Hikvision Discontinuing Online Service

Author: John Honovich, Published on Dec 12, 2016

Hikvision has declared it will discontinue its Hikvision online service, just days after IPVM's Hikvision Cloud Security Vulnerability Uncovered report. The abrupt move, including blocking logins in a few weeks, is troubling many dealers amidst ongoing security problems with the service.

Determined To Discontinue

Hikvision posted a 'notice' to users logging into the service declaring "all of our customers using the HiDDNS service need to migrate" and that in less than 3 weeks (Dec 30th), logins to the system will be blocked. Notice is copied below:

This has caused notable concern and confusion among Hikvision dealers.

  • No official email or announcement has been made, only the pop up notice when logging in to the system.
  • The announcement is from China / HQ and suffers from various grammatical errors making it hard to read, e.g., "As the use base continues to grow, a new platform with enhanced supporting capacity is extremely expected. To meet this certain needs..."
  • This service is important to many Hikvision dealers for facilitating remote access. The rapid 'login block' raises operational problems.

UPDATE Hikvision USA Announcement

4 days after Hikvision HQ posted their notice, Hikvision USA has released theirs. It differs in a number of material ways:

  • Hikvision USA emphasizes this as a migration in the title and opening, however the transition between the systems is completely manual, with no tools or automation to facilitate the process.
  • Also, Hikvision USA acknowledges that the "fully featured Hik-Connect platform" is not ready now and is scheduled for Q1 2017.
  • The 'login block' declaration from Hikvision HQ has been removed from Hikvision USA so it is not clear which is correct. However, Hikvision USA did emphasize that starting Dec 30th, access to Device Status and Device Management will be disabled.
  • For security, Hikvision USA indirectly acknowledged the issues with Hik-online.com, emphasizing that with the other system "Hik-Connect on AWS [they] leverage their best practices to enhance our security."

UPDATE Hikvision Corporate Change

~6 days after the initial announcement from Hikvision corporate, Hikvision has modified the 'notice' (copied above) to remove the 'login block' assertion. That has been replaced with the same language from Hikvision USA's release about blocking "access the Device Status tab or the Device Management tab." The various grammatical problems have not been corrected.

Security Problems

Get Video Surveillance News In Your Inbox
Get Video Surveillance News In Your Inbox

Hik-online.com has suffered from a number of security problems. The largest, which Hikvision has never publicly acknowledged, is a vulnerability that allowed an "attacker to remotely take over the server." That vulnerability, according to the researcher who discovered it, has been resolved.

However, a number of other vulnerabilities continue to exist. For example, the service does not use HTTPS at all, not for logging nor when logged in to one's account as shown below:

Not using HTTPS for such a service violates basic information security principles.

Moreover, Hik-online.com has a vulnerability that allows obtaining a list of all devices / IP addresses connected, including every new device added. Requests to http://www.hik-online.com/{number} are redirected to the IP address of the device, without any authentication needed. All an attacker needs to do is run a script that increments through the numbers, gathering the IP addresses connected. The gif below shows how Hik-online.com redirects from the number entered to IP addresses:

This provides a master list of probably hundreds of thousands of Hikvision devices that are publicly available on the Internet. From the testing we performed, ~3% of numbers scanned returned available Hikvision IP addresses, many of which were high numbered ports so even if dealers thought this would help obscure the devices from scanning, Hikvision's vulnerability undermines that.

Now Hikvision Wants Internal Network Access

As a replacement for this, Hikvision recommends Hik-connect (see: Hikvision Cloud Service (Ezviz / HikConnect) Tested). This service no longer needs the IP address of the Hikvision device to be made public (through port forwarding, etc.). Not making the device public is good.

However, now Hikvision will use a tunnel inside of one's internal network, through one's firewall. This will require trust that Hikvision has no security vulnerabilities in this service (a challenge given the many vulnerabilities in the current one) and that Hikvision itself will not misuse it.

"Phoning Home to China"

An increasing criticism is that Hikvision cameras are 'phoning home to China'. What is technically happening is that many new Hikvision cameras are being defaulted to automatically, and without user confirmation, phone home to Hik-connect (see Hikvision 'Phone Home' Raises Security Fears). At least for North America Hikvision devices, they are auto programmed to phone home to Amazon Web Services (AWS), though given this is the Internet, once access is established via AWS, it can be accessed from anywhere - China, Chile, Cameroon, etc.

This auto home phone 'feature' is extremely uncommon within video surveillance and none of Hikvision's major competitors (e.g., Avigilon, Axis, Bosch, Dahua, Samsung/Hanwha, Panasonic, etc., etc.) do this. Indeed, 95% of respondents say they prefer not to have any phone home feature automatically enabled (345 respondents).

Now, however, phoning home to their service is Hikvision's recommended migration path.

2016 Hikvision Challenges

Hikvision has grown phenomenally overseas in the past few years.

2015 had their first major challenge as a series of security issues, including a Hikvision engineer copying malware from an online forum into their production mobile app, shook the company.

2016's main challenge, by contrast, was people learning that Hikvision is a China state-owned company, and then having Genetec expel them, followed by a US Embassy removing Hikvision.

Now, Hikvision ends 2016 with a major challenge with its online / cloud service. The company still has immense resources from its China domestic projects plus $6 billion in recent China government funding committed. However, these continued security problems plus the China government control concerns combine for Hikvision's greatest challenge yet.

14 reports cite this report:

Hikvision Critical Cloud Vulnerability Disclosed on Apr 25, 2018
Security researchers Vangelis Stykas and George Lavdanis discovered a vulnerability in Hikvision's HikConnect cloud service that: just by...
Remote Network Access for Video Surveillance Guide on Feb 21, 2018
Remotely accessing surveillance systems is key in 2018, with more and more users relying on mobile apps as their main way of operating the system....
Hikvision Hardening Guide Recommends Port Forwarding on Jun 09, 2017
Hikvision's Network Security Hardening Guide recommends port forwarding as a 'standard configuration', highlighted below: In this note, we...
Hikvision Backdoor Confirmed on May 08, 2017
The US Department of Homeland Security's Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) has issued an advisory for...
Q1 2017 Video Surveillance Market Review on Mar 30, 2017
These are the most notable moves and events for January - March 2017 in the video surveillance market. Cybersecurity Rising Cybersecurity, once...
DDNS vs P2P vs VPN Usage Statistics on Mar 30, 2017
Cyber security concerns are escalating, even in the video surveillance industry which has historically lagged in its attention here. A key...
Hikvision OEM DDNS Devices To 'Lose Remote Access' on Feb 17, 2017
The fallout of Hikvision's DDNS discontinuation is expanding, this time hitting OEM partner Supercircuits, who reports that on June 30th: The...
Hikvision Barred From US City Housing Authority Bid on Feb 14, 2017
A US city's housing authority has barred Hikvision products from their bid, due to 'increasing security concerns.' In the past few...
Hikvision Most Polarizing Favorability Results on Jan 05, 2017
Pro or con, integrators have an opinion on Hikvision. Hikvision scored, by far, the lowest neutral levels on IPVM's favorability results,...
Suffering Criticism, Hikvision Keeps Insecure Online Service Up [Now Down] on Jan 03, 2017
Hikvision suffered severe criticisms for its abrupt plan to discontinue its Hikvision Online service, with 3 core functions to be removed on Dec...
Hikvision Sales and Support Conflict Over Discontinuation on Dec 28, 2016
Numerous Hikvision technical support employees have confirmed that the iVMS-4500 will be discontinued. Some Hikvision sales people say this is...
12 Video Surveillance Poll Results 2016 on Dec 28, 2016
IPVM has conducted more than 100 polls this year. Here are a selection of 12 of the most interesting results, receiving 4,500+ votes: Hikvision vs...
Hikvision iVMS-4500 Discontinued In Days [Says Support, Corporate Says No] on Dec 24, 2016
Hikvision's iVMS-4500 application will be discontinued in days, on December 30th, confirmed by multiple Hikvision technical support...
Hikvision Discontinued 'Migration' To Hik-Connect Tested on Dec 16, 2016
In 2 weeks, Hikvision's online service web portal will be discontinued. Hikvision has now framed it as a 'migration', though the transition will be...
Comments (38) : PRO Members only. Login. or Join.

Related Reports

"New Zealand Govt Uses Chinese Cameras Banned In US", Considers Security Audit on Oct 12, 2018
Newsroom NZ has issued a report: "NZ Govt uses Chinese cameras banned in US": This comes after the US federal government banned purchases of...
Honeywell Hides Selling US Gov Banned Chinese Video Surveillance on Oct 10, 2018
Honeywell hides selling US government banned Chinese video surveillance as their own 'Honeywell' products, deceiving buyers and putting US security...
IP Camera Installability Shootout - Avigilon, Axis, Bosch, Dahua, Hanwha, Hikvision, Uniview, Vivotek on Oct 08, 2018
What are the best and worst cameras from an installation standpoint? Which manufacturers make it harder or easier to install their cameras? We...
China Hacks Video Servers Causing Uproar on Oct 05, 2018
An incident causing an international uproar is hitting home in the video surveillance industry as a Bloomberg report, "The Big Hack: How China...
US Commerce Department Considers Sanctions Over Companies Profiting From Xinjiang on Oct 04, 2018
The US Commerce Department is considering its own sanctions for businesses alleged to be enabling repression in the Chinese region of Xinjiang...
Evidence Of Hikvision's Involvement With Xinjiang IJOP And Re-Education Camps on Oct 02, 2018
IPVM reveals as-yet unreported details about Hikvision’s activities in Xinjiang - a region of China where massive human rights abuses are being...
Genetec Takes Aim At 'Untrustworthy' 'Foreign Government-Owned Vendors' on Sep 24, 2018
Genetec is taking aim at 'untrustworthy' 'foreign government-owned vendors'. This is not a new theme for Genetec as nearly 2 years ago, Genetec...
4MP Camera Shootout - Axis, Dahua, DW, Hanwha, Hikvision, Uniview, Vivotek on Sep 24, 2018
4MP usage continues to climb, especially for low cost fixed lens models. To see who was best, we bought and tested seven 4MP models from Axis,...
SIA Plays Dumb On OEMs And Hikua Ban on Sep 20, 2018
OEMs widely pretend to be 'manufacturers', deceiving their customers and putting them at risk for cybersecurity attacks and, soon, violation of US...
25% China Tariffs Finalized For 2019, 10% Start Now, Includes Select Video Surveillance on Sep 18, 2018
A surprise move: In July, when the most recent tariff round was first announced, the tariffs were only scheduled for 10%. However, now, the US...

Most Recent Industry Reports

Hanwha Dual Imager Dome Camera Tested (PNM-7000VD) on Oct 18, 2018
Hanwha has introduced their first dual-imager model, the PNM-7000VD, a twin 1080p model featuring independently positionable sensors and a snap-in...
Camera Height / Blind Spot Added to IPVM Camera Calculator on Oct 18, 2018
IPVM has added camera height and blind spot estimation to the Camera Calculator. This is especially helpful for those who need to mount cameras up...
Axis Strong US Growth, Flat EMEA - Q3 2018 Financials on Oct 18, 2018
This spring, Axis had its best financials in many years (see Axis Strong Q2 2018 Results). However, over the summer, Axis had many products sold...
Best Alternatives to Banned Dahua and Hikvision on Oct 17, 2018
With the US government ban and a growing number of users banning Dahua and Hikvision, one key question is what to use for low cost? While Dahua and...
Video Quality / Compression Tutorial on Oct 17, 2018
While CODECs, like H.264, H.265, and MJPEG, get a lot of attention, a camera's 'quality' or compression setting has a big impact on overall...
Knightscope Winning Investors, Struggling With Growth on Oct 16, 2018
While Knightscope's new financials show the company only winning 11 new customers in the past 12 months, the company continues to win new...
Integrator Laptop Guide on Oct 16, 2018
This 18-page guide provides guidance and statistics about integrator laptop use. 150 integrators explained to IPVM in detail about their laptops,...
Huawei Admits AI "Bubble" on Oct 16, 2018
A fascinating article from the Chinese government's Global Times: Huawei’s AI ambition to reshape industries. While the Global Times talks about...
ADI's Financials Revealed + W-Box Growth Priority on Oct 15, 2018
  ADI is one of the most powerful distributors in the security industry but how big are they? How much profit do they make? How much do they sell...
Dahua Face Recognition Camera Tested on Oct 15, 2018
Dahua has been one of the industry's most vocal proponents of the value that AI creates: As part of this, Dahua has released a facial...

The world's leading video surveillance information source, IPVM provides the best reporting, testing and training for 10,000+ members globally. Dedicated to independent and objective information, we uniquely refuse any and all advertisements, sponsorship and consulting from manufacturers.

About | FAQ | Contact