WSJ Investigates Hikvision

This story is on the front page of the Wall Street Journal today, just picked this up on my morning coffee run:

Stay vigilant, my friends...

Of the 5% who voted postive: Can anybody detail in the comment sections how the impact of this article by WSJ is positive for Hikvision?

I imagine the response will be something along the lines of "any publicity is good publicity"...

The Daily Caller has also picked up the WSJ coverage of Hikvision.

I want to know if the GSA is holding the contractor who originally listed the products on Schedule 84 accountable. They deliberately lied to the Federal Government asserting the product was Made in the USA (implying that they were refurbished is a stretch anyway you put it). To be clear, this isn't a "left/right" issue, its the "legal" standing of China. It's not considered a MFN (Most Favored Nation) and the law is clear that the use of Chinese made products (unless substantially transformed in the US) is against procurement code. 

Clearly, this is only the tip of the iceberg. As many people may not know, the GSA is an acceptable procurement mechanism for multiple state and local governmental entities. In Jurisdictions where they require "open" procurement, you cannot buy off of the schedule, however, that is not the norm. Most locales can purchase off of GSA. So, the implication in that is there may be many 1000s more of their products in SLED (State Local / Educational) locations. That's disconcerting to say the least.

IT would behoove the GSA to send out a note, pursuant to their cancellation, to all parties that have purchased or implemented this solution.

I was contacted by a WSJ intern in Hong Kong about this story a few months ago and I decided not to follow up with them due to a concern for the legitimacy of the call as well as potential negative after effects of being named in an article like this. I still think it was the right choice for my company, but I wish I hadnt in some respects because I havent shied away from criticizing Hik in other publications.

Do we have a comprehensive list of cameras with vulnerabilities?

Note: The WSJ Hikvision article also ran in its China edition, in Chinese.

Not because of this article but a new hospital we just took over was instructed to remove all Hikvision camera from the network after an "issue" they had last week. The head of security told me today to come up with a plan to replace all the Hikvision cameras on the network which came down from IT. 

I can see how the Hikvision ownership structure can be alarming to people. That and combined with their cyber security problems they have had recently.

Their is some fear that the back door was intentional which raises some concern. But this is where good common sense should come into play. Here are my rhetorical questions that I would ask the concerned person:

- If they really wanted an intentional backdoor, why wouldn't they put it in the DVR's which would have made way more of an impact. Instead, the "backdoor" was on cameras, specifically cameras that were port forwarded that had old firmware. While not rare, this is for the most part an unlikely scenario. Nothing like the Dahua Hack-a-thon that happened recently.
- As far as the Chinese peaking in on you. Do you really think the chinese govt cares about what you are doing at your house or business. Do you think they have the time to spy in on you to see whether you are mowing your lawn or picking your boogers? What intel can they gather from your boogers? 
- If you are concerned about the chinese using the devices as botnets, I again refer back to my first question.

Admittedly, I think Hikvision makes a great product but they simply put cyber security as a very low priority in previous months/years. Matter of fact, I think alot of Chinese manufacturers think this way. Its just until recently that they have woken up to the fact that cyber security is important. However, I dont think anything is intentional. 

Nonetheless, Hikvision will definetely need to respond to this WSJ article. Silence will simply raise more concern. I can understand Hikvision calling IPVM silly, but you cant do this with the WSJ. This is where a good Americanized crisis writer/press relations comes in. I think they need to respond in a humble way, admitting their mistakes. I fear the humble tone may be a difficult move for Hikvision as they put alot of pride in their work and admitting mistakes is not their forte. Nonetheless, it needs to be done. They need to admit their mistakes then inform what has already been done to take care of the issues and what is in the works to continue to make their products secure and inform that cyber security is a much higher priority than it has been in the past. Wording all this properly is where a good press relations person comes into play. If you can word this well and let everyone know you are making the most secure product on the planet, this will blow away in no time.

"Paging Chuck Davis....  Chuck. Davis.  White courtesy telephone, please."

Where is Chuck?

[IPVM Note: Related: Hikvision Admits Backdoor 'PR Issue']

One thing I think everyone, on all sides, can agree on here is that this story would not have made front page news if it weren’t for John’s incessant reporting.  The article is at least 50% recycled IPVM content with redone graphics.

Only a minor mention to IPVM at the very end of the article seems remiss...

Please offer disclosure of just how many ADDITIONAL companies in CHINA are owned this way so we have a more clear understanding that HIKVISION is by far not the only one 'semi- OWNED by the government.

Capishe?

More coverage in the press: https://www-washingtonpost-com.cdn.ampproject.org/c/s/www.washingtonpost.com/amphtml/business/economy/years-after-regulatory-crackdown-some-security-cameras-still-open-to-hackers/2017/11/14/b15f8428-c980-11e7-8321-481fd63f174d_story.html

Article link from above @WashPost ReFirm researchers said they found a vulnerability that lets anyone gain access to a TRENDnet camera by typing 12 specified characters into a Web browser, followed by the Internet address of the video camera, which can be found relatively easily online.

 

Wow.  This 12 digit string sounds just like the Hik magic string backdoor LINK.  Very interesting that Hik and Dahua and TrendNet all have similar backdoors.