Backdoor found in Hikvision cameras

Testing V5.1.6 build 140412 I get either 404s or Invalid Operation, confirmation of noted non-vulnerable version.
 
DS-2CD2020F-IW
V5.4.3 build 160705: Confirmed working
V5.4.5 Build 170123: Confirmed _not_ working

Nice work montecrypto!
 
My relabeled Hik DS-2CD2412F cube cam (ANNKE I61DR) is vulnerable.

Wonder if I can drop newer Hik firmware over it?

Edit to add:

Contacted Annke support and they sent me a firmware update but the issue remains.

File name: digicap.dav
Firmware: V5.3.5 build 161112

Installing Hikvision firmware balks with "The type of upgrade file mismatches."

*sigh*

So after going back and forth with Annke's first line tech support trying to get them to understand this was a significant issue given that this and lots of their relabeled cameras likely are subject to the same and them saying that it wasn't a problem for a variety of reasons, even though I confirmed that the cam is in fact vulnerable even after the update, they finally told me that "As a technical support, we know better for our product."

Yeah, good luck with that. ; ) lol
 
Last edited:
LaZona said:
Are cameras behind a hikvision NVR also vulnerable to the same backdoor?
Click to expand...
The vulnerability is with the camera's firmware allowing remote unauthorized access on your network, a NVR has no mitigating effect.
You can 1. fix the firmware or 2. have a secure network with no "outside" access for an attacker to exploit the vulnerability.
 
catseyenu said:
The vulnerability is with the camera's firmware allowing remote unauthorized access on your network, a NVR has no mitigating effect.
You can 1. fix the firmware or 2. have a secure network with no "outside" access for an attacker to exploit the vulnerability.
Click to expand...


Ok thanks.

If I disable upnp from the NVR, does that disable access to the cameras even if the cameras have upnp activated?
 
The latest tinyCam Monitor 9.0.3 for Android will report this Hikvision vulnerability via network scanner.
 

Attachments

  • Screenshot_20170913-095018_framed.png
    Screenshot_20170913-095018_framed.png
    1.9 MB · Views: 78
  • Like
Reactions: tangent, fenderman, bp2008 and 1 other person
Mike A. said:
So after going back and forth with Annke's first line tech support trying to get them to understand this was a significant issue given that this and lots of their relabeled cameras likely are subject to the same and them saying that it wasn't a problem for a variety of reasons, even though I confirmed that the cam is in fact vulnerable even after the update, they finally told me that "As a technical support, we know better for our product."
Click to expand...

I wonder how they'd feel when their company name appears in an security advisory?
 
  • Like
Reactions: Bink, bashis, alastairstevenson and 2 others
Tolting Colt Acres said:
I wonder how they'd feel when their company name appears in an security advisory?
Click to expand...

Guess we'll find out.

They've also not let clear for public view a post that I made on their forum last night asking about it.

Great way to respond to security issues - pretend that they don't exist and hope that nobody notices. lol
 
Geez. I found this thread via a thread about the hikvision cube clone (which i just bought a month ago).

I have Ubiquiti Unifi gear. the BI PC is on VLAN2 with no access to my main LAN. My IP camera group on VLAN2 is blocked from access WAN and my main LAN (cannot ping out to WAN or to LAN1). The cameras get their time from my BI PC using the nettime app. The BI PC only runs my cameras.

Does this sound safe? I have not touched the firmware on my 8 cameras in a while.
 
DokkenVersusChicken said:
Geez. I found this thread via a thread about the hikvision cube clone (which i just bought a month ago).

I have Ubiquiti Unifi gear. the BI PC is on VLAN2 with no access to my main LAN. My IP camera group on VLAN2 is blocked from access WAN and my main LAN (cannot ping out to WAN or to LAN1). The cameras get their time from my BI PC using the nettime app. The BI PC only runs my cameras.

Does this sound safe? I have not touched the firmware on my 8 cameras in a while.
Click to expand...
yes, you have no risk.
 
fenderman said:
yes, you have no risk.
Click to expand...

Thanks, I thought so, but good to have experienced confirmation. I also use L2TP VPN for remote access and to not have any open/forwarded/visible ports. All this works great. I'm a networking novice, but I don't know how in the world normal people are supposed to be expected to set this stuff up.
 
  • Like
Reactions: fenderman
DokkenVersusChicken said:
Thanks, I thought so, but good to have experienced confirmation. I also use L2TP VPN for remote access and to not have any open/forwarded/visible ports. All this works great. I'm a networking novice, but I don't know how in the world normal people are supposed to be expected to set this stuff up.
Click to expand...
they are not...they either have to put a bit of effort into learning how (as you have shown, its not that difficult) or hire someone...those same folks wouldn't dare run electrical wiring themselves....so they should hire someone for this as well..
 
  • Like
Reactions: c hris527 and DokkenVersusChicken
You must log in or register to reply here.
Top Bottom