Uniview Recorder Backdoor Examined

Author: Brian Karas, Published on Oct 20, 2017

A Chinese research group has identified a vulnerability in Uniview recorders that allows backdoor access in a method similar to the Dahua backdoor.

IPVM spoke with the researcher behind the discovery and Uniview to determine the severity and impact of this discovery.

In this report we share Uniview's response and our analysis.

* ******* ******** ***** *** ********** * ************* ** ******* recorders **** ****** ******** ****** ** * ****** ******* ** the***** ********.

**** ***** **** *** ********** ****** *** ********* *** ******* to ********* *** ******** *** ****** ** **** *********.

** **** ****** ** ***** *******'* ******** *** *** ********.

[***************]

Samsung ************* ****** / ******** ******* ***

*** *** ****** *****,***-****-*****, ********* **** ************* *** *******, *** *******. **** *** verified **** *** ************* ** ** ******* ********* *** **** Samsung / ****** *** ****** * ******* ****** ** ******* recorders ****** *****. *** *********** *** ****** * ******* ***** model *** **** *** ***** ** *** **** ** *** report ** *** ************ ******* ******* *** *******.

* ********** ** ******** ***-****(***) *** *** *******-******* **** **** *** *** ******** (******) show *** ******** ************ ******* *** *****:

Vulnerability ********

*** ************* ******** * ******* ** ********** * *** **** the ******** ***** ******** * **** ** *** ***** ********. This **** *** **** ** **** ** ********** *** *** login, ******* *** ***-********* **** **** ** *** **** ******* of ******* ** * ****-******** ********. ***** ** ****** * user ** ***** ** *** ***** *** ********* **** ***** privileges, *** ******* *** ******** ********* ** *** ***** ****.

Researcher ********

*** ******* ****** *** *********, "******* ******** *******" ********* **** after ********* ****** *** ***, ******* **** **** * ******** research ************ ***** ** *******. **** ** *** **** * website, *** **** ********** ** *****, ********* ********** *******, **** as ***** # *** ******** ** *** **** ******, *** Skype.

** **** *** **** ******** *** ********** ********* ******* / Hanwha ****** **********. ********* *********** ******* ************* ** ********* ************* to ******** ******* ** **** ** *** ********** *******.

Models ********

****** **** **** *** ************* ******* ** ***** ********* *** not ** *******. *** ******* *** *** ******* ******** ****** or ******** ******** ********, *** **** **** **** ******* **** information **** ******* ******** ** *********, ********* ******** *** ******* 31st ****.

**** ******* ** ******** ********* ***** (*** ******) ****** *** vulnerability ******** *** ******* ********* ******.

****** (*** *** ****** *******) ****** *** ********* *****-**** ****** are ********:

  • ***-****
  • ***-****
  • ***-*****

Ease ** ******* - *******

********** **** ************* **** ******** ********** *** ***** ******** **** with *** ***, *** **** ******* **** **** **** ******* URL ** ***** ** *** **** ** *****. **** *** be **** ** *** *****:

  1. *** *** ***** ******** **** ***** **** ***: ****://**.***.**.**:****/***-***/****-***?****={"***":***,"**************":"*****","**********":"","******************":*} (**** for "*************", *** ****** ** ********** ***** ** *** ***** password ****)
  2. *** ** ** ***** ** * ******* ******** ***** **** URL: ****://**.***.**.**:****/***-***/****-***?****=*&**********=*****&************=***********************

*******, **** ************* ** **** **** ** ******* *** **** not ******* *** ******** *********** ** ********* *********.

Minimal ******-****** *******

******* **** *** ******* ******** **************** **** *** ******* ******, **** *** ******** ** **** being ** *** **:

Uniview ****, *** ********

[*******]

******* *** ***** ********* ******* ******** *** **** *************. ********* to *** *******, *** ******* *** ** *****/******* ** ** use *** ********'* *****-** ***** ******* *****. **** *****->*********** ***** should ** * "*****" ****** ** ***** *** *** ********:

******** *** "*****" ****** **** ***** *** ******** ** ***** for ******* ******** *** ******* *** ****** ** *******:

******* ******** *** ********* **** *** ********** **** *************:

*.******* **** ******* * *** ******** ****** ** ***** *** issue ** *** ******* ****. *** ****** ******* **** ** ********.

*.******* **** ******* *** ***** ******** *** ******* ******** ** Nov. ****.

*.******* **** ******* * *** ******** ** *** ** ******** which **** *** * ******* *** *** ****** *** ***** security ************** *** **** ***** ******** ****.

*** *** ****** **** *** ******* ** ******** **** *** impacted ** **** *************, ** **** ******* ** ******** ********* simultaneously **** ** ******* *** *** ********.

** ** *** ******* ******* *** ******** ** **** ************* before ** ********* ****, *** **** **** ********** ** ** once **** ***** ** *** *****.

OEM *****

**** ************* ***** ******* ******* ** *** ***** ********** **** relying ** *** *************. ******* ****** ****** ** ******* ** a *** ** **** ***** ** *** ******* ***** ***** units **** ****, *** **** **** ****** ** ***** ***** due ** *** *************. *******, ***** ********** **** ********** **** may **** *** *** *******. ******* **** ***** ******** **** affected ********* ******* **** *** *** *** ** '*********' ******* product, *** **** ******* ** ****** ******* ** ******* ** resolve **** *****.

***** ** *******'* ******* ******** *** ******** *******, ** ** clear **** *******'* ******* ******* ** ****** ***** *** ***** before ********** **** *** *** *** ********. ******* ************** *** been **** ********** **** ***** *** ********* **** **** *** similar *************** ** *******, ******* **** *** ********* *** ***** 2nd ******** **** *** *** **** ***** ******* ***** ***** own ***** ** *** **** *******.

Comments (36)

**** ******* ** ******** ********* ***** (*** ******) ****** *** vulnerability ******** *** ******* ********* ******.

** * ****** ********** ** ******* ********, **** ** ** great *******. **** * **** **** *******, * *** ** operations ******* ** **** ** *** **** ********** *** **** tests ** *** ** *** ******* ******* ********* **** ** sell **** **********. ** **** *** **** **** ** ********* this *************. *** * ****** **** *** **** ****** ********** are *** **** *** *******?

**** -

**** *** *** ** *** * ****? **** *** *** you ***** *** ********* **, **** ********?

******* ********** ********* **** ******* **** **** **** *** ******* OEMs, *** ** ****** ** *** ******, *** *** ******* specific ****** ********.

** *** *** ***** **** ****/********** ******* *** *****/******** ** might **** ****** ** *********** ***** ***** *** ********** ** not.

* **** ****** * *** ***** ** *** **** *** Shodan ****** *** *** * ***** **** ** *** ***** units ***** ******* ** *** ******* ******* **** ******** ** read *** ****** ********, **:

****://**.***.**.**:****/***-***/****-***?****={"***":***,"**************":"*****","**********":"","******************":*}

******* **** **** ** *** **** **** ** *** ************* (if *** ****** *** *** ****** ******** **** *** ****, you ****** ******* ** **** **** ******).

*** *** *** ** *** *** * ***** **** ** a ******** * *** **** ** ******* * ******** **** from - ****** *****:

***-***-**:********* ***$ ./*******.**
*******...
***** ********:
"*************": "********************************"
*******...
***** ********:
"*************": "********************************"
*******...
***** *** *** ******** ****.
*******...
***** ********:
"*************": "********************************"
*******...
***** ********:
"*************": "********************************"
*******...
***** ********:
"*************": "********************************"
*******...
***** ********:
"*************": "********************************"
*******...
***** ********:
"*************": "********************************"
*******...
***** ********:
"*************": "********************************"
*******...
***** ********:
"*************": "********************************"
*******...
***** ********:
"*************": "********************************"
*******...
***** ********:
"*************": "********************************"

* ***** ** ******* **** **** ***** # *** ******** build *** ** *** ****** *** *** ******** **** **** from *** ******.

** **** **** ** ***** ******* **** *** ***** ***** right *** ** ******* *** ***** *** ****** ******. * will *** **** **** ***.

***** ********:
"*************": "********************************"

** *** *** * ****, ****** **, ** ***** *** websites ********** ******* ****** ****** *** ****** ** ****** ********* with ********* ******* **********. *** ********, ******** "********************************" **** *****'* **** *****, **** **** *** "******" (****** using ***) ***** ** ******** *** **** ********.

** ** ***** **** **** *** **** ******* *** ****** of *** ********. **** ****** ** ***** ****** ****** ** a *******.

***, **** *****. * ******* ******* **** ***** ******* ****** to *** *** **** ***** *** ****** ******* **** ******* with **** ************* *** ******* ** **** ** **** *****. But ** *** **** *** * **** ******** **** ******* even **** ****/**** ** *******.

******, **'* **** * **** ** ********** **** **** ** the ****** *******. **'* *** ****** * *** ********* ********* for ***** *******, ******* *** ****** * ****** ***** *** company ** ***** *** ********* *********. ********* *** ******* **** hacked *** **** **** **** *********** *** **********.

*'** ***** ******* ** ***** ******** ***** ****** *** ** will *** ****.

*** *** ***** ** ** **: ******@****.***

***** ** *** *** ********

**** ******* ** ******** ********* ***** (*** ******) ****** *** vulnerability ******** *** ******* ********* ******.

**** *** *** ****?

** ***** * **** ** ***** ******* ****?

***********, **** *** **-******.

**** ** * **** ** *******'* ******* ***** ***** *** are ***** ****** *********** ** *******. ** ** *** *** at **** ****, ** **** **** ******* ******* ********. *** question *** *** ***** *** *******:

****://**.*******.***/********/*******/********/*************/

*** **** *********** **** ** *** ***** ******* ** **** 'szUserName' ** ****, *** *** ******* ** ***** *** "*****".

****://**.***.**.**:****/***-***/****-***?****={"***":***,"**************":"*****","**********":"","******************":*}

* ****** *** '****' **** *** **** **** *** ************** mechanism ** '*******' *** **** ** **** ** **** *** sensitive **** **** ***** **********...

*** **** ** ** ** **** ***** **** *****? ** if *** *** * **********, *** **** ** ** ** know **** ** * ****? *** *********** ** ****?

****'* *** *****. ** ***-******** *** * ******** ****. **** in * ***** ** **** ** ****** ****** ** *** their **** ***** **** *******. **** * **** ** ******** Dale *** ******, * **** **** * **** ** ***. When ** ******** ***** **** ******, * ****** ****, ***** all *** ***** ** ** ***, **** *** *****, *** ensure ** ******* *** *******.

* **** ***'* ******* *** * *** ******* ******* ***** have ***** ******.

** ** *** *** * **********, *** **** ** ** to **** **** ** * ****? *** *********** ** ****?

** ** **********, ** ** ****** *********** ** *****, *** partly **********.

** **** ***** * ********* ***** ** ***** **** ** required ** ***** ****** ****, *.*. ******* * **** **** as**** ***. ** **** ***'* **** *** ****** ** ****** ***** own *********, **** ****** ******** ***. ** *** ********, *** insecure **** * ********* ****** ** ****** ** ** ******** to *** ******** *.*. ******* *********** ***'* **** ** **, that's *** ****, ** ** * *********** **** ** ******* skill **** **** ***'* ****.

** *** **** * ********* ***** ** **** * ******* resistant ** ******* ****** ***** ******* **** ** ********** **** any ******* ********. ** ** **** ********, ** *** **** like **** *** *** ******* *** **** **** ****** **** time. ** **** **** ******, **** **** ** **** ** features **** ***** ******, ********, *** ***** *** ******** *** and *****. ********, ******** *** ***** ******** **** ***** ******, CEOs *** *** ** ** ***** ******** **** **** ****** priority ** ***** ** ******** **** *** ** ****** ** bullet ****** ** ********* *********.

** ** *** *** * ******** ******* ***** ******** ** important, *** **** ** *** ******* ** * ************* *********, or **** *** ******* ***** ***** *** ******* *** ***** with ** ** * ********** *****.

* ****** *****, *** ** **** ******* ***** *** ******* / **** ******* *** ********** *** **** ****** ******* ********* on * ******* *****.

** * ******* ** *** *********** ** ********** ** ******* until ** ** **********

*** **** ** ** ** **** ***** **** *****?

*** ** ****, *** **** **** ** ***** **** **** reading *** *** ** ********** *** ****

** ** *** *** * **********, *** **** ** ** to **** **** ** * ****?

*****, ********* *** *** ******* - ***** *** ** *****, this ** *** *** **** ** ******* *** *** *** portable ** ** '*****'

*** *********** ** ****?

******** *** ****** *** *** *********** *** *** ** ** there

* **** ***'* ******* *** * *** ******* ******* ***** have ***** ******.

*************, * ***** *** **** **** ** *** **** ** this *** * *****....

**** *** *** * *** **** ******** *** (** *'* curios), *** * ******** ***'* ***** ******* **'* * ********, it's ***** **** **** - **** **** ********** ** ******** whatsoever.

*** ** ***** *** **** ****** **** '******()', *** ** sanitation ********** ** **** ******** *****, ***** ***** **** ****** code ********* (***) **** **** *********.

* ******* ***** *** ********, *** ******* ****** **** ** absolutely ******.

* ******* ***** *** ********, *** ******* ****** **** ** absolutely ******.

*** **** *** ** ******** ************...

******** **** ******** ** ***, ******** * **** ***** ** who ****** ***.

*** ***** **** **, ** *** ** **** *****? (********** I ******* ***** ****** ** ****)

***** ****'* ****** *** ***** ****, ** ***.

****:

***** *** **** *** *** **** **** **** ********:*****://******.***/*****/***-*********-***

******** **** ******** ** ***, ******** * **** ***** ** who ****** ***.

*********, ***** "******" ******** ;)

* ******* ***** *** ********, *** ******* ****** **** ** absolutely ******.

* ******* *****'* ***** * *** ** ****** *** *****. About * **** ***, * *********** * ****** **** ********** ignored *** ******** *** ******** **** ********** *** ****. * told **** ***** *** *******, **** ****** **, * ********* and **** ********** ****** ** *** **. **** ****'* ****** overly ********* ***** *** ******* ** ***.

** *** ***, *** ******** *** **** ******** **** ** both *** ******* ******** *********** *** **** ****** ********, *** reached *** ** *** ******* ******** ********** ** ***** ******. I'm **** **** *** ******* *****, *** *** **** **** in **** **** ***** *** ****.

*** ** *** *** ***** *** ******** ** ***** **** the *** * ******* *************.

** ** ****** ***** ** ***** ***'* **** ** ** published?

***** ** ** **** ** *** ***** **** ***** *********** in ***** **** ** **** **** **** *** *** *** 3, **'* * **** *** ***** *** *** ** **** less ****** ******* ******* *** **** *** *****.

***** **** ****** ** *** ******* * ***** *******, *** has **'* *** ***** ******** ********, *** * *** *** I *** **** ***** **** * *** ** ******** ******.

**** ****** **** ********* **** **** ****** ****** **** *** PostMan ********, ***** *** ** * *** ******* ** *** are *** **** ** ******* **** **. * ***** * little **** ****** **** ***** ******, *** ******** *** *** do **** *** **** *** ******* *** *** ******* ******** fancy.

*** ***** ** ****/*******:

*) *** *** ***** ******** ****: ****://**.***.**.**:****/***-***/****-***?****={"***":***,"**************":"*****","**********":"","******************":*}

*) *** ** ** ***** ** * ******* ********: ****://**.***.**.**:****/***-***/****-***?****=*&**********=*****&************=***********************

**** ******/******. * **** ******** **** ****** ** * *** random ****** *******.

[**** ****: ****** ** * ******* *******.]

****** **** ** ****** ** ** ** ** ******** *********** on *** ** ******* ** ******* *** ** ********* ***** people's ********** ******* ******* **********???

* *** **** ******* ** **** ** ****. * **** said "****" ** ** **** ** ***** **** ** ***** it ** **** ****** *******.

[**** ****: ****** ** * ******* *******.]

**, *********** ***** *** ********** ****** *** ***.

*** *******, **** #* ******** ******* *** *** ****** ***** be **** *******, *** ********* ******* *** ************* ** *****.

**** #* ** *** *********.

**** ********** ** **** ****:****** * **** **,*** ***** *******?

**** ** ****** ** *********** *** **** *********** ** **** is ********* ** *** ******** ********* ***.

*** ******* ** **** ****** ** ** ***** ******* *** may ***, ****, *******, ** ******* ******* ********* ** ********* if ***** ******* *** ********** ** **** **** *** *** appropriately ** ***** ** ****** ****.

** *** ********* *** ************ **** ****** *** **** **** for *** **** ** ******* ********.

* ******* **** ********* ** ** ********* ******** ****, *** do *** ****** ***** **** **'* ********** *** *********** ** provide * ***-***-********* (**?) ******* ** *** ** ******* ****? While *'* **** **** ****** **** **** *** **** ** the ****** ** ***** ** *** ********, **** ******* **** it ***** **** *** ***** ***** *** ****** ***** ******* in ** ***** ****** *** ***** ********* ******* *** ******** them *** ***** ** ** **? ***** **** *** ** effectively *** **** *********** ********* ** *** ****** *** ***, you **** ***** ** ** * ****-****, ****-****** **** *** simplified ** ** **** ****** *** *** ** ****** ** seconds.

* ********** **** *******, ******* * ** *** ******* ** have ******* *** ***** ** ****** *** ***** **** ** use **** ************* (** ****** ** **** ********* ******* *** other *********) **** *** ********* **** ***** *** ******* ****** figure *** ** ***** ***. **** ** ** ********* ****** exploit, **** ** *** ***** ******* *****. *** **** *******, passing **** ******** ****** ** ** **** ****, ** ****** as ****** ** ** **** (*** **** *** **** **** complex ************'* ***** ****** ********).

*** **** **** ** **** ** **** ** *** ******* been ***** ** **** ************* **** ** ** ** *** make ** ********** ***** *** **** **** ** ***** ******** are, *** **** ******* *** ******, *** *** ************ **** expose ** ******* **** **** **** ** **** ** **** risky **** **** ****** ***. **, ****** **** ** ** and ***** "**** ***'* ****** ** **, ** ***** *** much ****** ** ****** **** ***."

[******]

******* *** ***** ********* ******* ******** *** **** *************. ********* to *** *******, *** ******* *** ** *****/******* ** ** use *** ********'* *****-** ***** ******* *****. **** *****->*********** ***** should ** * "*****" ****** ** ***** *** *** ********:

******** *** "*****" ****** **** ***** *** ******** ** ***** for ******* ******** *** ******* *** ****** ** *******:

** ******* ****** **** ******** *****?!?! *************!
Login to read this IPVM report.
Why do I need to log in?
IPVM conducts unique testing and research funded by member's payments enabling us to offer the most independent, accurate and in-depth information.

Related Reports on Hacking

New Whole Foods Installs Hackable Access Control on Feb 21, 2018
Whole Foods has built a reputation for high quality. And their 2017 Amazon acquisition has increased that, plus added deep pockets for buying...
Remote Network Access for Video Surveillance Guide on Feb 21, 2018
Remotely accessing surveillance systems is key in 2018, with more and more users relying on mobile apps as their main way of operating the system....
IP Cameras Default Passwords Directory on Feb 09, 2018
Below is a directory of 50+ manufacturer's default passwords. Note: Change Default Passwords Leaving default passwords is dangerous and makes it...
Simplisafe 'All New' Generation 3 Tested on Feb 08, 2018
Feared by the traditional alarm industry, Simplisafe has launched its 'all new' Generation 3 platform that they declare is "Stronger. Faster....
Geovision Unprecedented Security Vulnerabilities And Backdoor on Feb 06, 2018
Cybersecurity vulnerabilities have plagued the video surveillance market. Now, Bashis, discover of the Dahua backdoor, has discovered 15...
US Congressional Hearing Features Hikvision on Jan 31, 2018
A US Congressional hearing asked questions about Hikvision's government ownership and cybersecurity issues, following the WSJ's investigations into...
Chinese Government Backdoor Spies on African Union Revealed on Jan 29, 2018
For 5 years, a Chinese government backdoor was used to spy on the African Union, according to a Le Monde investigative report. As is their...
Worst NVR / VMS Manufacturers 2018 on Jan 29, 2018
These are the manufacturers who integrators reported the most significant problems with. 220+ integrators answered: In the past year, what...
Hacked Hikvision IP Camera Map USA And Europe on Jan 22, 2018
The interactive map below shows a sample of hacked and vulnerable Hikvision IP cameras across the USA and Europe. Hover over a marker to see an...
Chinese Government Hikvision Surveillance System On US Government Network on Jan 18, 2018
Hikvision, the Chinese government-owned manufacturer, has publicly claimed that their products are running on a US government network. Moreover,...

Most Recent Industry Reports

False Advertising: Hikvision USA Deep Learning on Feb 23, 2018
Hikvision USA is conducting a false advertising marketing campaign for their deep learning system. Hikvision USA's claim violates US FTC Truth In...
Favorite Integrator Sales Quote Software (Statistics) on Feb 23, 2018
What application do integrators use the most to issue sales quotes? Nothing? Spreadsheet? MS Project? Online software? Of the many offerings out...
Aruba Networks Profile on Feb 22, 2018
Aruba Networks' presence in the video surveillance market has historically been limited. With a company focus on Wi-Fi first and switching...
US Army Base Specifies 70+ Outdated Hikvision Cameras on Feb 22, 2018
A US Army base has specified 70+ Hikvision IP cameras, a month after the WSJ reported a different Army base removed Hikvision IP cameras. While...
Directory of 30+ LPR / ANPR Providers on Feb 21, 2018
License Plate Recognition / Automatic Number Plate Recognition are a type of video analytics software that can identify and match license / number...
New Whole Foods Installs Hackable Access Control on Feb 21, 2018
Whole Foods has built a reputation for high quality. And their 2017 Amazon acquisition has increased that, plus added deep pockets for buying...
Remote Network Access for Video Surveillance Guide on Feb 21, 2018
Remotely accessing surveillance systems is key in 2018, with more and more users relying on mobile apps as their main way of operating the system....
Visio For Video Surveillance Design on Feb 20, 2018
Many integrators have standardized on AutoCAD for camera layouts but new users may be overwhelmed by its learning curve. Microsoft's Visio...
Health Care Insurance Integrator Benefits Statistics on Feb 20, 2018
How common and how much healthcare coverage is typically provided by security companies? 150+ integrators explained how their companies provide the...
Hikvision Deletes Genetec Support on Feb 20, 2018
There will be no peace between Hikvision and Genetec. A year after Genetec expelled Hikvision (and Huawei, citing Chinese government control...

The world's leading video surveillance information source, IPVM provides the best reporting, testing and training for 10,000+ members globally. Dedicated to independent and objective information, we uniquely refuse any and all advertisements, sponsorship and consulting from manufacturers.

About | FAQ | Contact