Hikvision 'Phone Home' Raises Security Fears

Author: John Honovich, Published on Nov 10, 2016

The escalating attention towards Hikvision's China government ownership and Genetec's removal of Hikvision due to cyber security concerns has triggered increased scrutiny of Hikvision devices.

Hikvision's 'phone home' feature is raising particular fears as users evaluate Hikvision devices, attempting to understand what is happening and what risks this raise.

In this note, based on our testing, we examine how Hikvision 'phone home' works, its benefits and risks.

*** ********** ********* ****************'* ***** ********** *******************'* ******* ** ********* *** ** ***** ******** ******** *** ********* ********* ******** ** ********* devices.

*********'* '***** ****' ******* ** ******* ********** ***** ** ***** ******** Hikvision *******, ********** ** ********** **** ** ********* *** **** ***** this *****.

** **** ****, ***** ** *** *******, ** ******* *** Hikvision 'phone ****' *****, *** ******** *** *****.

[***************]

'Phone ****' - **********

**** ********* ******* *** ********* ** '***** ****' ** ********** service (*** *****, ****** ***** ** **** *** **** ** their ******** ********). *** **********, *** ********* ***** ******* (***** / **********) ******.

**** ********** ***** * ******* ***** *** * ****** ********* device ******** ** '***** ****' ** ***-*******.***:

******* *** **** ********* ** ******, ***** ********* ******* ** have ****** ***** *** / ******* ** ****** *** ********:

** **** ***** **** *** *** ****** (*****/***** ****) ******* ***** ********, ***** ****** *** *****/*** ****** (********************, **, ***.) ** ***.

Purpose - **** ***** / ****** ******

*** ******* ** **** ********, *** ** ***** ******* ** default, ** ** ******** ***** *** ******** ***** ** ***** video ********. **** ***, *** **** **** *** **** ** login ** *** ******'* *** *********, ** ******* / ****** configurations, ***. **** ****** ** ** *********'* ***** ********* ** connect ** ***** ******* **** ******* ***** **** ** *********. Indeed, ******* / ****** ***** ** *** ** *** **** common **** ****** *** *** ******* ***** *********.

******* ** *** ***** ** ****, **** ***** ******* **** services, *.*., ****** *******. *******, *** ************ / ********** ***** surveillance ***, **** ** ******. *** *******, **** *** ***** both **** ***** **** ******** ********* *** **** *** ********* off, ****** *********.

***** ********* *** ******* **** ** *** ** *** *** ******* but *** **** *** ****, **** ********** **** *** **** is ****** ***** / ****** ****** *** ******* *****. *******, **** of *** ***** *** ***** **** *******, ******* ** *** low ***** *** ***** *******, *** ***** **** ** ****** end **********.

Risk - ********* / ***** ********** ******

*** **** ** ********* ******** ***** *********** ****** ** ******* ********. Hikvision ***** *********** **** ** ******** ***** ** *** **** device ** ****** ***** ******* ****** * ***. **** ********* ******-*** ********** ***** ** **** ** ***** * ******* shell ** *****-***, ******* ********* ****** ** ** *** *******, ***** the ****** ** ** **-*** ******. **** ** * **** ** *** ******** **** **** ******, though ********* *** **** *** ** *********'* ********** *********. 

*** *** ****, ********* ********** **** *** ***** ******** **** for ***** ******** ***** ***"********** ******* ***** ****** ******, ** *** **** *** *********** ****** *****." *** ********* is **** ** ********* ****** ** ****** ***** ******* **** anywhere **** ** *** *****, **** ***** ****** ** ** via *** ****** ********.

**** **** ********* *** **** ** **** ** *********** *** many ***** *** *** ******* ** ***** ******** ****** **** find *** '***** ****' ******* ** **** ******* ** ** a ****, ** ******, *** **** ** ***** *********'* ***** ********** control.

Vote - **** ****** ** ****?

**** ** * *********** ****. *** **** ******* **** **, for ****, ************ * **** *********** ** **** ********** * security **** *** ****.

Comments (31)

********:

** ********* *** **** ************ (** ***** ********* *********) **** has **** ********** ******* ** ******* ******* *** ******* ** default ** *********?** **** ***** **** ****** ******* ***** ********* as ****.

* ** ********** **** ** ********** ***** ********* ** * company *** *** *** **** **** ********* **** ****** ***** this ******* *** *** ******** *** ******** ** ******** ***** that *** ***** ******* *** ** *** **** *** ********* know-how ** *** ** * **** ** * ******.

**********, * **** *** ****** *** ********** ******** ******** **** each ****** *** ******* ** **** ******* ** ********* ** those ************ *** ******* *** *********** ** *** ******** ******** them ** ***** ************ ** *** ******* "****** ****** ***-**".

** ***** ********* ** ******** ******* *** *** *** *** purchasers ** ***** "***-***" ***** **** ** ******* ** ***** homes ** ********** **** ******** ****.

****** ******** **** ******* ********* = ******** **** **** ****** does *** "**** * ****" **** **.

**** *** *** *** "****" ************, *** ***** *** ****, two ****** **** **'** *******/****** **** ***** ******** ******** ** default.

****'* * ******* ********* ***** ******, *** *******:

**** ******* ******* * ***** ****** *** ****************** ***** ******, ***** ** *** ********* ** *******.

****** ******** **** ******* ********* = ******** **** **** ****** does *** "**** * ****" **** **.

*** ** ******** **** ********:

****** ******** **** ******* ********** ******* ********* = ******** **** ones ** ********** ****** **** *** "**** * ****" **** me.

**** **** **** * **** *** ***?

***** *** *** ***** ** ***** **** ******** ************** ********** must ********.

********* *** **** ******* ***** ******** - ***** ******* *** the *********. **** *** ******** ** *******.

**********, * **** *** ****** *** ********** ******** ******** **** each ****** *** ******* ** **** ******* ** ********* ** those ************

* *** **** ** *** ******** * **** **** ******* at, *** ****'* *** *** *********** **** *** ************* **** it ***********. * **** **** ** ** ** *** ****** when ** ***** ** *** *** **** *** ** ****** a ****** **** ** ****.

* **** ** ***** ** *** ***** ***** **** ** information ******* ******.

***** ****** ********* ******* *** ** ******** *** ****** **** them ****** *** *** * ******* **** **** *** *****'* come ****** **.

*** ** *** ******* ******** *** **** *** ** ****** to **** **** *** ** *** **** ** *** *** habits ******** **** ** ********* **** ****** **** ******** ***** versions.

*** ** *** ******* ******** *** **** *** ** ****** to **** **** ***

***-*******/***** ** ******** ***** **** **** *** *** ** *** absolutely ** ****** ***, ** ***** ** ***** ******** ********, and *** ***** ****** ********* *'** ****. ******* *** "******" checkbox ** *** "******** ******" ***. ** ****** *** ********* cameras (** ****** ** *** **-*******), ***** ***'* **** ** option ** ****** **.

*'** *********** ******** ********* *******, *** **** ****'* ******** ** not *********, ***** ** ** ******** ******* ** *** ********.

* **** ***** ** *** ******* ***** *** **** ***** here

hik firmware

*** ***** *** ******** *** *** ***

** *** *** *** ******* ******* ** *** ********* ***** in **, *** ****** ***** *** ** **** ******** ***** are **** ***** **** **** *** ******** ******* **** ****** gray ******.

hik_disclaimer

* ** ******* ***** ******** *** ********.

**** **** ***** ****** ************* **** ** ****** **** ***** has **** ***** ** *** **** **** ** **** ****** firmware **** *** *****

******, ****'* **** * *** ********* ** *** **** ******* about. * ****** ** **** **** ******* **** ***** **** we've ******* ********* ***** ******** (*** **** ********) ********* *** the ******* **** ***** ** ********.

****, * **** * ******* ********* ***** *** *'* ****** sure * *** ***** ******* **. * ***** **** ** Wireshark ** ** ***** *** *** ** **** ******** *****, though.

*** * *** **** *** ******** ** **** ********* **** was?

** ******. **'** *********** *********/***** ******* ** ******* *********. *** shortest **** ** ******** ** *******, *** ******* *** **** several *******. *** ****** ********* **'* ******* **** ** *** in * ****** ** * *** *******.

...***** ****** ********* ******* *** ** ******** *** ****** **** them ****** *** *** * ******* **** **** *** *****'* come ****** **.

******** ** *** *** ***** ** ** ******** *** **** for *** ******* ** ****-********* *** ******* ** ***** *****.

** *** *** ***** ** ** ******** *** **** *** IOT ******* ** ****-********* *** ******* ** ***** *****.

******. *** ***** ** **** * *** ** *** ***** end ********* ******* *** ***** ******** ****** ** **** *********** internal ********. ** ***** *****, **** ***** **** ********* ****** no ******* ***** ********** ****.

*****, * ***** **'* * ***** **** ******* **** ********* users *** **** *** *** ** ***** ****.

***** *** *** ******** **** ** ** * ***** **** as ****, **** ********** *** *** **** **** ** ****** 'networking ******' *** ***** **** ******* *** ****** **** **** to ****, ******** * ** *** ****** **** ******.

*****, * ** ***** **** **** **** ** **** * better *** ** ******* ***** ******* **** ***** ****.

*** *******, *** ***** ******* ******* **** ******* ***** *** this ***** **** *** ******** ** ** **** ** *** users.

*******, *** ********* ******* **** *** **** ***********, ********** ** Hikvision ** ******* ***** ** *** **********. ** ***** ** safer ** ******* ** *** ****.

** ****** ***, ** *** ******* *** *** ***** ** the ******* **********, **** ***** ** * ***-*****. ** **** correct?

**, *** **** *************, ** ***** ** * **** *** any ****** ** '***** ****' ******* *** ************ ********** ******** it.

** **** *** ****, *** *******, ** ************ ***** **** would ***** **** ** ***** / ** ********* **** **** did *** ***** **** ** **** **** ** *********.

*** **** ******* *************, **** *** ******* ** ***** ** the ******* ********** ********* *** ****. ********, * ** **** many ******* ************* ***** *** ** *********** **** (******) ******** inside ***** ********.

*** ***** **** ***** * **** ***** ** *** ** three

***** *** ******* ********** ********** ******* ** **** **** ** you **** **** **** **** **YOUR government?

***** *** ******* ********** ********** ******* ** **** **** ** you **** **** **** **** ** *Foreign government?

** *** ***** **** ********** ****** ** ** *** ******** of ************* ******** *** *** ********?

**** ***** *** * **** **** *** **** **** ********* think ***** ** ** *****.

*****,

** ** **** ******* ******* ** ****:

********* ****** ******* *** ** ********** ***** ***** *********

**** *** ***** ****** ********* ******* ** ** ***** ******* attitudes.

**** * ****** *** ***** ***** ** *** * ****** ago ****** .

***** ** ****** ** **** ** ***** ******* *** ******* though, ** *** ***** *** ********** ****** *** **** **** about ****.

** ** * **** ******* *** **** ***** *** **********. That ****, ** ****** ** ********* ***. ** *** **** to **** * ***** ****** ** ****** **, ******* ** easy *** *** *** *****, * ***** **********.

**** ****, ** ****** ** ********* ***...

**, ***, **** **** ********...

** ** ******* ******* **** *** ****** *** ***** **** the *** **** * ****** ** *** ********.

**

*** ******* *** ******** ******* *** *** ******** ** ****** their's *** *****'* ********* ********. ** **! *** ******* ********** is ********** *** ******** ** ***** **** *** **** *** World's **** ********** ** *****... **** ***** ** ... **** .. ******** *** * ******* ** **** ** ******** **** restraint ****** *** **** **** ******* ********** **** ** ********** this ********* ***** ****.

****** **** ******* * ***. **'** ****** ** * *** world ***** *** ***** ** * **** ** **** ***'* watching *** ******** *** ***** ******** *** ********. ** **** learned **** *** *** (**?)**************** ******* ** **********. *** ********* **** **** ** *******. I ***** ********** **** **** ***** ****** ** ***** ******* upon * ******** ****** *** ***** ** ** ************* *** ...selling **? ....*********?????******??? ... ***!!??!!! ** **** *** ***** ***** ** *******'* be ***** *** ******* **** *** ***** ************ **** **** so **** ***** ** *** ************* **********. **** ****'* *** even **** ******* *********** *** ** **** **** * **** limited ** * ******** ********** ** ******* ** ****** ***** is ***** *** *** ****.

*** "***** ****" ******* ** ********** *******'* ** *** *******. that ** *** ****.. *** **** ** **** ****** ** the ***** ** **** **** **** ******** **** ********* ** the ****** ** ******** *** ****. ******* *** *** ********* to *** ***** *** ****** ************* ... *** **** ****** would *** *** ** ***** ****** ******** ** ******* *** communicating **** *** *****? ****! **** ****** **************** ** **** *********** **** *** *****

******* *** *** **** *** *****-*** ** **** ***** ****.

** **** **** * **** ******* ** * ******** ********** or ******* ** ****** *****

**** ** ** *** *****, ******(*.*., '*****') *** ******(*.*., '******') *** *** **** ****** *****. ****** ******* ** Taiwan *********, **** *** * ******** ****** ***** *****, *** a********** ***.

******* *** *** ********* ** *** ***** *** ****** ************* ... *** **** ****** ***** *** *** ** ***** ****** settings ** ******* *** ************* **** *** *****?

*****, *** ***** **** ** *** ***** ********* ******* ******* to **********, ** ** ***** ***** ** ************ *** *********** with **** '***** ****'.

****

** ** **** *** ********* ** **** ********* * ***** Ethnic ***** * *********. ***** ** ******* * ***** **** toward ********* ********** * ***** ****** **** ***** ************ ** similar ****** ******* *** ****** ******** ** ***** ************ *** in **** **** **** ** *** **** ***** *** **** intimate **** ** ***** ** **** *** ** **** ******** ATT **** *** **** ** **** ** * **********.

*** ***** ***** ****** ** **** **** **** ***** ** people **** *** ***** *** **** ** ************ *** *********** in **** ** ***'* ***** ***** ** **** ***** ***'* even **** **. *** **** *** ***** **** ************ ******* that *** **** ** *** ***** **** ******** **** *** average ******** *****'* ***** ***** ** **** ** ******** ** modify **** ** **/*** ***.

**** *****'* **** *** ***** ******. *** ****** ******* *** be ******* ***. *** ******* ** ****** *** ** * have **** ******* ***** ** ** ****** *******. *** ****** is ********** *** ****** ** ******. ** ****** *** ******* be ***** *** ****. *** **** ***, ****, *** ...

***** *** ********** ******** ** ******* ********** ********* *** ******** concerns. ****** *** ******* *** ****** **** **** **** ******** telecom ******** *** ** ***** ******* ********** ********* ** *********'* NBN.

******* ***** **** **** **** ** * ******* *****. ** may *** ** *** ****** ****** ** *****, * ******* bans ** *** ******** *** ** ***** *********. *'* ** with ****.

***, ****** *******'* ******** **** ***** ****** ** ** * don't *** ***** *******, *** ***** **'* **** ***** ******** to ********* *** ******* ******* *** ******** **** *** ***, I ***'* **** **'* *******'* ******** ** **** ** *** we ****** *** ****** *** ***. ** ** **********, ****'* my ******** ** *** ******* ***********.

** ***** **** * ********* ***** (***** ** ** ****** has ****** **** ** **** ** *** ****** ** ************ and ******* ** *** ********* ** *** ***** ******).

******** ***** ***** ** **** ******** ******

*** *** ****** ** **** ** *** **** ** * world ***** ******** ** ********* *****, ********-********* ***********, *********, *******, point-of-sale *********, *** *** ******* *** ******* * ******* ** data ***** ***** ****** ** *** ***** **** *** *****, where **’* ********** ** *** **********’* ******** *** ******** ******** forces ****** ******* ****’** ************ ** ** ******** ** ****’** commandeered ** **** ******** ******* ****** ** *** ******* **

****** ******* ****’** ************ ** ** ******** ** ****’** ************ it **** ******** ******* ****** ** *** ******* **

****, *** ******* *** ********** **** ***** ******* ******. ******* out *** *********.

*********** ****. ****** ***** * ******* ***** **** ******'* *** *******. *** *** ************* *** ******* ** *******, *** **** turning ** *** ** *** ******** ****'* ******* *** *** communications. * ****** ** ********** *** ******* ***** **** *****?

*** ******* *****'* **** **** * *** ** **** ** off, **** ****** *** ***** ***** *** *** ** ****** out ** **** *****:

**** ***+ *****, **% ** ******* ***** **** **** ****** not ** ******* ** *******. **** ** ********** ****** *********** and *************.

***** ** * ***** **** ******* ** **** ** * user ****** ** ******* ** ******** - **** **% ** integrators ********* ** ******* ** ******** ******* ****** **** (**%) of ************ *** **. ***/***, *********** ***** *** ********* *** this ******* *** ** *** **** ** ** ** *** default.

Login to read this IPVM report.
Why do I need to log in?
IPVM conducts unique testing and research funded by member's payments enabling us to offer the most independent, accurate and in-depth information.

Related Reports

China Huawei Gives France Free City Surveillance on Feb 16, 2017
China is using its financial resources again, this time in France, just a month after the Chinese government funded a $100 million security /...
Hikvision Barred From US City Housing Authority Bid on Feb 14, 2017
A US city's housing authority has barred Hikvision products from their bid, due to 'increasing security concerns.' In the past few...
Hikvision Pledges 'Never' 'Backdoors' on Jan 27, 2017
With criticisms rising, Hikvision has gone on the record publicly declaring: Hikvision never has, does or would intentionally contribute to...
Amazon Sales of Hikvision China Cameras on Jan 12, 2017
Hikvision has become widely available in the US, including on popular retail outlets like Amazon, with over 2,600 results: 4MP Hikvision outdoor...
Hikvision New R&D Base To Create 10,000+ Jobs, Says Chinese Government on Jan 10, 2017
Hikvision has secured a major new China government partnership.  In this note, we examine the official statement from the Chinese government and...
How Axis Can Beat Hikvision on Jan 09, 2017
Hikvision has rocked the industry globally, bullying former video surveillance revenue leader Axis even in the Western world. What can Axis...
Suffering Criticism, Hikvision Keeps Insecure Online Service Up [Now Down] on Jan 03, 2017
Hikvision suffered severe criticisms for its abrupt plan to discontinue its Hikvision Online service, with 3 core functions to be removed on Dec...
Hikvision Sales and Support Conflict Over Discontinuation on Dec 28, 2016
Numerous Hikvision technical support employees have confirmed that the iVMS-4500 will be discontinued. Some Hikvision sales people say this is...
China Government Funds $100 Million South American Security / Surveillance Project on Dec 27, 2016
Chinese manufacturers stand to benefit from new funding that the Chinese government is giving to a South American country for a $100+ million...
The Future of Video Surveillance Distribution on Dec 22, 2016
40+ video surveillance distributors around the world told us what they see as the present and future of distribution. The key positive: solutions....

Most Recent Industry Reports

'Dirty': Hikvision Attacks Genetec on Feb 20, 2017
Hikvision is angry at the growing public awareness that Hikvision is owned by the Chinese government. They took aim at Genetec,...
Directory of Alarm Company Brokers on Feb 20, 2017
Selling an RMR based business, such as alarm company, can be highly profitable, with acquisition prices of 36 to 48x RMR (equivalent to 3 to 4x...
Hikvision Hiring 50, Direct Out of College, Sales People on Feb 20, 2017
Hikvision is hiring 50, direct out of college, field sales people across the country. This is the next major expansion for the Chinese...
Simplisafe is 'Blowing The Doors Off' on Feb 17, 2017
The company alarm dealers love to hate, Simplisafe, is 'blowing the doors off' according to Michael Barnes, one of the top financial advisors in...
Hikvision OEM DDNS Devices To 'Lose Remote Access' on Feb 17, 2017
The fallout of Hikvision's DDNS discontinuation is expanding, this time hitting OEM partner Supercircuits, who reports that on June 30th: The...
Milestone: "Easy Money Days Are Over" on Feb 17, 2017
Contrary to IPVM's criticisms, Milestone has reaffirmed that glory days remain. But they admit that they 'easy money days are over': Are the...
Directory of Alarm Panel Manufacturers on Feb 16, 2017
Alarm panels are the central controller of intrusion systems. The following is a list of manufacturers of alarm panels. This directory only covers...
Panasonic Favorability Results on Feb 16, 2017
Panasonic is one of the largest brands in the world and a long term provider of both video surveillance imagers and cameras. But, like all...
Hikvision Silicon Valley and Canada R&D Expansion on Feb 15, 2017
After massive growth in their sales team, Hikvision is now planning to add two new R&D centers in North America. In this report we examine...

The world's leading video surveillance information source, IPVM provides the best reporting, testing and training for 10,000+ members globally. Dedicated to independent and objective information, we uniquely refuse any and all advertisements, sponsorship and consulting from manufacturers.

About | FAQ | Contact