Hikvision camera resets ITSELF to factory default twice!
- Thread starter d3sentryGunZ
- Start date
Ok. I'd like to make another point though.. If there's (as you say) reason to believe that there are so many vulnerable cameras out there still - and especially if the cameras are being attacked - should Hikvision not issue a public warning about it? As far as I can tell the company hasn't said anything about the disclosure yet. If Hikvision doesn't think there's a reason for anyone to be alarmed about how Montecrypto handled his discovery then why should you worry about it?
alastairstevenson
Staff member
They have - and have been embarrassed to receive from ICS-CERT a perfect 10 out of 10 vulnerability score for their backdoor, and an 8.8 out of 10 score for putting plaintext passwords in a configuration file which can be extracted without requiring authorisation.
Hangzhou Hikvision Digital Technology Co. Ltd.
Hangzhou Hikvision Digital Technology Co. Ltd.
Hikvision Cameras | ICS-CERT
NVD - CVE-2017-7923
Those are the original statements from March and May.
Tolting Colt Acres
Pulling my weight
- Joined
- Jun 7, 2016
- Messages
- 378
- Reaction score
- 153
You should be thanking Montecrypto then. Its good for business. Think of all those service calls you'll be billing customers for.
rpdmallett
n3wb
- Joined
- Sep 22, 2017
- Messages
- 2
- Reaction score
- 0
Ive had this exact problem for the last 3 days with two of my 6 hikvision cameras. They would reset to factory defaults at random times, but always within 2 minutes of each other. Roughly once a day.
Both are behind a firewall and part of a Synology camera system.
Disabling upnp, cloud settings, etc makes no difference.
I've just rebooted my internet router (Draytek) to see if that changes things - since I'll then get a new public up address.
I have no port forwarding active.
Any ideas?
Richard
fenderman
Staff member
- Joined
- Mar 9, 2014
- Messages
- 36,901
- Reaction score
- 21,269
These cameras arrive with upnp enabled...as soon as you plunged them in they punched a hole in your firewall, disabling upnp after the fact does not help...double check your settings and ensure no ports are forwarded...
rpdmallett
n3wb
- Joined
- Sep 22, 2017
- Messages
- 2
- Reaction score
- 0
alastairstevenson
Staff member
Also - the implication would be that uPnP is also enabled on the router, that would then allow any device on the LAN to configure port forwarding.
A handy way to test if any incoming access has been inadvertently configured is one of many port checking services, such as ShieldsUp!
GRC | ShieldsUP! — Internet Vulnerability Profiling
Defender666
Getting the hang of it
- Joined
- Dec 19, 2015
- Messages
- 193
- Reaction score
- 25
Why do the hackers reset it to default? No point in doing this when customer password is hackable. Damn had this problem once cannot upgrade the cam because of chinese hacked version.
Router to old to make a vpn server.
Router to old to make a vpn server.
alastairstevenson
Staff member
What model of camera, what firmware?
If R0, check this out : Hikvision DS-2CD2x32-I (R0) brick-fix tool / full upgrade method / fixup roundup.
Ok I went on shields up with upnp enabled it came back "the equipment at the target IP address did not respond to our upnp probes" I don't have any ports open to the web,I thought upnp was ok to use for the hikvision universal plug and play between the camera and nvr on you closed LAN system.
Or should I turn off completely
The router I have is locked down zero ports open to the web
The only app I use is Hik-Connect to look in when we are away from home
What's the best thing to do here leave on or turn off ?
Or should I turn off completely
The router I have is locked down zero ports open to the web
The only app I use is Hik-Connect to look in when we are away from home
What's the best thing to do here leave on or turn off ?
Defender666
Getting the hang of it
- Joined
- Dec 19, 2015
- Messages
- 193
- Reaction score
- 25
UPNP is not save. It is actually the oposite because it opens Ports to any device asking for it.
I understood it that the latest firmware also has this bug or is it safe?
How about NVR 7100 series can those be upgraded?
I understood it that the latest firmware also has this bug or is it safe?
How about NVR 7100 series can those be upgraded?
I also have many reseted cameras most of them are DS-2CD3212D-I3 / Chinese version / some are multilingual version, others are in Chinese language. Some and cameras are version 5.1.0 stock version and reseting to 192.0.0.64, but others are with version 5.3.0 is reseting to need is activate again with IP 192.168.0.64 / if I do not get confused/. I stoped all DDNS, UpNP in the camera and in the router, RTSP authorizations, Telnet, SSH, change password with numbers and letters and nothing.
Port forwarding in the routers is not imposible to be stopped because the cameras locate in difference location from location NVR. /it is the advantage of IP-based systems to be flexible - cameras are in different places around the world and united in a common system, if I install at any point of the camera the VPN what would be the cost of such a system/.
Problem with camera reseting I think it will be solved by installing new firmware. Which firmware to put on these Chinese versions of the cameras and from where to download firmwares. Is there a special feature in choosing the right firmware for these cameras
Port forwarding in the routers is not imposible to be stopped because the cameras locate in difference location from location NVR. /it is the advantage of IP-based systems to be flexible - cameras are in different places around the world and united in a common system, if I install at any point of the camera the VPN what would be the cost of such a system/.
Problem with camera reseting I think it will be solved by installing new firmware. Which firmware to put on these Chinese versions of the cameras and from where to download firmwares. Is there a special feature in choosing the right firmware for these cameras
alastairstevenson
Staff member
Generally, installing new firmware on CN cameras will either brick them (EN/ML firmware) or result in CN menus and 'language mismatch' problems (CN firmware) with the NVR.
The solution for full updating of CN camera that may have been 'hacked to English' can be discovered here : Hikvision DS-2CD2x32-I (R0) brick-fix tool / full upgrade method / fixup roundup.
The solution for full updating of CN camera that may have been 'hacked to English' can be discovered here : Hikvision DS-2CD2x32-I (R0) brick-fix tool / full upgrade method / fixup roundup.
Apologize for the stupid question / I'm not very familiar with Hikvision/ How do I know which camera the platform is R0,R1 and etc.../my Chinese models is- DS-2CD3210, DS=2CD3212/. To what version can I update these old Chinese models / TO TURN OFF THE PROBLEMS WITH THE SECURITY SURVEYS /, some of them are with versions 5.1.0 and 5.3.0.
alastairstevenson
Staff member
Neither of those cameras are R0
This is an R2 series camera.
R2 series EN/ML firmware up to 5.4.5 is here : DOWNLOAD PORTAL
Whether that will work or not depends on whether this camera is a Chinese camera.
A good clue is often in the serial number - does it have CCCH embedded?
This is a Chinese camera, but probably R0 internals apart from the language setting.
It may well be running 'hacked to English' firmware, making updates problematic.
Was it sold as upgradeable?
The CN firmware is here, section 07 : 海康威视是全球领先的以视频为核心的物联网解决方案提供商
What's the serial number on this camera? That may provide a clue to if it's Chinese under the covers.
*edit*
Oh, and firmware updates are more safely done in stages, not a big jump.
yes the cameras is Chinese /some ot this camera is in Chinese UI, other is have Multilanguage interface/ for example, one of them has the following number DS-2CD3212D-I3201XXXXXCCCHXXXXX9089, last firmware from Hikvision china portal is V5.4.41build170707.
I know that after updating everyone will be in the Chinese language (for me it is more important to work, not to be hacked nad crashed /. Can they then be made in English UI after the last update?
I know that after updating everyone will be in the Chinese language (for me it is more important to work, not to be hacked nad crashed /. Can they then be made in English UI after the last update?