XiongMai Master Password List Emailed By Chinese Spammer

Author: Brian Karas, Published on Dec 05, 2016

XiongMai created an international uproar as their devices drove massive botnet attacks of major Internet sites.

After pledging to recall cameras after the attack, and then threatening to sue those who criticized them, XiongMai is back.

A Chinese reseller of XiongMai equipment sent us a spam email that contains master passwords for XiongMai devices.

They consider this list a benefit for dealers, enabling faster and easier customer support, while overlooking the security risks it creates.

******** ******* ** ************* ****** ** ***** ******* ***** ******* botnet ******* ** ***** ******** *****.

***** ******** ** ****** ******* ***** *** ******, *** *************** ** *** ***** *** ********** ****, ******** ** ****.

* ******* ******** ** ******** ********* **** ** * **** ***** **** contains ****** ********* *** ******** *******.

**** ******** **** **** * ******* *** *******, ******** ****** and ****** ******** *******, ***** *********** *** ******** ***** ** creates.

[***************]

"Helpful" ********

* ***** ********, **********, ******* **. ****** **** ***** *** ****** ** *** to *** ******** (*** ******* ******), **** ******** * "***** Password ****" *** ** (********) ********:

*** ********* ***** ** * ****** **** *********** ****, ***** *** *** ***-******** ****** ******** *** **** *** of ****.

Super ******** ***** ***** ****

*** "***** ********" ******** ***** ****** ** *** ****** **** used, ********* ** **********. *** *********, *** ******** *** ** entered ******** *** *** ******** **, *** *** ******* ** additional ******* ******* ** ******** ** **** *** ********/***** ********. In ****** ****, *** *** ****** ** * ****** **** the ***** ******** *******, ******** *** * *** ***** ******** to ** ***.

But ***** *** *** ******

***** ********* *** **** *** *** ****** ****** *** **** not ****** ** ******* *** ****** ******** *********** **** ****** number ** *** *******.

Compared ** ********* ****** *********

********* ******** ********* * ****** ******** ** **** ****** ** * device **** * ********* ***** ********, ******* *** ********* *** also **** ** **** *** ****** ****** ** *** ******. By ********* *** ****** ****** ** **** ** *** *********** there ** ** ****** **** ** "****** *********" *** *********, reducing *** ******* ** **** ********. ********* *** **** ***** a ****-***** ******** *****, ******** ***** ** ***** ******** ********* **** *** ****** to *******/***** * ********* ********.

Vulnerability ********

***** **** ****** **** ***** **** ** ******** ***** *** admin ********, **** ************* ***** ***** ** * *********** ************* ** users. ** ******** *** ***** ****** ** *** *** *** an ******** **, ****** ******* ******, ** ***** ****** ********* to *** ** * ******* ***** *** ****** ****** ***** utilize ***** ********* ** *** ***** ****** ** ******* ** recorders, ******* ** *** ********* *** ********** ********, ** **** accessing ***** ** ********* *********.

Sign ** *** ******?

** **** ** *********** **** **** ******** ***** ** ******* their ***********, ******* ** *** ******, ** ***** *****. **** could ** * **** **** **** ***-****** ******* ********* *** finding ** ********* ** *** *** **** *********** ** *******, and *** **** ** ****** ** ***** ******* ** ******* new ********. 

Comments (9)

Undisclosed #1

12/05/16 07:00pm

*** ***'* **** ******* ***** *** ***, *** *** **** the *******?

Thumbnail brk1

Brian Karas

IPVM | In reply to Undisclosed #1 | 12/05/16 11:10am

***** ** ** ************* **** ****, ***, **** ** ** understanding.

Thumbnail msnedit

Blake Murphy

12/05/16 03:21pm

** **** **** ********* **** **** *******.
* ***** ****** "***********" ******

Undisclosed Integrator #2

12/05/16 04:19pm

****'** **** ******* ****** ** ** ***** **** ****** **** IP. **** * ******** ** ****** *****!!!!

Undisclosed Manufacturer #3

12/05/16 06:46pm

*********** ******* ******* *** *********... ***** *** * *** ** repeated ********* ********** *** **** ** *** *** ** *** code. * ***** ***** **** ** ****** ****.

Thumbnail img 3690

Paul Curran

12/06/16 04:30am

* *** *** **** *****. ****** ***. *********..

*). *** ***** *** **** **** ******** ** ****?

*). *** ***** *** ***** ** **** ******** *** ******* up *** * *****.

Undisclosed #1

In reply to Paul Curran | 12/10/16 12:41pm

*). *** ***** *** ***** **...

**** **** *** *** **** ******** *******:

*****-****-*****-**********-***********@****.***

Undisclosed Distributor #4

12/10/16 11:01am

******* *** ,*********'* ****** **** ********* ***** ** ****** ****** and **** *** **** ** *** *** *** **** *****! I ***'* ******** ** ** ***** ** *** **** ** be ** **** ** ***** ** ***** *** ********.

**** **** ** **** ********* *******, **** **** * ******* reset ****** , * ***-***** **** **********, *** ******** *** all *** ****** ******. * *****'* **** **** ******** ********* on **** ******* *** ***** *** **** ******* **** **** system ****** *** *****.

******* **** ** *** ****** ( ***** ) *** ******* on *** ******** *** *** **** **** ***** ***. ***** has *** ******* *** " *** ******** " ********. ********* also **** ** **** ******.

Undisclosed Integrator #5

In reply to Undisclosed Distributor #4 | 12/10/16 12:23pm

* ***** *** ********** ** *** *** ****** *** ****** via *** ***** ****** ******** ******** ****** *** *** ******* physical ******. *** ********* ****** ** **** ******** ** ***** tool ***** *** ****** ****** *** *** ******* ********* ******** access, * **** * **** **** ** ** *********. ******* a ****** ***** *** ** ** **** *** * ***** button.

** *** ***** *** ****** ******** **** *** ** *** list ** ***** **** *** ******* ** ***** *** ******* could ****** ********** *** ********* ** **** *****. **** ** the **** *** ***** ** *** ****** **'* *** ***** to **** **** ** *****. ****** ***** *** ****** ******* but ** ** ********* ** ***** ** ** ****** *** access ** **** *****?

Login to read this IPVM report.
Why do I need to log in?
IPVM conducts unique testing and research funded by member's payments enabling us to offer the most independent, accurate and in-depth information.

Related Reports

China Is Not A Security Megatrend, Says SIA on Oct 19, 2018
The US Security Industry Association has released its 10 "Security Megatrends" for 2019. SIA declares that these megatrends, such as "Advanced...
"New Zealand Govt Uses Chinese Cameras Banned In US", Considers Security Audit on Oct 12, 2018
Newsroom NZ has issued a report: "NZ Govt uses Chinese cameras banned in US": This comes after the US federal government banned purchases of...
Honeywell Hides Selling US Gov Banned Chinese Video Surveillance on Oct 10, 2018
Honeywell hides selling US government banned Chinese video surveillance as their own 'Honeywell' products, deceiving buyers and putting US security...
IP Camera Installability Shootout - Avigilon, Axis, Bosch, Dahua, Hanwha, Hikvision, Uniview, Vivotek on Oct 08, 2018
What are the best and worst cameras from an installation standpoint? Which manufacturers make it harder or easier to install their cameras? We...
China Hacks Video Servers Causing Uproar on Oct 05, 2018
An incident causing an international uproar is hitting home in the video surveillance industry as a Bloomberg report, "The Big Hack: How China...
US Commerce Department Considers Sanctions Over Companies Profiting From Xinjiang on Oct 04, 2018
The US Commerce Department is considering its own sanctions for businesses alleged to be enabling repression in the Chinese region of Xinjiang...
Evidence Of Hikvision's Involvement With Xinjiang IJOP And Re-Education Camps on Oct 02, 2018
IPVM reveals as-yet unreported details about Hikvision’s activities in Xinjiang - a region of China where massive human rights abuses are being...
Genetec Takes Aim At 'Untrustworthy' 'Foreign Government-Owned Vendors' on Sep 24, 2018
Genetec is taking aim at 'untrustworthy' 'foreign government-owned vendors'. This is not a new theme for Genetec as nearly 2 years ago, Genetec...
4MP Camera Shootout - Axis, Dahua, DW, Hanwha, Hikvision, Uniview, Vivotek on Sep 24, 2018
4MP usage continues to climb, especially for low cost fixed lens models. To see who was best, we bought and tested seven 4MP models from Axis,...
SIA Plays Dumb On OEMs And Hikua Ban on Sep 20, 2018
OEMs widely pretend to be 'manufacturers', deceiving their customers and putting them at risk for cybersecurity attacks and, soon, violation of US...

Most Recent Industry Reports

Startup SafePass Profile on Oct 19, 2018
A major problem with visitor management is that the systems mostly require adhesive printed paper labels and paper logs, creating waste and an...
China Is Not A Security Megatrend, Says SIA on Oct 19, 2018
The US Security Industry Association has released its 10 "Security Megatrends" for 2019. SIA declares that these megatrends, such as "Advanced...
Hanwha Dual Imager Dome Camera Tested (PNM-7000VD) on Oct 18, 2018
Hanwha has introduced their first dual-imager model, the PNM-7000VD, a twin 1080p model featuring independently positionable sensors and a snap-in...
Camera Height / Blind Spot Added to IPVM Camera Calculator on Oct 18, 2018
IPVM has added camera height and blind spot estimation to the Camera Calculator. This is especially helpful for those who need to mount cameras up...
Axis Strong US Growth, Flat EMEA - Q3 2018 Financials on Oct 18, 2018
This spring, Axis had its best financials in many years (see Axis Strong Q2 2018 Results). However, over the summer, Axis had many products sold...
Best Alternatives to Banned Dahua and Hikvision on Oct 17, 2018
With the US government ban and a growing number of users banning Dahua and Hikvision, one key question is what to use for low cost? While Dahua and...
Video Quality / Compression Tutorial on Oct 17, 2018
While CODECs, like H.264, H.265, and MJPEG, get a lot of attention, a camera's 'quality' or compression setting has a big impact on overall...
Knightscope Winning Investors, Struggling With Growth on Oct 16, 2018
While Knightscope's new financials show the company only winning 11 new customers in the past 12 months, the company continues to win new...
Integrator Laptop Guide on Oct 16, 2018
This 18-page guide provides guidance and statistics about integrator laptop use. 150 integrators explained to IPVM in detail about their laptops,...
Huawei Admits AI "Bubble" on Oct 16, 2018
A fascinating article from the Chinese government's Global Times: Huawei’s AI ambition to reshape industries. While the Global Times talks about...

The world's leading video surveillance information source, IPVM provides the best reporting, testing and training for 10,000+ members globally. Dedicated to independent and objective information, we uniquely refuse any and all advertisements, sponsorship and consulting from manufacturers.

About | FAQ | Contact