Hikvision Trojan Mobile App

I read about this Xcodeghost malware over on macrumors.com a couple days back. Good catch on the Hikvision IVMS being hacked, I did not see that on the list of applications. Some other applications that are commonly used such as CamCard and Mercury were hit as well. There is a full list on in the link above.

This is caused by developers downloading XCode versions off of third party servers rather than Apple official servers. The way Apple hosts this overseas is apparently too slow for developers to wait for so they download from third party sites. Bad move.

I'm really surprised by the number of voters saying this will impact Hikvision significantly, or even moderately. If past history of hacking and holes in the security industry tells us anything, in two weeks, no one will remember.

John, you have right to think that this should be an issue, it was sloppy and reckless on Hikvision's part.

But I am still unsure how you feel this will actually affect Hik mid-term or long-term.

Here's the thing about hacks. No one gives a crap without real victims.

Think about it, the last Hikvision hack was published in Nov, detailing three buffer flow vulnerabilities found that allowed anyone access to Hik recorders.

No one cared for 3 months! Then only because a Chinese province cried "We got hacked!" did it finally get some press. Ironically, the province may have been 'hacked' only because of the default password not being changed, but again because there were 'victims' everyone remembers.

Take the trendnet example, obvious victim "Baby", result huge press coverage.

Where are the victims here that will cry out for justice? Otherwise it's just blah, blah, hack, not me, blah, blah to most.

Based on this thread it sounds like a rough ASIS is in store for Hikvision.

After publishing this post, a Hikvision employee lept to the defense of his employer:

What nonsense. Hikvision uploaded the malicious code. If Hikvision did not do this, there would have been no hack. For example, why were the Axis, Avigilon, ACTi, etc. apps not hacked? Because those companies did not submit trojan apps.

This compounds the problem. Is Hikvision going to take responsibility for these serial hacks or is everything someone else's fault?

Prediction: Hik will hire some form of 'cyber expert' whose name they will parade around in media press releases to make a show of 'taking this stuff seriously', etc etc

Besides DVtel are any other VMS/camera manufacturers activity promoting network security as part of there IP video solutions?

For your information

HIK has new App Ver 4.2.1

That was fast

Some Chinese firms had said they were pushed to download Apple's developer toolkit from unofficial sources in China because of the slow internet speeds when connecting to international services."

I wonder if the Chinese goverment has "slow internet speeds" when they are hacking other goverments?

Probably the mobile development was outsourced or had 1 or 2 engineers hired specifically for the project - since the language and technology were not in the core skills of the engineering team. But yes, using an IDE from an unknown source was a very naive move. Lesson learned: have strict policies on using illegal/unknown sourced softwares, even for outsourced teams. But Apple should also face it's own daemons for not having the IDE signature marked and checked on every uploaded app, they must be rushing to solve this.

About the previous Hikvision scandal: IMO, as a software engineer, I can assure you that security is not a big concern in surveillance products as expected in the comments above. Usually, the main concern is the functionality itself, and engineering aspects like security are left aside.

IP cameras and DVRs have big security flaws, that can get a lot worse the cheaper they are. Passwords are sent without any protection. SSL/encryption is rarely used, and rarely a default setting. When used, it covers only HTTP, not the RTSP port. Standalone DVRs and NVRs use proprietary protocols, developed from scratch for their desktop and ActiveX(!) client softwares, full of flaws, very easy to reverse engineer and hack. It's a honey pot for an experienced hacker to run buffer overflow attacks. Closing a telnet port and asking for a proper password doesn't solve any of these, there is much more under the hood.

I would say that hacking a cheap DVR can be done a lot of times in a period of 6 months. I'm not sure that this should be used as a metric to compare Hikvision and other companies. I've already analyzed Dahua's and many other Chinese DVRs / cameras, they fall into the same problems. With proper effort, even big player's products can be hacked too (hardware from Axis, Sony, Samsung, etc and VMSes from Genetec, Milestone, etc).

Is this a new aspect for IPVM to cover in it's tests? Evaluate low level security for surveillance equipments and VMS softwares? These would help to raise the market standards.

But please, do not expect top notch security when buying cheap from China or reseller brands.

You get what you pay for.. When your R and D department is using knock off xcode how can you be sure anthing is engineered correctly!

These are really interesting poll results. With 257 votes, there's no clear “winner”.

I’m not sure how legitimate this article is, but it proved to be an interesting read. I’m no conspiracy theorist, but I wonder if the NSA has ever attempted to collect personal data using this tactic.

Based on this thread, I think a lot of people don't care!

Based on this thread, I think a lot of people care a lot about not caring.

John. I am concerned that the basic chipsets may contain some kind of Trojan... or at minimum, a vulnerability that someone knows about because they planted it there only to exploit the vulnerability THEN insert some kind of malicious program.

What is your opinion?

My specs usually are worded in a way that no one has proposed HV, but could if they want. Should this make me add spec verbiage that restricts products from China? Or for me to have the integrator replace any cameras for xxx years if such a vulnerability is discovered at some time in the future? Some of my projects are quite sensitive and high risk (as I am sure others in the membership have). They include corporate, institutional, and government jobs with a high potential for this kind of sophisticated attack. Not a good thing if the same camera system I design can be used to peek at manufacturing processes or trade secrets or research in progress; or be used as a back door to access the Client’s network.

Do you recall many years ago when the smoke detector was actually CAUSING Fires? This seems like the same thing… or at least will have the same results (i.e. not allowing HV on my projects)

Is there a testing agency that could test for security vulnerabilities?