Hikvision Anti Hacking Firmware Tested

By: Ethan Ace, Published on Jun 03, 2015

Hikvision has had historic hacking problems, with DVRs turned into Bitcoin miners, buffer overflow vulnerabilities, and finally culminating in the hacking of a Chinese province's cameras due to weak passwords.

In response to these attacks, Hikvision promised improvements to address these issues in updated firmware.

************ *** ******** ******* problems, **** **** ****** into******* ******,****** ******** ***************, *** ******* *********** in ********** ** * ******* province's ******* *** ** weak *********.

** ******** ** ***** attacks,********* ******** ************** ******* ***** ****** in ******* ********.

** ****** **** *** firmware, ******* *.*.*, ** see *** ***** ******** functioned, *** ********* *********, and what ****** **** *** firmware *** ** ********* devices ***** ******.

[***************]

Key ********

**** *** ************ ***** in *.*.* ********, ********* devices *** **** **** ****** to ** *********** ****** *** to ***** *** ******** simple ******* ********* ** internet ********* *******, ***** the ******/******** ****** * unique ******** ****** ** may ** ****. *******, some ***** *** **** strong ******** ************ ******** or result ** ********* ************* and *************** ****.

************, **** *** ********* of ******* ***** **** (and ************), ***** ***** hacking ******** *** *** less ****** ** *******, as ********* **** ** blocked ***********, ******** *** attack, *** ***** *** be ********, ****** **** time ** *****, *****, IP *********, ****** *******, etc. 

*******, *** ******* ** the **********, ***********, *** infrequently **** ****** ******** closes * ******** **** often **** ** ********* of ******** *******.

Firmware ************

*.*.* ******** ** ********* now *** ******** **** Hikvision ***'* ******* [**** no ****** *********] *** those ** ***** *******. Users ** ***** ******* should ***** ***** ********** websites.

****: ********* ********** ******* installing ***** ************* ** firmware (*.*., ******* ******* of ***** ******** *******), as **** *** ******* for ********* *******, **** different **********, ***.

Device ********** *******

*** ******* *** ******** in ******** *.*.* ** the *** ****** ********** process, ***** ****** ***** to ****** * ****** password (*** *** ********* of *********'* **** ********) before *** ****** *** be ******** ** ********* to * ***. ********* must ******* ** ***** 8 ********** *** *** a *********** ** *** types (*********, *********, *******, or ******* **********), ****** this ** ***** ********** "weak" ** *********. ** order ** ****** * "strong" ********, ***** **** use ** ***** ***** ***** of *********. 

*** ****** ********** ******* is ******** ** **** video:

**** ******** ******** ****** increases ********, *** ***** with *** *********:

********* ************* ********

*** **** ********* ***** strong *********, ********** ***** integrators, ** **** ********* documentation ** ********. **** ****** to ****** ***** ****** passwords *********, ********** **** working ** ************-**** ********, not ****** **** ***** services.

************ *** ******* ***** may **** ** **** up ********* ***** **** scheme, ***** **** *** have ********* ****** ********* it. *******, ************* *** ****** create * ******* ******* password ***** ** **** for *** ******** *** easy ** ********, ***** still ******* ***** *****, effectively ******** **** ********.

*** ******** *********

****** ** ******** ***** may ** ******** **** adding *.*.* ******* ** VMSes ***** ******** ******* passwords. ***** ***** ***** do *** ****** ******* feedback ** ** *** cameras *** *** *******, these ***** *** *** realize **** *** ***** incorrect *********. **** *** cause ********** ******** ** illegal ***** **** ** turned ** (*****).

Illegal ***** ****

******* ***** **** ****** all ****** **** ******** IP ********* ***** **** failed ***** ********. ************, emails *** ** ********* informing ************* ** ****** login ******** ** **** may **** ***** ******* such ** ******** *** reporting ********* ** *********, checking ******** ********, ***.

**** ******, ***** **** wait ** ******* ** access *** ******, ** log ** *** * different ** *******, *** disable *** **-****** *** feature.

******* ***** **** ********* are ***** ** **** video:

***** *** **** ******

***** *** ******* ******** illegal ***** **** ** they ******* ** *** a ****** ** * VMS ***** *** ******* credentials. ** *** *** attempts ** ********* *******, the ****** *** ***** its ****** ** * matter ** **** * few ******* ** ****** passwords *** *** *******. In *** *****, ********** that ********** ******* ********* ** ***** using *** ***********, *** camera *** ******* ** under *** *******.

****** *******

*******, ********* ******* ****** support **** *** ******* in *.*.*, * ******* commonly ******** ** ******* [link ** ****** *********], since ** ** *********** and *** **** ** often **** ** *******. SSH, * ******* ********, is ***** ** ***, serving **** ** *** same ********* ** ******** access ** ********, ****** it ** *********, ******* via ****** *** *** much **** ********** ** attack.

** **** *****, ** compared**** ******* ******* ******* *.*.* and *.*.*, ******* *** differences ** ****/****** ***** and ******* ********.

**** **********

*** ********** ***** ***** the ********** ** **** and ****** ***** ******* a ****** ******* *.*.* firmware *** *** ******* 5.2.x, **** ****** ****** (as **** ** *** and *****, ***** *** now ******** ** *******).

Compared ** ***** *************

********* ** *** *** first ************ ** ********* each ** ***** ******** features, *** *** ** the ***** ** ******* them. ** ******* * summary ** ******** ***** by ***** ************* *****. Readers ****** *** *** ** ****** ********* - Axis, *****, ******* ****** *** **** *******.

******* ******** * ****** activation ******* ******* ** Hikvision, ******** ** *.* *********. Users *** ******** ** ****** a ****** ******** (**** more ******* **** *********, seen *****) ****** *** camera *** ** ******** or ***** ** * VMS.

**** *** ****** ***** to ****** * **** password, *** ***** *** still ****** *** "****", effectively *** **** ** keeping *** *******. ************, before *** ******** ** created, ***** ** ******* using *** ****/**** ***********, allowing *** ****** ** be ***** ** *****.

*******, ***** **** *** include *** ****** ******** requirements, **** ********* ********** to "*****". *******, **** are *** ** *** other ************* ** ******* email ************ ** ******** failed ***** ********. ******, unlike *********, *** ****** does *** *********** ***** the ********* ** *******, allowing *** ****** ** continue.

What ** *** *****?

** ***** ********* ** Hikvision's *.*.* ******** ** enough ** ******* *******? Or **** ******** *******?

 

 

Comments (15)

nothing is going to "prevent hacking". I think they did a pretty good job of thwarting it but as long as your connected - you're not safe. Its like death - Its part of our lives so we need to accept that, take whatever precautions we can, get whatever insurance we can, hope for the best and don't dwell on it. Customers want to know that you've taken every precaution but they understand that if the Feds & banks can't keep thier systems safe, they can't expect to keep their security system 100% safe either.

Weren't they vulnerable to some pretty elementary buffer overflow attacks as well? Can't say I put much faith in them after that.

Tyler- the buffer overflow issue was corrected last year, within a week of it being reported to us (Hikvision). Hikvision has set up multiple addresses for the reporting of secuity concerns and issues. We also track US-Cert for their weekly reports of all reported security issues.

Bob

Not enough. Partially Hikvision's fault: 3 months is too long for these kinds of fixes. The rest is the industry's own fault: DVR/NVRs (and cameras) often carry the same types of security vulnerabilities as commodity IT equipment (PCs/servers) but without the standard practices or infrastructure to support regular updates that have evolved in the IT industry over the past 30+ years. Microsoft, Apple, et, al., release security patches almost monthly, and many IT shops are set up to either install these automatically or have policies to ensure that software is kept up-to-date. Our industry is somewhat proud to be "non-converged" and as such doesn't seek out the goal to keep software up-to-date or secure. Consequently, many Hikvision DVRs will forever remain unpatched.

I'd say it's a problem that extends well outside of security. So, so many people just don't appreciate the gravity of making a device accessible to every single person in the world with an IP address and hoping that it doesn't have any unknown vulnerabilities. Look at the router hacks that have happened (and are continuing to happen) for a perfect example.

Tyler, you're right, it can/does exist outside of security. It exists in any culture where systems are not regularly patched with the inevitable security fixes.

My point is for systems to be kept up-to-date and thus relatively free of known security vulnerabilities two things need to exist:

  1. The manufacturer needs to both continuously release security patches and provide mechanisms whereby patches can be easily (if not automatically) applied.
  2. The customer needs to recognize that regular updates are required to keep their system secure, and take responsibility for ensuring the updates get applied. They need to hold the manufacturer accountable, and exploit whatever facilities exist (i.e, automatic updates) to update their systems whenever possible.

Any IT culture falls somewhere in a spectrum: on one extreme they install a system and never update it, on the other extreme they continually apply updates.

The security industry tends to fall towards the former part of that spectrum. Many Hikvision customers aren’t paying attention to the security of their DVR/NVRs (or they wouldn’t let telnet run on their network), and Hikvision has not been responsible for keeping their vulnerabilities in check. I don’t believe this will change much unless the non-converged security networks take on some of the best practices that are more common on the IT network.

Your example of router vulnerabilities is a great one. But I propose that that too is mostly a problem in an environment/culture where systems are allowed to get out of date (specifically, the home/small-office environment). This culture is being ‘admin’d’ typically by non-IT person, who doesn’t even know they should be checking to ensure their network could evolve new vulnerabilities and their only recourse is to keep their router updated.

I would say that these hacks were incorrectly blamed on Hikvision. The problem was the end user not creating appropriate passwords. This update simply requires integrators and installers to do their job properly. The lockout is a nice security feature and that brings these cameras to a step more secure than most others.

No one should EVER put a system into production, let alone a security system, with default passwords in place. All it takes at that point is someone to spend 30 seconds on google and they have control of your devices.

Blaming the manufacturer for this is like blaming Ford that your car was stolen because you left it unlocked and the key in the ignition. A lot of responsibility falls to the administrator for security.

I think this got a lot of press at it was a Chinese company and that grabs headlines but Axis cameras and countless other products (both security and not) are exactly as vulnerable when the administrators don't use proper password protocols.

"Blaming the manufacturer for this is like blaming Ford that your car was stolen because you left it unlocked and the key in the ignition. A lot of responsibility falls to the administrator for security."

That's a fair point.

"but Axis cameras and countless other products (both security and not) are exactly as vulnerable when the administrators don't use proper password protocols."

Though Axis has forced setting a password upon first login for a few years, which helps to mitigate against this.

Steve- the issue in the news 3 months ago had already been addressed by prior firmware releases. This new Secure Activation process has been in development for some time and takes the security to a new level.

As this involves multiple system components, including NVRS, DVRS, IP Cameras, SADP Search Tool, iVMS-4200, 3rd party integration, etc, it is not simply something that is developed and released. We are also releasing YouTube videos to assist customers with this new process as one of many educational steps Hikvision is taking.

Best regards

Bob

Did Hikvision turn off UPnP by default in this new firmware?

What happens when the illegal lock function is triggered, other than block the offending IP?

What happens if I intentionally attempt to lockout the Admin user account? Will a VMS/DVR using the same creds lose connection too?

If so, I smell a new vulnerability.

If you can send your login attempts from the same machine/IP as the VMS, AND kill the current authorized stream(s), forcing the VMS to re-authenticate, then you should be golden.

It doesn't block the account. It blocks the IP address with too many failed login attempts.

Which could be exploited by spoofing the IP?

Ethan- the firmware is now available on the Hikvision USA website.

http://www.hikvision.com/en/us/download.asp

For other regions, please go to your regional Hikvision Website for available downloads.

Login to read this IPVM report.

Related Reports

Breaking Into A Facility Using Canned Air Tested on Jan 28, 2020
Access control is supposed to make doors more secure, but a $5 can of...
Vulnerability Directory For Access Credentials on Feb 20, 2020
Knowing which access credentials are insecure can be difficult to see,...
China DVR/NVR Backdoor Discovered, Huawei Refutes on Feb 07, 2020
A backdoor was found in Chinese-produced DVRs and NVRs that secretly allowed...
Vehicle Gate Access Control Guide on Mar 19, 2020
Vehicle gate access control demands integrating various systems to keep...
Help Security End Users Facing Coronavirus Improve Remote Access on Mar 24, 2020
Many end-users and integrators are struggling with the impact of coronavirus...
Facial Recognition 101 on Mar 18, 2020
Facial recognition interest, use and fear is increasing. This guide aims to...
Dynamic vs Static IP Addresses Tutorial on Apr 16, 2020
While many cameras default to DHCP out of the box, that does not mean you...
Access Control ADA and Disability Laws Tutorial on Feb 17, 2020
Safe access control is paramount, especially for those with...
Add Door Operators To Fight Coronavirus on Mar 31, 2020
IPVM recommends that integrators advocate and end-users consider adding door...
HID Releases Lower-Cost Signo Readers on Mar 06, 2020
HID Global is releasing a new line of readers called Signo they claim read...
Use Access Control Logs To Constrain Coronavirus on Apr 09, 2020
Access control users have included capabilities that are not commonly used...
London Live Police Face Recognition Visited on Feb 13, 2020
London police have officially begun using live facial recognition in select...
Faked Coronavirus Fever Detection, Athena Used Hikvision; Responds - Selling NDAA Compliant Cameras, Pledging 50% Of Profits to Victims on Mar 24, 2020
US company, Athena Security, faked its coronavirus fever detection marketing,...
Delayed Egress Access Control Tutorial on Feb 04, 2020
Delayed Egress marks one of the few times locking people into a building is...
Hands-Free Bathroom Doors For Coronavirus Mitigation on Apr 10, 2020
Coronavirus has increased concerns about picking up germs, especially from...

Recent Reports

Dangerous Hikvision Fever Camera Showcased by Chilean City on Aug 07, 2020
Deploying a fever camera outdoors, in the rain, with no black body, is...
"Grand Slam" For Pelco's PE Firm, A Risk For Motorola on Aug 07, 2020
The word "Pelco" and "grand slam" have not been said together for many years....
FLIR Stock Falls, Admits 'Decelerating' Demand For Temperature Screening on Aug 07, 2020
Is the boom going to bust for temperature screening? FLIR disappointed...
VSaaS Will Hurt Integrators on Aug 06, 2020
VSaaS will hurt integrators, there is no question about that. How much...
Dogs For Coronavirus Screening Examined on Aug 06, 2020
While thermal temperature screening is the surveillance industry's most...
ADT Slides Back, Disappointing Results, Poor Commercial Performance on Aug 06, 2020
While ADT had an incredible start to the week, driven by the Google...
AHJ / Authority Having Jurisdiction Tutorial on Aug 06, 2020
One of the most powerful yet often underappreciated characters in all of the...
SIA Coaches Sellers on NDAA 889B Blacklist Workarounds on Aug 05, 2020
Last month SIA demanded that NDAA 899B "must be delayed". Now that they have...
ADI Returns To Growth, Back To 'Pre-COVID Levels' on Aug 05, 2020
While ADI was hit hard in April, with revenue declining 21%, the company's...
Exposing Fever Tablet Suppliers and 40+ Relabelers on Aug 05, 2020
IPVM has found 40+ USA and EU companies relabeling fever tablets designed,...
Indian Government Restricts PRC Manufacturers From Public Projects on Aug 04, 2020
In a move that mirrors the U.S. government’s ban on Dahua and Hikvision...
Directory of 201 "Fever" Camera Suppliers on Aug 04, 2020
This directory provides a list of "Fever" scanning thermal camera providers...
Face Masks Increase Face Recognition Errors Says NIST on Aug 04, 2020
COVID-19 has led to widespread facemask use, which as IPVM testing has shown...
Dahua Loses Australian Medical Device Approval on Aug 04, 2020
Dahua has cancelled its medical device registration after "discussions" with...
Google Invests in ADT, ADT Stock Soars on Aug 03, 2020
Google has announced a $450 million investment in the Florida-based security...