WSJ Investigates Hikvision

This story is on the front page of the Wall Street Journal today, just picked this up on my morning coffee run:

Stay vigilant, my friends...

Of the 5% who voted postive: Can anybody detail in the comment sections how the impact of this article by WSJ is positive for Hikvision?

I imagine the response will be something along the lines of "any publicity is good publicity"...

The Daily Caller has also picked up the WSJ coverage of Hikvision.

I want to know if the GSA is holding the contractor who originally listed the products on Schedule 84 accountable. They deliberately lied to the Federal Government asserting the product was Made in the USA (implying that they were refurbished is a stretch anyway you put it). To be clear, this isn't a "left/right" issue, its the "legal" standing of China. It's not considered a MFN (Most Favored Nation) and the law is clear that the use of Chinese made products (unless substantially transformed in the US) is against procurement code. 

Clearly, this is only the tip of the iceberg. As many people may not know, the GSA is an acceptable procurement mechanism for multiple state and local governmental entities. In Jurisdictions where they require "open" procurement, you cannot buy off of the schedule, however, that is not the norm. Most locales can purchase off of GSA. So, the implication in that is there may be many 1000s more of their products in SLED (State Local / Educational) locations. That's disconcerting to say the least.

IT would behoove the GSA to send out a note, pursuant to their cancellation, to all parties that have purchased or implemented this solution.

I was contacted by a WSJ intern in Hong Kong about this story a few months ago and I decided not to follow up with them due to a concern for the legitimacy of the call as well as potential negative after effects of being named in an article like this. I still think it was the right choice for my company, but I wish I hadnt in some respects because I havent shied away from criticizing Hik in other publications.

Do we have a comprehensive list of cameras with vulnerabilities?

Note: The WSJ Hikvision article also ran in its China edition, in Chinese.

Not because of this article but a new hospital we just took over was instructed to remove all Hikvision camera from the network after an "issue" they had last week. The head of security told me today to come up with a plan to replace all the Hikvision cameras on the network which came down from IT. 

    I worked for a company that installed mostly HikVision, across multiple states.

I sold numerous systems as did many other salesmen over the past 3-5 years.

I read a post on LinkedIn that lead me to IPVM, over the summer. One of my customers

asked me to add another camera to a 32 camera NVR. So we installed it on Oct.28th.

The same day IPVM posted an article about the firmware update, he called back with an

issue of not being able to view the new camera on the IVMS. On Halloween we spent

hours reinstalling the software and reloading all user accounts and passwords. It is my 

belief that this company will become very concerned about the systems' vulnerabilities.

   I read the WSJ last year, every day, from Sep to Nov. I especially read letters to the editor with regards to editorials and story content. Many, many powerful and well connected people care about what is written in that paper. This story will have legs.

One thing I think everyone, on all sides, can agree on here is that this story would not have made front page news if it weren’t for John’s incessant reporting.  The article is at least 50% recycled IPVM content with redone graphics.

Only a minor mention to IPVM at the very end of the article seems remiss...

Update (and appended to the original report):

On November 14, 2017, Hikvision emailed to dealers a 'Special Bulletin' Update on Wall Street Journal Article:

The most notable element of the response is how they lead with their government ownership, revealing that they see that as the most significant issue. Unfortunately for their dealers, Hikvision tricks them saying:

Hikvision is completely transparent about its ownership structure and as of June 30, 2017 had less than 42% of its shares owned by a state-owned enterprise (SOE), with the rest of the stockholders being venture capitalists,

They are completely misleading. If they wanted to be transparent, they would acknowledge that those 'shares owned by a SOE' are in fact their controlling shareholder, as their own financials do disclose:

Please offer disclosure of just how many ADDITIONAL companies in CHINA are owned this way so we have a more clear understanding that HIKVISION is by far not the only one 'semi- OWNED by the government.

Capishe?

More coverage in the press: https://www-washingtonpost-com.cdn.ampproject.org/c/s/www.washingtonpost.com/amphtml/business/economy/years-after-regulatory-crackdown-some-security-cameras-still-open-to-hackers/2017/11/14/b15f8428-c980-11e7-8321-481fd63f174d_story.html

What is truly amazing is how long this took to catch on. Not long ago China used to be Called Red China. Why? because they are a Communist regime. They are not our friends never have been yet we continue to buy products from a brutal totalitarian regime that has killed 40 million plus of its own people through the purges of Mao and now has become this Frankenstein due to all the money pouring in from the USA and other countries. They flex there military might in the South China sea, build artificial islands to expand there military reach, threaten neighbors such as Vietnam and the Philippines yet you buy from them....because they are cheap.

Maybe the ignorant masses need to study history a bit more and look at the current geo political atmosphere and try to comprehend what the Chinese communists are all about before sending Dollars to them.

Maybe some day people will wake from the slumber they are in but I doubt it because the either don't know or don't care where they are sending there money to. Maybe when an end user gets hacked and sensitive info is stolen and they sue the company that installed the equipment, Dealers might wake up.