Hikvision Trojan Mobile App

I read about this Xcodeghost malware over on macrumors.com a couple days back. Good catch on the Hikvision IVMS being hacked, I did not see that on the list of applications. Some other applications that are commonly used such as CamCard and Mercury were hit as well. There is a full list on in the link above.

This is caused by developers downloading XCode versions off of third party servers rather than Apple official servers. The way Apple hosts this overseas is apparently too slow for developers to wait for so they download from third party sites. Bad move.

In the absence of any material harm coming from this, i.e. people's bank accounts being emptied, no one will remember this.

What Hik is saying is that for three weeks anyone who downloaded IVMS got the malware app. Just to make clear, the IVMS malware version of the app does not have access to everything on your IOS device.

In fact it only has access to what IVMS has access to. So your email account, maybe your photos, whatever personal information you put in IVMS.

Of course it can try to Trojan you by prompting you for ICloud credentials or even credit cards, bank accounts etc and if you type them in, that could be bad. But commercial users are generally more savvy than that, that and the 3 week window limits the real-world damage.

Also, Apple is to blame as much as the others here because they accepted apps built by a modified version of the tool. Hik of course is negligent by not using the right one, but somehow the signature was hacked enough to fool Apple into believing it was built by the authentic tool.

I voted moderately, because it will linger for me. I had the app installed on my phone and had a mini freak out when I first saw the news. Now that I know that I probably wasn't exposed, I never used the app in the past six months, never had a popup, I'm not as worried.

However, it has greatly diminished my trust in Apple. They have touted their superiority due to stringent App Store regulations. They, I won't forgive as quickly.

John, you have right to think that this should be an issue, it was sloppy and reckless on Hikvision's part.

But I am still unsure how you feel this will actually affect Hik mid-term or long-term.

Here's the thing about hacks. No one gives a crap without real victims.

Think about it, the last Hikvision hack was published in Nov, detailing three buffer flow vulnerabilities found that allowed anyone access to Hik recorders.

No one cared for 3 months! Then only because a Chinese province cried "We got hacked!" did it finally get some press. Ironically, the province may have been 'hacked' only because of the default password not being changed, but again because there were 'victims' everyone remembers.

Take the trendnet example, obvious victim "Baby", result huge press coverage.

Where are the victims here that will cry out for justice? Otherwise it's just blah, blah, hack, not me, blah, blah to most.

Based on this thread it sounds like a rough ASIS is in store for Hikvision.

Besides DVtel are any other VMS/camera manufacturers activity promoting network security as part of there IP video solutions?

For your information

HIK has new App Ver 4.2.1

That was fast

From Reuters

"An Apple spokeswoman did not respond to questions about the app approval process and why developers in China were using unofficial Xcode, but a senior executive said on Tuesday the company would make it easier for Chinese developers to download its tools.

Marketing chief Phil Schiller told Chinese news site Sina.com it would offer domestic downloads within China of its developer software.

Some Chinese firms had said they were pushed to download Apple's developer toolkit from unofficial sources in China because of the slow internet speeds when connecting to international services."

Interesting that in all the MSM stories about this huge story that nobody has mentioned that one of the relatively few apps (in relation to the total available) compromised was that of one of the worlds largest surveillance manufacturers - which happens to be partially owned by the Chinese government.

Some Chinese firms had said they were pushed to download Apple's developer toolkit from unofficial sources in China because of the slow internet speeds when connecting to international services."

I wonder if the Chinese goverment has "slow internet speeds" when they are hacking other goverments?

The issue is trust. You trust an installer to install correctly. You trust manufactures to design, build and secure correctly. Especially in the security industry! There has been several security issues from this vendor recently. I dont trust them and Im sure all the competitors will be talking about this for years to come.

These are really interesting poll results. With 257 votes, there's no clear “winner”.

I’m not sure how legitimate this article is, but it proved to be an interesting read. I’m no conspiracy theorist, but I wonder if the NSA has ever attempted to collect personal data using this tactic.

Out of interest if the excuse is a "poor internet connection" how did they get the right version of xcode so quickly so as to bring out this new version? Can you get an internet connection this quickly installed in China?

Or did they use someone else’s, if so why wasn’t it used from day one (but that is still lame..)

Or is the excuse a lie.

Or did they go to another forum to download their development software.

It’s one thing compromising your own kit, another putting malware on users devices which phones home. With the Chinese government owning part of Hikvision this doesn’t look good..

Apple should ban them..

John. I am concerned that the basic chipsets may contain some kind of Trojan... or at minimum, a vulnerability that someone knows about because they planted it there only to exploit the vulnerability THEN insert some kind of malicious program.

What is your opinion?

My specs usually are worded in a way that no one has proposed HV, but could if they want. Should this make me add spec verbiage that restricts products from China? Or for me to have the integrator replace any cameras for xxx years if such a vulnerability is discovered at some time in the future? Some of my projects are quite sensitive and high risk (as I am sure others in the membership have). They include corporate, institutional, and government jobs with a high potential for this kind of sophisticated attack. Not a good thing if the same camera system I design can be used to peek at manufacturing processes or trade secrets or research in progress; or be used as a back door to access the Client’s network.

Do you recall many years ago when the smoke detector was actually CAUSING Fires? This seems like the same thing… or at least will have the same results (i.e. not allowing HV on my projects)