Hikvision Anti Hacking Firmware Tested

Author: Ethan Ace, Published on Jun 03, 2015

Hikvision has had historic hacking problems, with DVRs turned into Bitcoin miners, buffer overflow vulnerabilities, and finally culminating in the hacking of a Chinese province's cameras due to weak passwords.

In response to these attacks, Hikvision promised improvements to address these issues in updated firmware.

We tested this new firmware, version 5.3.0, to see how these features functioned, any potential drawbacks, and what impact this new firmware has on Hikvision devices being hacked.

************ *** ******** ******* ********, **** **** ****** *********** ******,****** ******** ***************, *** ******* *********** ** ********** ** * ******* ********'* ******* *** ** **** *********.

** ******** ** ***** *******,********* ******** ************** ******* ***** ****** ** ******* ********.

** ****** **** *** ********, ******* *.*.*, ** *** *** these ******** **********, *** ********* *********, *** **** ****** **** *** firmware *** ** ********* ******* ***** ******.

[***************]

Key ********

**** *** ************ ***** ** *.*.* ********, ********* ******* *** much **** ****** ** ** *********** ****** *** ** ***** *** ******** simple ******* ********* ** ******** ********* *******, ***** *** ******/******** forces * ****** ******** ****** ** *** ** ****. *******, some ***** *** **** ****** ******** ************ ******** ** ****** ** increased ************* *** *************** ****.

************, **** *** ********* ** ******* ***** **** (*** ************), brute ***** ******* ******** *** *** **** ****** ** *******, as ********* **** ** ******* ***********, ******** *** ******, *** users *** ** ********, ****** **** **** ** *****, *****, IP *********, ****** *******, ***. 

*******, *** ******* ** *** **********, ***********, *** ************ **** telnet ******** ****** * ******** **** ***** **** ** ********* of ******** *******.

Firmware ************

*.*.* ******** ** ********* *** *** ******** ************* ***'* ********** ***** ** ***** *******. ***** ** ***** ******* ****** check ***** ********** ********.

****: ********* ********** ******* ********** ***** ************* ** ******** (*.*., Chinese ******* ** ***** ******** *******), ** **** *** ******* for ********* *******, **** ********* **********, ***.

Device ********** *******

*** ******* *** ******** ** ******** *.*.* ** *** *** device ********** *******, ***** ****** ***** ** ****** * ****** password (*** *** ********* ** *********'* **** ********) ****** *** camera *** ** ******** ** ********* ** * ***. ********* must ******* ** ***** * ********** *** *** * *********** of *** ***** (*********, *********, *******, ** ******* **********), ****** this ** ***** ********** "****" ** *********. ** ***** ** create * "******" ********, ***** **** *** ** ***** ***** ***** of *********. 

*** ****** ********** ******* ** ******** ** **** *****:

**** ******** ******** ****** ********* ********, *** ***** **** *** downsides:

********* ************* ********

*** **** ********* ***** ****** *********, ********** ***** ***********, ** that ********* ************* ** ********. **** ****** ** ****** ***** ****** passwords *********, ********** **** ******* ** ************-**** ********, *** ****** with ***** ********.

************ *** ******* ***** *** **** ** **** ** ********* under **** ******, ***** **** *** **** ********* ****** ********* it. *******, ************* *** ****** ****** * ******* ******* ******** ***** is **** *** *** ******** *** **** ** ********, ***** still ******* ***** *****, *********** ******** **** ********.

*** ******** *********

****** ** ******** ***** *** ** ******** **** ****** *.*.* cameras ** ***** ***** ******** ******* *********. ***** ***** ***** do *** ****** ******* ******** ** ** *** ******* *** not *******, ***** ***** *** *** ******* **** *** ***** incorrect *********. **** *** ***** ********** ******** ** ******* ***** lock ** ****** ** (*****).

Illegal ***** ****

******* ***** **** ****** *** ****** **** ******** ** ********* after **** ****** ***** ********. ************, ****** *** ** ********* informing ************* ** ****** ***** ******** ** **** *** **** other ******* **** ** ******** *** ********* ********* ** *********, checking ******** ********, ***.

**** ******, ***** **** **** ** ******* ** ****** *** camera, ** *** ** *** * ********* ** *******, *** disable *** **-****** *** *******.

******* ***** **** ********* *** ***** ** **** *****:

***** *** **** ******

***** *** ******* ******** ******* ***** **** ** **** ******* to *** * ****** ** * *** ***** *** ******* credentials. ** *** *** ******** ** ********* *******, *** ****** may ***** *** ****** ** * ****** ** **** * few ******* ** ****** ********* *** *** *******. ** *** tests, ********** **** ********** ******* ********* ** ***** ***** *** ***********, *** ****** *** blocked ** ***** *** *******.

****** *******

*******, ********* ******* ****** ******* **** *** ******* ** *.*.*, a******* ******** ******** ** *******, ***** ** ** *********** *** *** **** ** ***** open ** *******. ***, * ******* ********, ** ***** ** use, ******* **** ** *** **** ********* ** ******** ****** is ********, ****** ** ** *********, ******* *** ****** *** and **** **** ********** ** ******.

** **** *****, ** ************ ******* ******* ******* *.*.* *** *.*.*, ******* *** *********** ** open/closed ***** *** ******* ********.

**** **********

*** ********** ***** ***** *** ********** ** **** *** ****** ports ******* * ****** ******* *.*.* ******** *** *** ******* 5.2.x, **** ****** ****** (** **** ** *** *** *****, which *** *** ******** ** *******).

Compared ** ***** *************

********* ** *** *** ***** ************ ** ********* **** ** these ******** ********, *** *** ** *** ***** ** ******* them. ** ******* * ******* ** ******** ***** ** ***** manufacturers *****. ******* ****** *** *** ** ****** ********* - ****, *****, ******* ****** *** **** *******.

******* ******** * ****** ********** ******* ******* ** *********, ******** in 2.x *********. ***** *** ******** ** ****** * ****** ******** (**** more ******* **** *********, **** *****) ****** *** ****** *** be ******** ** ***** ** * ***.

**** *** ****** ***** ** ****** * **** ********, *** users *** ***** ****** *** "****", *********** *** **** ** keeping *** *******. ************, ****** *** ******** ** *******, ***** is ******* ***** *** ****/**** ***********, ******** *** ****** ** be ***** ** *****.

*******, ***** **** *** ******* *** ****** ******** ************, **** passwords ********** ** "*****". *******, **** *** *** ** *** other ************* ** ******* ***** ************ ** ******** ****** ***** attempts. ******, ****** *********, *** ****** **** *** *********** ***** the ********* ** *******, ******** *** ****** ** ********.

What ** *** *****?

** ***** ********* ** *********'* *.*.* ******** ** ****** ** prevent *******? ** **** ******** *******?

 

 

Comments (15)

Meghan Uhl

06/03/15 07:29pm

nothing is going to "prevent hacking". I think they did a pretty good job of thwarting it but as long as your connected - you're not safe. Its like death - Its part of our lives so we need to accept that, take whatever precautions we can, get whatever insurance we can, hope for the best and don't dwell on it. Customers want to know that you've taken every precaution but they understand that if the Feds & banks can't keep thier systems safe, they can't expect to keep their security system 100% safe either.

Steve Nauman

06/03/15 09:00pm

Weren't they vulnerable to some pretty elementary buffer overflow attacks as well? Can't say I put much faith in them after that.

Bob Germain

In reply to Steve Nauman | 06/07/15 12:53am

Tyler- the buffer overflow issue was corrected last year, within a week of it being reported to us (Hikvision). Hikvision has set up multiple addresses for the reporting of secuity concerns and issues. We also track US-Cert for their weekly reports of all reported security issues.

Bob

Steve Mitchell

06/03/15 10:10pm

Not enough. Partially Hikvision's fault: 3 months is too long for these kinds of fixes. The rest is the industry's own fault: DVR/NVRs (and cameras) often carry the same types of security vulnerabilities as commodity IT equipment (PCs/servers) but without the standard practices or infrastructure to support regular updates that have evolved in the IT industry over the past 30+ years. Microsoft, Apple, et, al., release security patches almost monthly, and many IT shops are set up to either install these automatically or have policies to ensure that software is kept up-to-date. Our industry is somewhat proud to be "non-converged" and as such doesn't seek out the goal to keep software up-to-date or secure. Consequently, many Hikvision DVRs will forever remain unpatched.

Steve Nauman

In reply to Steve Mitchell | 06/04/15 12:37pm

I'd say it's a problem that extends well outside of security. So, so many people just don't appreciate the gravity of making a device accessible to every single person in the world with an IP address and hoping that it doesn't have any unknown vulnerabilities. Look at the router hacks that have happened (and are continuing to happen) for a perfect example.

Steve Mitchell

In reply to Steve Nauman | 06/04/15 04:59pm

Tyler, you're right, it can/does exist outside of security. It exists in any culture where systems are not regularly patched with the inevitable security fixes.

My point is for systems to be kept up-to-date and thus relatively free of known security vulnerabilities two things need to exist:

  1. The manufacturer needs to both continuously release security patches and provide mechanisms whereby patches can be easily (if not automatically) applied.
  2. The customer needs to recognize that regular updates are required to keep their system secure, and take responsibility for ensuring the updates get applied. They need to hold the manufacturer accountable, and exploit whatever facilities exist (i.e, automatic updates) to update their systems whenever possible.

Any IT culture falls somewhere in a spectrum: on one extreme they install a system and never update it, on the other extreme they continually apply updates.

The security industry tends to fall towards the former part of that spectrum. Many Hikvision customers aren’t paying attention to the security of their DVR/NVRs (or they wouldn’t let telnet run on their network), and Hikvision has not been responsible for keeping their vulnerabilities in check. I don’t believe this will change much unless the non-converged security networks take on some of the best practices that are more common on the IT network.

Your example of router vulnerabilities is a great one. But I propose that that too is mostly a problem in an environment/culture where systems are allowed to get out of date (specifically, the home/small-office environment). This culture is being ‘admin’d’ typically by non-IT person, who doesn’t even know they should be checking to ensure their network could evolve new vulnerabilities and their only recourse is to keep their router updated.

Undisclosed End User #2

In reply to Steve Mitchell | 06/04/15 05:10pm

I would say that these hacks were incorrectly blamed on Hikvision. The problem was the end user not creating appropriate passwords. This update simply requires integrators and installers to do their job properly. The lockout is a nice security feature and that brings these cameras to a step more secure than most others.

No one should EVER put a system into production, let alone a security system, with default passwords in place. All it takes at that point is someone to spend 30 seconds on google and they have control of your devices.

Blaming the manufacturer for this is like blaming Ford that your car was stolen because you left it unlocked and the key in the ignition. A lot of responsibility falls to the administrator for security.

I think this got a lot of press at it was a Chinese company and that grabs headlines but Axis cameras and countless other products (both security and not) are exactly as vulnerable when the administrators don't use proper password protocols.

John Honovich

IPVM | In reply to Undisclosed End User #2 | 06/04/15 05:19pm

"Blaming the manufacturer for this is like blaming Ford that your car was stolen because you left it unlocked and the key in the ignition. A lot of responsibility falls to the administrator for security."

That's a fair point.

"but Axis cameras and countless other products (both security and not) are exactly as vulnerable when the administrators don't use proper password protocols."

Though Axis has forced setting a password upon first login for a few years, which helps to mitigate against this.

Bob Germain

In reply to Steve Mitchell | 06/07/15 01:04am

Steve- the issue in the news 3 months ago had already been addressed by prior firmware releases. This new Secure Activation process has been in development for some time and takes the security to a new level.

As this involves multiple system components, including NVRS, DVRS, IP Cameras, SADP Search Tool, iVMS-4200, 3rd party integration, etc, it is not simply something that is developed and released. We are also releasing YouTube videos to assist customers with this new process as one of many educational steps Hikvision is taking.

Best regards

Bob

Undisclosed Integrator #1

06/03/15 11:18pm

Did Hikvision turn off UPnP by default in this new firmware?

Thumbnail image

Jon Dillabaugh

Pro Focus LLC | 06/05/15 03:58am

What happens when the illegal lock function is triggered, other than block the offending IP?

What happens if I intentionally attempt to lockout the Admin user account? Will a VMS/DVR using the same creds lose connection too?

If so, I smell a new vulnerability.

Chris Dearing

IPVMU Certified | In reply to Jon Dillabaugh | 06/05/15 04:37am

If you can send your login attempts from the same machine/IP as the VMS, AND kill the current authorized stream(s), forcing the VMS to re-authenticate, then you should be golden.

David Oleksy

In reply to Jon Dillabaugh | 06/06/15 10:59pm

It doesn't block the account. It blocks the IP address with too many failed login attempts.

Thumbnail image

Jon Dillabaugh

Pro Focus LLC | In reply to David Oleksy | 06/07/15 12:27am

Which could be exploited by spoofing the IP?

Bob Germain

06/05/15 11:24am

Ethan- the firmware is now available on the Hikvision USA website.

http://www.hikvision.com/en/us/download.asp

For other regions, please go to your regional Hikvision Website for available downloads.

Login to read this IPVM report.
Why do I need to log in?
IPVM conducts unique testing and research funded by member's payments enabling us to offer the most independent, accurate and in-depth information.

Related Reports

Cybersecurity for IP Video Surveillance Guide on May 18, 2018
Keeping surveillance networks secure can be a daunting task, but there are several methods that can greatly reduce risk, especially when used in...
Dahua 12MP Fisheye Camera Tested (NK8BR4) on May 16, 2018
Continuing our coverage of 12MP sensor fisheye cameras, we bought and tested the Dahua NK8BR4, examining: Default vs. Optimized...
Worst Manufacturer Technical Support 2018 on May 16, 2018
5 manufacturers stood out as providing the worst technical support to 190+ integrators in new IPVM results. These integrators answered: In the...
Hikvision Source Code Transparency Center Examined on May 14, 2018
Following criticism of Hikvision's Chinese government ownership and Hikvision's IP camera backdoor, the company has responded with a series of...
Axis 12MP Stereographic Camera Tested (M3058-LVE) on May 10, 2018
Axis has released the M3058-PLVE, a 12MP sensor, stereographic panoramic camera and Axis' first with integrated IR claiming images "sharp to the...
N3N "Truly Open Visualization Platform For Physical Security" Profile on May 09, 2018
A Cisco-backed startup, N3N, claims to deliver "the world’s first and only truly open visualization platform for physical security." The company...
S2 Access Control / 'Unified Security Management' Profile on May 08, 2018
In our 13th access control company profile, we examine S2 Security's Netbox platform: Unified Security Management Platform positioning Core...
Vivotek 12MP Fisheye Camera Tested (FE9391-EV) on May 08, 2018
Next in our 12MP fisheye camera evaluation, we bought and tested Vivotek's latest generation FE9391-EV, a new model claiming improved smart IR...
Hikvision VMD And Intrusion Analytics Tested on May 04, 2018
VMD worked poorly on Hikvision cameras, new IPVM testing found. However, Hikvision ships analytics on practically every IP camera, with intrusion...
JCI / Tyco VideoEdge NVR Profile on May 03, 2018
JCI (formerly Tyco) is one of the largest players in the global security industry, both as a manufacturer and an integrator. The company's most...

Most Recent Industry Reports

Stealth / UCIT - Remote Video Monitoring Provider Profile on May 18, 2018
Can 2 remote video monitoring companies, Stealth Monitoring from the US and UCIT from Canada combine to impact the market and compete in a changing...
Cybersecurity for IP Video Surveillance Guide on May 18, 2018
Keeping surveillance networks secure can be a daunting task, but there are several methods that can greatly reduce risk, especially when used in...
Forced Entry / Duress Access Tutorial on May 17, 2018
Even though access control normally keeps people safe, tragedies have revealed a significant issue. If users are forced to unlock doors for...
ADT Stock Drops 50% Since IPO on May 17, 2018
It has been a brutal 4 months for ADT. They first expected to IPO at ~$18. They IPOed at $14, dropping immediately to $12.39 And now, not even...
Dahua 12MP Fisheye Camera Tested (NK8BR4) on May 16, 2018
Continuing our coverage of 12MP sensor fisheye cameras, we bought and tested the Dahua NK8BR4, examining: Default vs. Optimized...
Worst Manufacturer Technical Support 2018 on May 16, 2018
5 manufacturers stood out as providing the worst technical support to 190+ integrators in new IPVM results. These integrators answered: In the...
Installing Cameras in Plenums Tutorial on May 15, 2018
There is often confusion about plenum ceilings, with misinformation about what is required when running cables through them and mounting cameras...
Top Benefits Of Attending Trade Shows (Statistics) on May 15, 2018
150 integrators told IPVM: What are the top benefits of going to trade shows? The clear top 2 responses in order: (1) Networking (2) New...
Measuring For Security Installation Guide on May 15, 2018
Accurate measurement is a fundamental skill, yet many installers do not know how to do it. Using these tools are a key skill needed for security...
Arecont Files Ch.11, Agrees To Sell To Turnaround Specialist on May 14, 2018
The long-anticipated sale of Arecont Vision is finally happening. After raising $80 million in debt in 2014, a failed sale in 2017 and the...

The world's leading video surveillance information source, IPVM provides the best reporting, testing and training for 10,000+ members globally. Dedicated to independent and objective information, we uniquely refuse any and all advertisements, sponsorship and consulting from manufacturers.

About | FAQ | Contact