Beware unitoptek/Boavision camera, backdoor inside

[shdf]

Hello from France,
i just bought a few weeks ago a chinese camera on aliexpress :
4 Inch HD 4MP Mini PTZ IP Camera Outdoor Network Onvif Speed Dome 30X Zoom IP PTZ Speed Dome Camera CCTV 50m IR NightVision-in Surveillance Cameras from Security & Protection on Aliexpress.com | Alibaba Group

and just discovered that it has a telnet runing and that you can't disable it, the seller does not seem to want to give the password in order to be able to disable it...

Finaly, someone discovered that there is an administrator hidden account hardcoded in the firmware, that you obviously can't disable :
user : HANKVISION_2016
pass : HANKVISION_2016

if your Camera web interface looks like this, i bet this backdoor account is working...

 

[bp2008]

No camera should ever be assumed to be secure Even the world's leading camera manufacturers have been caught doing this kind of crap.

 

[Q™]

“The men don’t know, but the little girls understand.”

 

[alastairstevenson]

Lol!
Riders on the Storm is about the only one I remember well.

 

[shdf]

Looks like ILDVR cameras are in the same boat, everything that uses the HANKVISION firmwares has a lot of vulnerabilities :
ILDVR INC-MH40D06 security nightmare part 2 | Sergei's Stuff and Things

my cam is actually in his box, i'll check if this is working, i guess yes :
http://${CAMERA_IP}:10081/OwnUserInfo.txt

 

[Эдем]

Доброе время суток подскажите ели возможность сбросить пароли на данной модели boavision hd54f-4mp-30x

 

[Greenmachine]

Old post I know but apart from the security issues, how has this camera performed? Looking at getting new 8mp version

 

[shdf]

hello,
the camera is still runing on the top of our office, so it's not so bad for the price we paid.