XiongMai Master Password List Emailed By Chinese Spammer
By: Brian Karas, Published on Dec 05, 2016
Login to read this IPVM report.
Why do I need to log in?
IPVM conducts unique testing and research funded by member's payments enabling us to offer the most independent, accurate and in-depth information.
Related Reports
China DVR/NVR Backdoor Discovered, Huawei Refutes
on Feb 07, 2020
A backdoor was found in Chinese-produced DVRs and NVRs that secretly allowed access to the recorders. While it was first attributed to Huawei...
Dahua New Critical Vulnerability 2019
on Sep 23, 2019
Dahua has quietly admitted 5 new vulnerabilities including 1 critical vulnerability with a 9.8 / 10.0 CVSS score and 2 high vulnerabilities (scored...
Uniview OEM Directory
on Sep 11, 2019
This directory lists 20+ companies that OEM products from Uniview, with a graphic and links to company websites below.
It does not cover all...
ONVIF Exposure To "Devastating DDoS Attacks" Examined
on Sep 06, 2019
ZDnet reported "Protocol used by 630,000 devices can be abused for devastating DDoS attacks", citing exposure of ONVIF devices.
And after an...
3 Weeks Later, Honeywell Still Cannot Say Whether They Are Vulnerable To Dahua Wiretapping [Now Admits]
on Aug 27, 2019
The Dahua wiretapping vulnerability and Dahua's decision to delay disclosing it until IPVM inquired underscored problems with cybersecurity and...
Critical Vulnerability Across 18+ Network Switch Vendors: Cisco, Netgear, More
on Aug 26, 2019
Cisco, Netgear and more than a dozen other brands, including small Asian ones, have been found to share the same critical vulnerability, discovered...
Honeywell Speaks On NDAA Ban, New Non-Banned Cameras and Cybersecurity
on Aug 06, 2019
For years, Honeywell has depended on Dahua, a company with a poor cybersecurity track record and now banned by the US NDAA, for the development and...
Dahua Wiretapping Vulnerability
on Aug 02, 2019
IPVM has validated, with testing, and from Dahua, that many Dahua cameras have a wiretapping vulnerability. Even if the camera's audio has been...
LifeSafety Power NetLink Vulnerabilities And Problematic Response
on May 20, 2019
'Power supplies' are not devices that many think about when considering vulnerabilities but as more and more devices go 'online', the risks for...
Security Fail: ASISNYC Auto Emails Passwords In Plain Text
on May 14, 2019
ASIS NYC automatically emails a user with the password the user just entered, in plain text, when one registers for the site / event, as the...
Most Recent Industry Reports
Wyze Raises $10 Million And Seeks Services Expansion
on May 27, 2020
Wyze has raised $10 million, the company's first disclosed raise since the $20 million announced at the beginning of 2019.
Inside this note,...
Startup Videoloft Presents Cloud Storage
on May 27, 2020
Videoloft presented offsite cloud storage at the May 2020 IPVM Startups show.
A 30-minute video from Videoloft including IPVM...
Directory of 250+ Fever Camera News Reports Globally
on May 27, 2020
This global directory tracks 250+ articles about thermal cameras used to detect fevers in response to the coronavirus pandemic.
Articles are...
Integrators Rising Against Coronavirus
on May 27, 2020
IPVM integrator statistics make it clear - Coronavirus's impact on business is lessening and many are anticipating even better news in weeks...
Netposa Stock Surges 46% After US Human Rights Abuse Sanctions
on May 27, 2020
Last Friday, the US government announced it would sanction PRC video management provider NetPosa for being "complicit in human rights violations...
LILIN Presents NDAA-Compliant P2 Cameras
on May 26, 2020
Merit LILIN presented its NDAA-compliant P2 camera series at the April 2020 IPVM New Products show.
Inside this report:
A 30-minute video...
ZKTeco Body Temperature and Mask Detection Reader Tested
on May 26, 2020
While dedicated fever cameras emerged first, now tablet/kiosk fever detectors are ramping up.
China's ZKTeco has been aggressively promoting such...
IDIS Presents 12MP IR Panoramic Fisheye
on May 26, 2020
IDIS presented its 12MP IR panoramic fisheye camera at the April 2020 IPVM New Products show.
Inside this report:
A 30-minute video from...
FDA Defines Correct Operation of "Fever Cameras"
on May 26, 2020
The US FDA has now defined the correct operation of "Thermal Imaging Systems", colloquially known as "fever cameras".
Many in video...
OnSSI Founders Return, Start Corsight
on May 25, 2020
The OnSSI founders are back, less than 2 years after selling OnSSI to Qognify, they have returned to Corsight, a spin-out of an Israeli AI...
Comments (9)
Undisclosed #1
For DVR's work locally means the LAN, not the just the console?
Create New Topic
Blake Murphy
So many dots connected with this article.
I await future "promotional" emails
Create New Topic
Undisclosed Integrator #2
They'll soon promote Analog HD as being more secure than IP. only 1 password to worrry about!!!!
Create New Topic
Undisclosed Manufacturer #3
Interesting looking through the passwords... There are a lot of repeated sequences throughout the year at the end of the code. I think their code is pretty weak.
Create New Topic
Paul Curran
I got the same email. Really odd. Questions..
1). Why would you have this backdoor in 2016?
2). Why would you email it when XiongMai are clearly up for a fight.
Create New Topic
Undisclosed Distributor #4
Nothing new ,Hikvision's secure code generator based on serial number and date has been on the web for many years! I don't consider it an issue as you need to be on site in order to clear the password.
Just look at your broadband routers, they have a factory reset button , a one-touch wifi connection, one password for all and remote access. I haven't seen much negative publicity on that subject and there are more routers than CCTV system around the world.
Xionmai used to use telnet ( local ) but decided on one password per day just like Dahua did. Dahua has now revised the " one password " facility. Hikvision also used to have Telnet.
Create New Topic