NMAPing IP Cameras
By: Ethan Ace, Published on Mar 05, 2015
Read this IPVM report for free.
This article is part of IPVM's 6,378 reports, 860 tests and is only available to members. To get a one-time preview of our work, enter your work email to access the full article.
Related Reports
Hikvision UPnP Hacking Risk
on Dec 04, 2017
Hikvision IP cameras are being hacked even for end users who had not set up port forwarding and believed their cameras were 'safe' behind...
Broken Hikvision App Exposes Hypocrisy
on Dec 06, 2017
While Hikvision talks about a commitment to cybersecurity, their broken app and their insecure 'solution' exposes not only their engineering...
Hikvision VMD And Intrusion Analytics Tested
on May 04, 2018
VMD worked poorly on Hikvision cameras, new IPVM testing found.
However, Hikvision ships analytics on practically every IP camera, with intrusion...
SNMP / Network Monitoring For Surveillance
on Aug 21, 2018
Surveillance systems typically rely on the the VMS to report issues, but this most often just means knowing a camera is "down" with no warning or...
Axis Door Station A8207-VE Tested
on Aug 07, 2019
Axis newest door station, the A8207-VE, claims to deliver "video surveillance, two-way communication, and access control" in a single device. But...
Intel Meltdown / Spectre Patch Tested on Avigilon, Exacq and Milestone VMSes
on Jan 23, 2018
Significant concern exists about the impact on VMS servers and video surveillance systems of patching the Meltdown and Spectre flaws. Generally,...
LifeSafety Power NetLink Vulnerabilities And Problematic Response
on May 20, 2019
'Power supplies' are not devices that many think about when considering vulnerabilities but as more and more devices go 'online', the risks for...
How To See If Your Camera Uses Huawei Hisilicon Chips
on Aug 30, 2019
Rarely do manufacturers disclose what SoCs (System on a Chip) they use, even though it is the core of IoT devices.
Interest in this has increased...
Top Problems Searching Surveillance Video (Statistics)
on Oct 13, 2017
When crimes, accidents or incidents happen, the video surveillance system is a key component in finding out and proving what actually...
Most Recent Industry Reports
Avigilon ACC Cloud Tested
on Jul 08, 2020
Avigilon merged Blue and ACC, adding VSaaS features to its on-premise VMS, offering remote video and health monitoring that was previously limited...
The US Fight Over Facial Recognition Explained
on Jul 08, 2020
The controversy around facial recognition has grown significantly in 2020, with Congress members and activists speaking out against it while video...
Sperry West / Alibaba Tablet Temperature Measurement Tested
on Jul 07, 2020
In April, we ordered a ~$500 temperature tablet from Alibaba. We set it to the side while doing 18 other temperature screening tests but, after...
Facial Recognition: Weak Sales, Anti Regulation, No Favorite, Says Security Integrators
on Jul 07, 2020
While facial recognition has gained greater prominence, a new IPVM study of security systems integrators shows weak sales, opposition to...
Video Surveillance 101 Book Released
on Jul 07, 2020
IPVM's unique introduction to video surveillance series is now available as a 145-page eBook. Designed for managers, salespeople, and engineers new...
Startup Duranc Presents AI VSaaS
on Jul 06, 2020
Duranc presented its system at the May 2020 IPVM Startups show.
A 30-minute video from Duranc including IPVM Q&A
Background on the...
Low Voltage Nation Wants to "Help You Carve Out A Fulfilling Career" Interviewed
on Jul 06, 2020
It is difficult to make your way in this industry as there is little formal schooling. However, one person, Blake Urmos, the Founder of Low Voltage...
The Next Hot Fever Detection Trend - $100 Wall-Mounted Units
on Jul 06, 2020
The first wave of the booming fever detecting market was $10,000+ cameras, now interest for ~$2,000 tablets is high and the next big thing may be...
Cisco Meraki Unlocks IP Cameras With RTSP Tested
on Jul 06, 2020
Meraki opened up its cameras to 3rd party NVRs/VMSes by offering RTSP streaming because of "the need to solve a business problem".
We tested...
Comments (10)
Eric Taylor
This is a great article. Thank you.
Create New Topic
Pat Villerot
This is a great article. I was not aware of this tool. Thank you for posting.
Create New Topic
Steve Mitchell
This article does a great service, thanks.
One thing that's been nagging at me in these various Hikvision discussions recently.. I get the feeling many people here are thinking about Hikvision cameras and what vulnerabilities may be present. Maybe because when they hear Hikvision they think "camera."
In Hikvision's statement from last year they do admit some vulnerabilities in their cameras. They talk about the default password, and telnet being available, and released new camera firmware at that time to disable telnet and enforce better password policy. In the same statement they talk about their DVR firmware--also discussing default passwords, telnet, and password policy. (I'm talking about this statement: https://ipvm-uploads.s3.amazonaws.com/uploads/8341/3f4f/HikvisionOutlinesUpdatesToSurveillanceProducts.pdf )
Of course, default passwords, weak passwords, and telnet (because it exposes passwords in the clear) could all be used to gain user or admin level access to a device. But in some cases that vulnerability may be of limited risk due to the additional need to elevate ones permissions in order to further exploit the device/network. I.e, "you can log in and change the resolution of my camera, big deal."
But the other discussions surrounding actual Hikvision exploits talk about their DVRs in particular and the RTSP buffer overflow issue (wired article: Hackers Turn Security Camera DVRs Into Worst Bitcoin Miners Ever | WIRED , SecurityWeek article: Multiple Vulnerabilities Found in Hikvision DVR Devices | SecurityWeek.Com ). The DVRs appear to be running a linux (/dev/watchdog). And the exploits are shown to provide "full control" of the device.
I am just pointing this out because I've always felt that DVRs/NVRs are the real high risk components in a surveillance network. They tend to be more powerful devices, already hold all the video (if protecting video is your concern), tend to run a fuller linux (or Windows) command set if not running a full commodity OS and thus are at greater risk of rootkit, require more open protocol implementations for interoperability and integration, and may be based on a commodity hardware platform rather than the more exotic SoCs used in many cameras.
DVRs are big juicy targets, and are harder to protect than cameras. I suspect that's why Hikivision is in the doghouse today.
Create New Topic
Luke Maslen
Hi John, thank you for your very helpful article. For those cameras which do not offer ways to disable unnecssary ports, do you think adding rules to the firewall, to block ports on the cameras and NVR's, would be an adequate solution? Thank you.
Create New Topic
Ray Bernard
John, this is a great article. I would add one warning to it. If you run an Nmap scan on a network with older IP cameras, say cameras made before 2010, it is possible that some cameras would go offline. This wouldn't happen with Axis, Bosch, Panasonic or Sony cameras for example, but it could with popular low-cost competors. I've written about this twice in my Convergence Q&A column, as the experiences with this were classified as "incidents". In one case, relayed to me by a consulting colleague of mine, over 100 network cameras were taken offline when an IT tech did an Nmap scan. This was a deployment done in 2004. They were not PoE cameras. People had to be sent out to the camera locations to manually recycle their power. Not a fun day. I wrote about it again a couple of years later when a Nessus scan took an entire network of IP cameras offline, and it required more than just power cycling to get them back on (I don't know the technical details).
Because in each of these cases it was a practice the IT departments to periodically scan all devices on their network, ths was taken into account by adding the IP addresses of the cameras to the Do Not Scan list.
Performing both an Nmap scan and a Nessus scan - whether or not the cameras will be connected to a larger corporate network - should be a standard test before finalizing any network camera deployment.
I have had integrator techs tell me that they don't need to do that, because their cameras are on a physically independent network. However, you have to anticipate that the isolated network status could change in the future. Additionally, for deployments with older cameras that are vulnerable in this way, you have to remember that this is a security vulnerability, becasue attackers gaining access to the video network don't need a password or special skills to take the network down. They can just run the default scan.
I believe that two manufacturers involved in these incidents have since upgraded the firmware for their cameras to eliminate this vulnerabilty or fixed it in a replacement model. But it is common for deployed cameras not to get their firmware upgraded once everything is working well.
Standalone video networks still need to have securty measures in place, regardless of the age of the cameras, so that traffic from non-approved devices (such as an attacker's laptop) can't flood the network.
Create New Topic
Undisclosed Integrator #2
So I've been NMAPping the guest wifi here at Starbucks... still hasn't found anything, including my phone or the guy's laptop at the next table, but it's only 5% into the SYN scan. Neat tool, very inclusive. I've been using Advanced IP Scanner (from www.radmin.com) for a long time and will probably stick to that for finding stray network devices, like when my managed switch doesn't show up on the DHCP server, but this is definitely getting added to my toolbox for those times soemthing stonger is needed.
Create New Topic
Marc Pichaud
Very Usefull article.
Let's add that with some vendors, rtsp ports by default (factory settings) don't require credentials....so .... you can first sniff the network, get the IPs and then access video without passwords with Vlc. IF you can see the security from inside, then a physical introduction becomes very easy.. yahoo!
Create New Topic