NMAPing IP Cameras
Author: Ethan Ace, Published on Mar 05, 2015
Login to read this IPVM report.
Why do I need to log in?
IPVM conducts unique testing and research funded by member's payments enabling us to offer the most independent, accurate and in-depth information.
Related Reports on ONVIF
October 2018 Camera Course
on Sep 13, 2018
Today is the last day to save $50 on the October 2018 Camera Course, register now.
This is the only independent surveillance camera course,...
Directory Of 110+ Video Management Software (VMS) Suppliers
on Aug 30, 2018
This directory provides a list of Video Management Software providers to help you see and research what options are available.
Listing...
Inputs/Outputs For Video Surveillance Guide
on Aug 24, 2018
While many cameras have Input/Output (I/O) ports, few are actually used and most designers do not even consider them. However, a good understanding...
Synology Surveillance Station VMS Tested
on Aug 22, 2018
With so many low-cost NVRs and enterprise VMSes, is there any place in the market for NAS-based VMSes?
Recently, IPVM bought a Synology NAS for...
Video Analytics Integration Guide
on Aug 16, 2018
Video analytics is hot again (at least conceptually) but integrating video analytics with VMSes can be challenging. This is especially significant...
Cut Milestone Licensing Costs 80% By Using Hikvision and Dahua NVRs (Tested)
on Aug 13, 2018
Enterprise VMS licensing can be quite expensive, with $200 or more per channel common, meaning a 100 camera system can cost $20,000 in VMS...
Milestone / Canon Spinout Arcules Cloud Launch
on Jul 30, 2018
Canon and Milestone's VSaaS Startup spinoff Arcules launched their platform at Google Cloud Next.
IPVM spoke with CEO Andreas Pettersson about the...
Eagle Eye Networks Cloud VMS Tested
on Jul 26, 2018
Eagle Eye has become one of the most significant players in the industry in the past few years:
Eagle Eye's Owner Acquired Brivo
Eagle Eye...
Replacing / Switching Access Control Systems Guide
on Jun 28, 2018
Ripping out and replacing access control systems is hard for important reasons.
Because users typically hold on to access control systems for as...
OpenEye Apex VMS Tested
on Jun 26, 2018
OpenEye is a US company, founded nearly 20 years ago. In the past few years, OpenEye has been one of a few VMS providers that have pivoted to being...
Most Recent Industry Reports
Alexa Guard Expands Amazon's Security Offerings, Boosts ADT's Stock
on Sep 21, 2018
Amazon is expanding their security offerings yet again, this time with Alexa Guard that delivers security audio analytics and a virtual "Fake...
UTC, Owner of Lenel, Acquires S2
on Sep 20, 2018
UTC now owns two of the biggest access control providers, one of integrator's most hated access control platforms, Lenel, and one of their...
BluePoint Aims To Bring Life-Safety Mind-Set To Police Pull Stations
on Sep 20, 2018
Fire alarm pull stations are commonplace but police ones are not.
A self-funded startup, BluePoint Alert Solutions is aiming to make police pull...
SIA Plays Dumb On OEMs And Hikua Ban
on Sep 20, 2018
OEMs widely pretend to be 'manufacturers', deceiving their customers and putting them at risk for cybersecurity attacks and, soon, violation of US...
Axis Vs. Hikvision IR PTZ Shootout
on Sep 20, 2018
Hikvision has their high-end dual-sensor DarkfighterX. Axis has their high-end concealed IR Q6125-LE.
Which is better?
We bought both and tested...
Avigilon Announces AI-Powered H5 Camera Development
on Sep 19, 2018
Avigilon will be showcasing "next-generation AI" at next week's ASIS GSX.
In an atypical move, the company is not actually releasing these...
Favorite Request-to-Exit (RTE) Manufacturers 2018
on Sep 19, 2018
Request To Exit devices like motion sensors and lock releasing push-buttons are a part of almost every access install, but who makes the equipment...
25% China Tariffs Finalized For 2019, 10% Start Now, Includes Select Video Surveillance
on Sep 18, 2018
A surprise move: In July, when the most recent tariff round was first announced, the tariffs were only scheduled for 10%. However, now, the US...
Central Stations Face Off Against NFPA On Fire Monitoring
on Sep 18, 2018
Central stations are facing off against the NFPA over what they call anti-competitive language in NFPA 72, the standard that covers fire alarms....
Hikvision USA Starts Layoffs
on Sep 18, 2018
Hikvision USA has started layoffs, just weeks after the US government ban was passed into law.
Inside this note, we examine:
The important...
The world's leading video surveillance information source, IPVM provides the best reporting, testing and training for 10,000+ members globally. Dedicated to independent and objective information, we uniquely refuse any and all advertisements, sponsorship and consulting from manufacturers.
Comments (10)
Eric Taylor
This is a great article. Thank you.
Create New Topic
Pat Villerot
This is a great article. I was not aware of this tool. Thank you for posting.
Create New Topic
Steve Mitchell
This article does a great service, thanks.
One thing that's been nagging at me in these various Hikvision discussions recently.. I get the feeling many people here are thinking about Hikvision cameras and what vulnerabilities may be present. Maybe because when they hear Hikvision they think "camera."
In Hikvision's statement from last year they do admit some vulnerabilities in their cameras. They talk about the default password, and telnet being available, and released new camera firmware at that time to disable telnet and enforce better password policy. In the same statement they talk about their DVR firmware--also discussing default passwords, telnet, and password policy. (I'm talking about this statement: https://ipvm-uploads.s3.amazonaws.com/uploads/8341/3f4f/HikvisionOutlinesUpdatesToSurveillanceProducts.pdf )
Of course, default passwords, weak passwords, and telnet (because it exposes passwords in the clear) could all be used to gain user or admin level access to a device. But in some cases that vulnerability may be of limited risk due to the additional need to elevate ones permissions in order to further exploit the device/network. I.e, "you can log in and change the resolution of my camera, big deal."
But the other discussions surrounding actual Hikvision exploits talk about their DVRs in particular and the RTSP buffer overflow issue (wired article: http://www.wired.com/2014/04/hikvision/ , SecurityWeek article: http://www.securityweek.com/multiple-vulnerabilities-found-hikvision-dvr-devices ). The DVRs appear to be running a linux (/dev/watchdog). And the exploits are shown to provide "full control" of the device.
I am just pointing this out because I've always felt that DVRs/NVRs are the real high risk components in a surveillance network. They tend to be more powerful devices, already hold all the video (if protecting video is your concern), tend to run a fuller linux (or Windows) command set if not running a full commodity OS and thus are at greater risk of rootkit, require more open protocol implementations for interoperability and integration, and may be based on a commodity hardware platform rather than the more exotic SoCs used in many cameras.
DVRs are big juicy targets, and are harder to protect than cameras. I suspect that's why Hikivision is in the doghouse today.
Create New Topic
Luke Maslen
Hi John, thank you for your very helpful article. For those cameras which do not offer ways to disable unnecssary ports, do you think adding rules to the firewall, to block ports on the cameras and NVR's, would be an adequate solution? Thank you.
Create New Topic
Ray Bernard
John, this is a great article. I would add one warning to it. If you run an Nmap scan on a network with older IP cameras, say cameras made before 2010, it is possible that some cameras would go offline. This wouldn't happen with Axis, Bosch, Panasonic or Sony cameras for example, but it could with popular low-cost competors. I've written about this twice in my Convergence Q&A column, as the experiences with this were classified as "incidents". In one case, relayed to me by a consulting colleague of mine, over 100 network cameras were taken offline when an IT tech did an Nmap scan. This was a deployment done in 2004. They were not PoE cameras. People had to be sent out to the camera locations to manually recycle their power. Not a fun day. I wrote about it again a couple of years later when a Nessus scan took an entire network of IP cameras offline, and it required more than just power cycling to get them back on (I don't know the technical details).
Because in each of these cases it was a practice the IT departments to periodically scan all devices on their network, ths was taken into account by adding the IP addresses of the cameras to the Do Not Scan list.
Performing both an Nmap scan and a Nessus scan - whether or not the cameras will be connected to a larger corporate network - should be a standard test before finalizing any network camera deployment.
I have had integrator techs tell me that they don't need to do that, because their cameras are on a physically independent network. However, you have to anticipate that the isolated network status could change in the future. Additionally, for deployments with older cameras that are vulnerable in this way, you have to remember that this is a security vulnerability, becasue attackers gaining access to the video network don't need a password or special skills to take the network down. They can just run the default scan.
I believe that two manufacturers involved in these incidents have since upgraded the firmware for their cameras to eliminate this vulnerabilty or fixed it in a replacement model. But it is common for deployed cameras not to get their firmware upgraded once everything is working well.
Standalone video networks still need to have securty measures in place, regardless of the age of the cameras, so that traffic from non-approved devices (such as an attacker's laptop) can't flood the network.
Create New Topic
Undisclosed Integrator #2
So I've been NMAPping the guest wifi here at Starbucks... still hasn't found anything, including my phone or the guy's laptop at the next table, but it's only 5% into the SYN scan. Neat tool, very inclusive. I've been using Advanced IP Scanner (from www.radmin.com) for a long time and will probably stick to that for finding stray network devices, like when my managed switch doesn't show up on the DHCP server, but this is definitely getting added to my toolbox for those times soemthing stonger is needed.
Create New Topic
Marc Pichaud
Very Usefull article.
Let's add that with some vendors, rtsp ports by default (factory settings) don't require credentials....so .... you can first sniff the network, get the IPs and then access video without passwords with Vlc. IF you can see the security from inside, then a physical introduction becomes very easy.. yahoo!
Create New Topic