** unit. ****'* *** **** ***** **.

Undisclosed Manufacturer #4

In reply to Undisclosed Integrator #3 | 08/09/17 03:55pm

** ****** *** ***** ********'* ********* *** *** ** **** a ****** *** ********* *** ***** ********, ***** **** **** a *** ****** ****** **** **** ******* ***** ***** ******. You ***** "****** ********" ** *** *** *** ** ***** a ******** **** *** *** ** ****** *** ***** ******** on *** ***** ***.

Thumbnail brk1

Brian Karas

IPVM | 08/09/17 04:21pm

****** -

***** **** ********** ****** ** *** *-*** **** ******* ** list *** ***** ****** ****** (**-*******) *** ** ******* **** ** ****** **** **** *** older ********, *** *** ***** ******* **** *** ******/****** ********, 3.4.2.

Undisclosed Integrator #1

08/09/17 06:28pm

**** ** ******** ** ***** **** *** ****. *** ****** generator *** ***** ******* *** ******** *** **** ****** *** years. ***** ******** *** ***** ****. **** * ***** **** this * *** ******** ******* *** ******* *** *** *** to ***** ******** *** ****'* *** *** ****.

*** **** ******* **** ** **** **** ******* ***** *** have ***** ********* ***** *** *** *** ******* ****'** ******* old ********, ** **** *******?

Thumbnail brk1

Brian Karas

IPVM | In reply to Undisclosed Integrator #1 | 08/09/17 07:02pm

*** **** ******* **** ** **** **** ******* ***** *** have ***** ********* ***** *** *** *** ******* ****'** ******* old ********, ** **** *******?

Undisclosed Integrator #1

In reply to Brian Karas | 08/09/17 08:20pm

***** ********* ****** *** *** **** **** *** ****** ********?

*** ****** ***** ***** **** **** ***** ******* **** ***'* upgrade ** *** ****** ******** ** ******** *********. ****'* ** to *** ***.

Undisclosed Distributor #8

In reply to Undisclosed Integrator #1 | 08/10/17 06:02am

* ******* **** ** *** ***-*** ******, *** * *** K ******, ******* *******.

**** ***** **** * *** **** ** *** ******.

Undisclosed Integrator #1

In reply to Undisclosed Integrator #1 | 08/10/17 10:30pm

**** ******** ** *****, *** **** **** ********* ** ******* hikvision ******** **** *** ****** ********? ** **** *** *-*** unit?

Thumbnail brk1

Brian Karas

IPVM | In reply to Undisclosed Integrator #1 | 08/10/17 11:38pm

***** *** *** ******/******** ******** **** ** **** **** ** successfully ******* *** ***** ******** ***** **:

********* **-******-**/** ********:

**.*.****** ******

**.*.* ***** ******

**** **-******* ********:

**.*.****** ******

** *** **** *** *** ******* ** * ******** ***** NVR *** ** *** ***, ******* ** ***** ******** *** generated **** **** ********** ** ***** ******** *****.

Undisclosed Integrator #1

In reply to Brian Karas | 08/11/17 12:26am

** ***** ** *********'* ********, *** ***** **** ****'* ******** anymore. ***** *** *** ****** ********, *** ******* *** * series ****.

*** ***** ** **** **** *** ***** ****. ******* ** longer **** **** **** ******** **** ***** *** ***** **** don't ******.

Undisclosed Integrator #5

08/09/17 07:48pm

* ***'* ******* ********* ** *** **** ************ *** *** a *** ** **** **** * ******** ******* ****** *** password *****. * **** **** ****** *** **** **** ***** when ********* *** **** ** ********* ** ** *** *** back **** *** ********* - (**** ******** **** ****** ******* manufacturers ** ****). ** * ****** ** * *********** **** running ***** ********* * **** * *** **** **** **** within *******. *** ** **** ** ** ****** (** ******** logged ** ** *** ***** ****** **** * ********** **** program) *** ****** ******* **** *** ********* ***** ** ******** then ******* ** *** ******** ******** *********. *** * ************ I **** *** **** **** ************ ** ** ***** ** I ***'* **** ** **** **** ******* ** **** ** back **** ** - *** *'* *** * **** *'* in *****! ** ** ***'* **** * ********* *****, *** reported *** *** ** * ********* *** ** ** **, but *** ******** ** *** **** ***** ********* ******* ******* the *********.

************, *** ***** *** *** **** ** ******* ***** **** this **** ******** ***********. ***** **** *** ****** ***** ** be ****** - ** **'* ******** ** ******* ****** ***** be *** *******, *** ****'* *** ****** **** * ***** person ***** **** *** ***** ******** ** **** ** *** - ******* ** *** ** ********** - *** *** ******* have *** *********.

Undisclosed Integrator #2

In reply to Undisclosed Integrator #5 | 08/09/17 08:08pm

*** ******* ***** **** **** ******** ***** ****** ** **** all *** **** ** ******* ** ** ****** ** *** LAN. **** * **** ** ****** **** ** ********* **** on *** ******** ******* **** ********* ******* * *** *** them ***. **** ** ** ********** ** ***** ************ **** have * ******** ***** ****** **** **** ** **** ** reset *** ***** ********. **** ** * ***** ** *** discussion.

Steven Burman

In reply to Undisclosed Integrator #5 | 08/09/17 08:43pm

**** ***** ***** ** ***** ************ ** *** **** ****** some ** *** ****** *** ******** ****. ** ***** ********. Being * ************ **** ******* ****** ******** ** *** ********, personal ******* ****** ** ********* ****** ** *** ******.

Undisclosed Integrator #2

In reply to Steven Burman | 08/09/17 09:46pm

* *****. *** **** ****** *** ** **** ** * large ***** ** **** ********. * **** ***** ** ******** on ********* ** ** ******** ******* **** **** *** ***** of **** ****. *** *** **** ** ****** ********* ************.

Steven Burman

In reply to Undisclosed Integrator #2 | 08/09/17 10:05pm

* ****'* ******** ** **** ****, *** ** **** ****'* readily ******** ********* ******* ***. * ****** ***'* ********** *** they *** ******* ** **** ***** ** * ******** ** low-end ** ****** ************* ******* ***** ******* **** **** ** no *****-******** ***********. *'* *** ********* ***, ***** *** ********, I ********* **** **** **** **-****** "******* ******", ****** ************ called *** ** ** ******. *** ** * ****, * grow ***** ** ****** **** ** ********* * ******** ****** portrayed ** "****** ****".

John Honovich

IPVM | In reply to Steven Burman | 08/09/17 10:20pm

******, ****** *** **** ********. * ********** **.

** *** *** ********* ******* *********, **** ** * ****** accusation. ** ************ *****, ********* *** ****** ***** ** ****, Anixter ****** ***** ** **** ****, ******** ****** ***** ** hate ****, **** ****** ***** ** **** ****, ** *** on...

*** ***** ** ***** ******* **** ****** *** ******. ** Hikvision *** *** *** ******* *** ******** *** ****, ***. are ***** ** **** *** **** ********* **** ***** *******. This ** *** * ****** ****** - ***** *** ********* far **** ****** *** ************ ****** (***** ** **** **** focuses **) **** ******* *******.

******** ** ***-*** ** ****** ************* ******* ***** ******* **** poor ** ** *****-******** ***********

*** *******,****** *** ****** ***,*** ****** ************* *** '**********'. ** *** **** *********** *** ******** ****. ** ******* not ** ** * ****, *** ******* ** '****' *** 'NeoCoolCam' ****** (** **** ** **** *** **** ***) *** because ** **** *** ******* ************** ******* *** *** ******* with ****, ** ** ** ********** ** **** **** **.

* **** **** ***** ******* *** ********* *******. ***** ** answer **** ********* ****.

******** *******

******, **** **** ** '******** *******' ************ ** *** **** IPVM ** ****** ******* ******?

Steven Burman

In reply to John Honovich | 08/09/17 10:39pm

******* ***. ** * **** ** ***** *** ***** ****** of "********" ***** ********* *************, ** * ********* ** *********** that *** ****** ** ******** *********** ** *** ***** *** outnumber ******** *********** ***** *************?

John Honovich

IPVM | In reply to Steven Burman | 08/09/17 10:48pm

******,

** **** ****** ** ******** ***** ***** *********, **** **** the ****** ** ***:

** *** ***** ** ******** ******** *** ************* ***** ********* **** ** *** ***** ** **** ***** almost *** ***** ******* ******* ** *********'* ***** ****.

Steven Burman

In reply to John Honovich | 08/09/17 11:23pm

******* **** ** **** ***** *******. ** *** ** * complete ******, *** *** * ****** ** * ****, ******* the ****** ** ********* ****** *********** ******* *** *** * most ********* ********, **** ** *** ******* **** ***** ****? My *** ********** ** **** *** **** ******* ******* *** negative ***** *** ** *********. * ***** ** *****, *** it ******'* **** ** *** ***** ****.

John Honovich

IPVM | In reply to Steven Burman | 08/09/17 11:29pm

******,

*** ***** **** *** **** "******** *******" *** *** "******** ******" ******* *********.

* **** ***** *** ******** ******** ** ******** ********* **** a ********** ****** ***** ******** **** ******* **** '******' *** 'personal *******' ***** *** **. *** *** *** ******* ** as, *** * *****, '*******'.

**** ********** **** ** ****** *** **** ** ********* *** many ********* *** ***** ** ******* *** ******** *********. *** just ******* ** *** ******** **** *** **** ** *** wrong ** **** ** *** '********' ******* ****.

* ** *** ****** *** ***** - ************ **** ********* that **** *** **** ** '********' ** ****** ******* *********?

Steven Burman

In reply to John Honovich | 08/09/17 11:55pm

******* *** ****** ** ******** *********** ** *** ***** ** heavily ******** ******** *********** ** ***** *************. *** * ********** person ***** **** ** ***** *** ****** ** ******** ******** over *** ****** ******** ** *** ****** ** ******** ****, and *** **** ** * ****** ** ******* **** *** positive / ******** ***** ** ******** ********** ***** *************. ******* that *** ****** * "********" ******** **** *** ****** *** no ***** ********** ******* *** ************ ********* *****. ** **** statement **** * ********* **** * ** "*******" ****'* ******** accurate. ******* *** ********** ****** ***** ********* *** * ******** articles ** ***** **** ** ******** ****, *** ****** *** other ******* ********* ****** **** >*/* *****, *** **** ********** person ***** ******** ******** **** *** *** ****** **** **** personal ****** ******* ****.

John Honovich

IPVM | In reply to Steven Burman | 08/10/17 12:36am

**** *** ****** * "********" ******** **** *** ****** *** no ***** ********** ******* *** ************...********* *** * ******** ******** ** ***** **** ** ******** ones

******, ** ****. ** **** *** ********* ******** ***** ** 25 ******** ***** ** ********* **** ******. ** *** **** to ********* ** **** ** ****, ** ** ** *****, do *** ******* ************* **** *** ******* *****.

**** ******, ***** **** ****, ** **** ********* ** *************, ** ** ***** **** **** ** *********, ********* **** one ****.

** ******** ** *** * ******** **** ***** *****, ** have * ******** ********** ** ***** -***** ** ****** ****** ** ********* (******* )*** * ***** ***** **** *** ******* ** ******** -********* *** ***-**** ****** ****************** *.***+ ****** ****** (****).

** **** ************ ** ******* *****.

**** ****, **** **** *** *** ** ** **/** ************ ** *****. ** ***'* **** '******' *** '********' ** 'negative' ********. *** **** ** ** ***** ********* ****** ** the ******** **********.

* **** *** *** * *** **** ******, ****** *** sheer ****** ** ******** ** *****, **** ************ ** ********* ***************** ** '******** *******'?

Undisclosed #7

In reply to Steven Burman | 08/10/17 02:53am

**** ********, ******* ******** ****** **** *** *******, *********** ********* 'numbers ** ******** *****' **** '****'... ** ** *** **** just ******* *** *** ** ** ****.

*******, ***, *** ********* ** **** ******** *** **** ******* on ******** **** **** ****-******* '****' ***** ***.

*** ** *** ****** ******* ************ ********* ********. **** ** the ********* *** '******* ** *****'.

*** ****** ****** *************** ** ******** ** ***** ****** *************** *** **** ** ****** ** ******** ** *** *** in ***** **** ******* *** ************ *******/********* ** ******** ******** exposed *************** ** ***** *** ********/********.

** * ******* *** *********** ********* ********* *********** ** ********* vulnerabilities **** * ****** ** **** - ** ****** **** it ** **** **** ******* ******** - * **** ** hard ** ******* * ***** ** **** **** *** **** majority ** **** ******* ******** ***** ********* *********** ** *************** are ********.

Steven Burman

In reply to Undisclosed #7 | 08/10/17 01:40pm

* ***** *** ****** *** ***** "** ********** **" *** "my ******* **" ** ** *****. *** **** ***** "******** down *** **** ***** ***" ** *****. * ** ***** slapstick *****. *** *'** *** ****** *** **** **** ** an *************** ******* **** * ********** ********.

Undisclosed #9

In reply to Steven Burman | 08/10/17 10:36am

*** **** *** *** ********* ** ***** ****** ******** **** would ** *** **** ** *** ***** ******** ******** ********, government *************, *** ***** ***** **** *** ******* **. *********** that ******* ***** **** ** ** **** *** ***** ********, solving *** ********** ***** ***** ****.

John Honovich

IPVM | 08/09/17 08:20pm

****: ***** ** ********** ****, ** **** ******* * *** topic -****** ******** ********, *** ** *******?

****, ** *** ******** ** *** ******* **** ***** ***** recovery ******.*** ****** ** ***** *************, ****** *** ** **** *****.

Undisclosed Manufacturer #6

08/10/17 01:30am

* ***** **** *** ***** ** **** ***** ****** ** password ******** ** ********** * **** ****. **** *** **** discussed **** ********.

**** ************* * **** ****** ****, **** *** ******* *** device, *** *********** ** *****, ** **** ** ******** *****'* get ****** ** *** ********. **** *** ** ******* ******** the *******, *** *** ******* ****** ***** **** ****** ** in *** ******* ****.

****, *** ***** ****** ***** *** ******** ****** *** **** access ** *** ****** ** ** *** ********** **********.

*** **** ***** ******** *********, **** ****** ** ********** ** requiring ******** ****** ** ***-**-****** (***) ******. * ******* ****** shouldnt ***** * ***** **** *** *******.

***** ***** ***** ** ***** ***** ********. *** **** ******** access ** ***** * ****** ******** *** * ******* ***** for ***** ***** ******.

Thumbnail small head shot

Joseph Marotta

IPVMU Certified | 08/10/17 10:05pm

********* **** **** *** ** ***** ******* ******** ********* **** issue. ** ** **** ****:

"*** ****** ** ******** ** ***** ** *** ***************** ******** from ** ***. * ****** ****** ** * **-****** ********* 'security ****' ***** '*******' *** * ********-**** ********** ******** *******."

*** ***'* ***** **** *** ********* ** ****'* *******, ** you?! :^*

Thumbnail brk1

Brian Karas

IPVM | 08/10/17 11:42pm

******:

********* *** *********, ****** *** ******** ** **, **** *** send * ******* ******** ***** ***. ** **** ******* *** report ** ******* ****:

Hikvision ******** **** "******** ***** ******"

** ****** **, ****, ********* **** * '******* ********' ***** * **** ******** ******** "********* ***/*** ******** ***** ******". ** ******** * ******* ** ******** ********** ** ******** passwords ****** ******* *********. ** **** ********* * **** **** Hikvision ********* *************** ** ** ******* *** ******* *** **** to ****** *** **** ***********.

*** ********* *****:

(*) ********* ****** ** *** ******** ***** ** "**-****** ********* 'security ****'". ** ** *****, ** *** *** **** '******** code' ******* **** ** *********'* *** **** *** **** *******, e.g., *** ******* ** ********* ********* ******* ** * '******** ****'.

(*) ********* ******* ****** *** ******** **** ***** ******** **** was *******. ****** **** ********* * ***** ******** **** ***** overcome **** *******. **** ******** ** **** ** **** ** reviewing ** ****** **** ********* *** **** ******* ** ******.

Undisclosed Manufacturer #6

08/11/17 02:43pm

*** ****** ******* ****** *** ****. *) *** ***** *** be ***** ** *** ** ****** **** **** *** *********, which ******* *** **** *******. ** ********* *****, **** ***'* want ** ****** *********** **** ***** ***** *****, *** ****** can **** ** *** *** *** *********. *) **** **** you ** **** **** * **** ***. * ******** ****** down ** ****** **** ******** **** ************** **** *** ***** you ** ******** **** **** *** ****, ***** *** ***'* know *** ******** *** **** *** **** *************. *** **** thing **** ****** ** ******* ** ** *** ********* ****/******** - ** ******* *** **** ** **...

* ******* *** ******* **** *** ***** ***** ** ***** are "*** **** *** *********" ******* **** **** *** ***** on *** ****/**** ** *** **** *** **** ****** ** 24 *****. ** ******, **** *** **********, *** ***** ** be ********* *** ***** *** * *** ****, ***** ****** it **** **** *********.

Undisclosed Integrator #10

08/14/17 12:34pm

*** *** ***** * ******* ******* ***** ***** ** ****. Nothing *** ****.

Giancarlo Favero

In reply to Undisclosed Integrator #10 | 09/08/17 06:46pm

* ***** ***%.

* ***'* ********** *** **** ****.

*** **** **** *** **** ** ****** ********** ******* ** on *** **** ***, ******* ********* *** *****.

*** *****, **** *** ********** ***** *** ******** *** **** access ** *** ***/***, *** **** ****** ** **** *********, meaningless ****** **** ****** ***** *****: **** ** ***** ***** spend **** *** ****** ******** ****. *** ***'* **** ****** to ******** ****, ****** **** *******, ******* ****, *******. **** again, ******** ** ***************** ** *** *************.

*** ***** *** **** *** **** ** ******* ** ******* from **** *********: **** **** * ****** ** **** ****** the ******** ** * ******* ******, ** *** ** ***** several ******* ***** ** **** *** ******* ** ******* ** Germany, **** *** ****!!

*.*.: ** *** ******** ******* ** ********* ************ **** *** videosurveillance ****** *** **** ****** **% ** ***** ***** ** recent ******.

* ** ********* ** ** *** ** ** **** ********** biased, *******-***** ******* **********.

**** **** ***** ********** ****.

********* ******

John Honovich

IPVM | In reply to Giancarlo Favero | 09/08/17 07:05pm

* ***'* ********** *** **** ****.

*** **** **** *** **** ** ****** ********** ******* ** on *** **** ***, ******* ********* *** *****.

***, ** ** *** ** **** * **** ** ************ ********.

*******, ** ** ********* * **** *** * **** **** Hikvision *** **** ***** **, ****'* *** ********* ******* *** code ********** ******* -********* ******** ** ******* ******** *****.

Thumbnail brk1

Brian Karas

IPVM | 08/14/17 01:02pm

****** -

** *** * ********* ****** **** **** ********* ** ****** August **** ** ******* *** ******** **** *****, *** ***** Hikvision *** ***** ** **** ** **** *********** ** ***** the ******** ****. ** **** ** ********** * *** ****** tomorrow (****** ****) **** *** ******** ** *********'* ******* ***** password ***** *******.

Thumbnail newheadshot

Sean Nelson

Nelly Security | In reply to Brian Karas | 08/14/17 02:59pm

**** ** *** *** **** *** ** ******** ***** *****. It **** ****** **** *** ********* ********* ****** ******* ** be **** ********* **** *********** ******. *********.

Undisclosed #7

In reply to Sean Nelson | 08/14/17 03:10pm

**** **** ************ ** * **********. :(

Thumbnail brk1

Brian Karas

IPVM | 08/15/17 03:53pm

Update - ****/*** ******** ** ********* ******** *** *** ******

*** ******** ** *********'* ******** *** *** *** ******** ***** method *** **** ********:********* ******** ** ******* ******** *****

Dawid Adamczyk

08/15/17 07:27pm

* ***** *** "****" *** ****. *** ** **** ***** agains *** **** ***** ******** -******* ****** ** ***** ***/*** is **** **** ****.

Robert Shih

SavvyTech Security | In reply to Dawid Adamczyk | 08/16/17 01:53pm

* **** ******* ******* *** **** ********. ********, ** **** need ******** ***** ******* *** **** *** **** * ******** recovery ****** ****'* ***** *** **** *** ****** **********. ******** access ****** **** **** ** **********. **** *****, **** ** we ** ***** ******** *****?

John Honovich

IPVM | 08/31/17 02:36pm

******: *-*** ***** **** ****.*.* ***** ****** (******** ****). *** ****** ** ******* *** **** *** **** *******.

John Honovich

IPVM | 09/08/17 01:57pm

******: ****** ********** ********* ********** ********* *** ***** ********** ** *** ******* ******** code *******:

********** *********' ********* *** ** ***** ***** *** ********* ******** code ********* ******** ** *** *************** ******** **** *******. ******** * **** **** **** **** ** ********* ****** Manager ****** *** ******** ** ******* (*****/****). **** **** ********* and ***** **** **** ******* **** ********** ** *** ********.

Login to read this IPVM report.
Why do I need to log in?
IPVM conducts unique testing and research funded by member's payments enabling us to offer the most independent, accurate and in-depth information.

Related Reports

Sony Gen 5 IP Cameras Critical Vulnerabilities on Jul 26, 2018
Cybersecurity vulnerabilities remain prevalent in video surveillance devices. Now Talos researchers have discovered multiple vulnerabilities in...
Installing Dome Cameras Indoors Guide on Jul 16, 2018
IPVM is producing the definitive series on installing surveillance cameras. This entry covers one of the most common scenarios - installing dome...
July 2018 IP Networking Course on Jul 12, 2018
Registration is closed. This is the only networking course designed specifically for video surveillance professionals.  Lots of network training...
GDPR For Access Control Guide on Jul 03, 2018
Electronic access control is common in businesses plus organizations are increasingly considering biometrics for access control. With GDPR coming...
Axis Guardian - Cloud VMS And Alarm Monitoring - Released on Jun 19, 2018
Axis has struggled to deliver a cloud-based managed service video platform. Video service providers have utilized AVHS for over a decade, and have...
Hikvision Corrects False Cybersecurity Announcement on Jun 18, 2018
Hikvision has corrected a false cybersecurity announcement that claimed a British government-sponsored program endorsed the cybersecurity of...
The Dumb Ones: PSA's Bozeman On Cybersecurity on Jun 15, 2018
The smart ones are the hundred people who flew to Denver and spent $500+ on a 1.5-day conference featuring Dahua as a 'cyber responsible partner',...
Debating Relevance of China Hacking US Navy Plans on Jun 11, 2018
"Chinese government hackers have compromised the computers of a Navy contractor, stealing massive amounts of highly sensitive data related to...
Remove Dahua and Hikvision Gov Installs Required By US House Bill Ban on Jun 06, 2018
The final released US House Bill HR 5515 verifies that it not only prohibits the purchasing of Dahua and Hikvision products, it requires removing...
Dahua's Terrible Cybersecurity, Buys Credibility From PSA And SIA on Jun 04, 2018
Dahua has a terrible cybersecurity track record. But American organizations, like the Security Industry Association (SIA) and the PSA Security...

Most Recent Industry Reports

SimpliSafe Violating California, Florida, and Texas Licensing Laws on Aug 14, 2018
IPVM has verified that DIY security system provider SimpliSafe, founded in 2006 and acquired in June of 2018 at a billion dollar valuation, is...
Cut Milestone Licensing Costs 80% By Using Hikvision and Dahua NVRs (Tested) on Aug 13, 2018
Enterprise VMS licensing can be quite expensive, with $200 or more per channel common, meaning a 100 camera system can cost $20,000 in VMS...
Nortek Sues SDS, Battle Over Unpaid Bill and Cancelled Lines on Aug 13, 2018
Nortek and SDS legal battle continues. As IPVM reported, SDS sued Nortek alleging bribery and antitrust violation. However, Wave fired back at SDS,...
Uniview Intrusion Analytics and VMD Tested on Aug 13, 2018
IPVM's IP Camera Analytics Shootout featuring Avigilon, Axis, Bosch, Dahua, Hanwha, Hikvision created some ill will with a Uniview distributor who...
ADT Employees Protest ADT CEO on Aug 10, 2018
So many ADT employees were so upset with ADT's CEO speech reported on by IPVM, that ADT's CEO was forced to send a mass email to employees to...
Axis / Avigilon Legal Battle Rises on Aug 09, 2018
In what is shaping up to be high-powered, will-not-back-down battle, Axis and Avigilon are squaring off in multiple legal contests. In 2017, IPVM...
Camera Focusing Tutorial on Aug 09, 2018
A camera's focus is fundamental to quality imaging. Mistakes can cause important problems. In this guide, we explain focus issues and proper...
Dahua Ban Response: NOT Chinese Government Owned on Aug 08, 2018
Dahua has responded to the US Congress passing a US government ban on Dahua and Hikvision's products. While Dahua offered the now standard...
Bad Move: ADT Markets Rival Amazon on Aug 08, 2018
Amazon may be lining up ADT as its next victim but ADT is happy to promote Amazon. Amazon has made major moves recently, including acquiring...

The world's leading video surveillance information source, IPVM provides the best reporting, testing and training for 10,000+ members globally. Dedicated to independent and objective information, we uniquely refuse any and all advertisements, sponsorship and consulting from manufacturers.

About | FAQ | Contact