IPVM Vulnerability Scanner Released

By: IPVM Team, Published on Jun 18, 2018

IPVM is proud to announce video surveillance's first and only cybersecurity vulnerability scanner. This tool allows quickly and simply identifying known video surveillance vulnerabilities. It is available as a Windows and MAC download, free for all to scan a single IP address at a time or to scan entire networks at once for IPVM members.

This 30-second overview explains what the vulnerability scanner does:

Download it from the options below:

Benefits of the Vulnerability Scanner

The reality is your video surveillance cameras or recorders may have vulnerabilities you are simply unaware of:

(1) You may have bought OEMed equipment (e.g., Honeywell, Interlogix, Tri-Ed, ADI, ADT, etc.) and not even realize you have vulnerable Dahua or Hikvision equipment.

Get Notified of Video Surveillance Breaking News
Get Notified of Video Surveillance Breaking News

(2) You may not have gotten word from your manufacturer on vulnerabilities as most manufacturers strive to minimize publicity of these issues.

(3) And, even if you are aware of vulnerabilities, you may not have found all the devices that are vulnerable in your system.

The Scanner addresses this by looking for the known signatures of these vulnerabilities, automatically examining your networks and reporting back on your cameras or recorders that show vulnerabilities.

How To Video

The following video shows the basics of how to use the Scanner and what options can be used:

Privacy Built-In

The Scanner has privacy built-in, it never uploads, records nor shares any vulnerability information. It displays this only on your own computer.

The only outbound requests the Scanner makes is to get updated versions and for member sign-in to enable scanning entire networks.

Known Limitations

The Scanner has some known limitations:

  • MAC OUI addresses are used as part of identifying vulnerable devices. If we are missing a MAC OUI, we could potentially miss a vulnerability. If the scan is being done remotely, where MAC OUIs are not available, we cannot as definitively verify the vulnerability (displayed as 'possible') in such cases.
  • Vivotek has a known vulnerability but we are not currently scanning for it since the check involves crashing the web server. Since, we do not want to endanger any potential product systems, we are currently omitting it but searching for an alternative technique.
  • We have limited the number of IP addresses that can be simultaneously scanned to a Class B address range to minimize probing the public Internet for insecure devices. That, combined with the limitation on MAC OUI checking, will limit misuse.

Thanks To Bashis

While any error is entirely IPVM's, we would like to thank Bashis, (1) for finding so many of these manufacturer vulnerabilities (e.g., 1, 2, 3, 4) and (2) for volunteering feedback on the Scanner's implementation to improve its functionality.

Future Features

We have a number of requested and potential future features. In no particular order:

  • Exporting results: In 1.0, we show a list of results with IP addresses and vulnerability information. In the future, we will add a way to download that list to a csv or text file.
  • Local history: Members have asked for a way to store a local history of previous searches (e.g. different IP addresses or ports, etc.).
  • Default / weak passwords: Another cybersecurity concern are devices using default passwords (see our list) or weak passwords (e.g., 1234, abcd, password, etc.). We are considering a future addition that scans for such issues.
  • OEM detection: Members have asked about notifying them if they have products that are OEMed from Dahua, Hikvision, etc. This could help them identify potential vulnerabilities and products that are prohibited.

Ask Questions / Share Problems

Surely there will be many questions and certainly some problems. We are happy to answer any questions and help with any problems, either commenting below or emailing us - support@ipvm.com

Download

Download it from the options below:

2 reports cite this report:

VMS Camera Management Shootout - Avigilon, Dahua, Exacq, Genetec, Hanwha, Hikvision, Milestone, Network Optix on Oct 29, 2018
Camera setup, configuration and maintenance are the most common tasks when managing a surveillance system. Who does it best and worst? Who offers...
The Dumb Ones: PSA's Bozeman On Cybersecurity on Jun 15, 2018
The smart ones are the hundred people who flew to Denver and spent $500+ on a 1.5-day conference featuring (now US government banned) Dahua as a...
Comments (73) : PRO Members only. Login. or Join.

Most Recent Industry Reports

Security Dealer 'Social Media Contractor' Program on Jun 25, 2019
A $20,000 video surveillance system can be yours for free if you are willing to post on social media about the security dealer. Good deal, bad...
Axis Live Privacy Shield Analytics Tested on Jun 25, 2019
Privacy is becoming a bigger factor in video surveillance, driven both by increased public awareness and by GDPR. Now, Axis has released Live...
Directory of 55 Video Surveillance Startups on Jun 25, 2019
This directory provides a list of video surveillance startups to help you see and research what companies are new or not yet broadly known. 2019...
Hikvision Colorvu Camera Tested on Jun 24, 2019
Hikvision says their new ColorVu line captures "vivid chromatic images in darkness", with unconventional white light illuminations whereas most...
China Subway Facial Recognition System Examined on Jun 24, 2019
A China city of 6+ million people has installed facial recognition-enabled gates in subways, allowing commuters to enter stations by simply showing...
HID Mobile Tested on Jun 21, 2019
HID Global is one of the largest access brands, but their mobile access has had challenges. Indeed, the company has already restructured their...
Genetec Beats Milestone For IHS #1 on Jun 21, 2019
For years, Milestone has touted that they are the #1 VMS. Now, Genetec has beaten them in IHS rankings. But what is this? Even other manufacturers...
Risk of Amazon Alexa Guard: No Battery Or Cell Backup on Jun 20, 2019
Amazon positions its Alexa Guard Service as a "smart home security system" and says it can help you "keep your home safe". However, the...
Exacq Remote Cloud Access Tested on Jun 20, 2019
Remote cloud access has been missing from most VMSes (including Exacq and Milestone). Now, Exacq, after releasing Cloud Drive Storage earlier in...
Briefcam Buys Frost Award* on Jun 20, 2019
Frost 'awards' are well-known and widely disrespected. Now Briefcam is touting their win. The way it has worked for many years is that Frost...

The world's leading video surveillance information source, IPVM provides the best reporting, testing and training for 10,000+ members globally. Dedicated to independent and objective information, we uniquely refuse any and all advertisements, sponsorship and consulting from manufacturers.

About | FAQ | Contact