DS-2CD3345-I Password reset on its own. How to fix?

M

mendark

n3wb
Sep 5, 2018
4
1
California
After reading a lot of posts and upgrading the firmware a few times I am lost...

Issue: Suddenly, one of the 5 cameras lost its password. As nobody touched it, hardware failure could be possible. Cannot log in via anything but I can get to the web UI.

This camera does not have a reset button.

So I updated the firmware to the Chinese version IPC_G0_CN_STD_5.5.53_180716.zip (camera was apparently Chinese grey market) hoping will reset the password.

Still no luck...camera remains activated.

I have another DS-2CD3345-I working well which is at firmware 5.3.8.

Options:
1. Copy the partitions from the working one onto the non working one. Has it been done?
2. Downgrade the camera. I only found steps for R0 cameras but this one is a G0 camera. Also could not find any old dav file for it.

Can anyone help?
 
mendark said:
As nobody touched it, hardware failure could be possible
Click to expand...
The common cause of those symptoms is that it has been hacked.

mendark said:
So I updated the firmware to the Chinese version IPC_G0_CN_STD_5.5.53_180716.zip (camera was apparently Chinese grey market) hoping will reset the password.
Click to expand...
How did you do this? And did the login prompts change to Chinese?
Presumably using the Hikvision tftp updater as you don't know the password.
What were the last few lines on the tftp updater status window?

If the camera has been hacked - a couple of common passwords to try are
1111aaaa
and
asdf1234

And definitely worth checking whether those work or not is what inbound ports ShieldsUp! finds on the full port scan : GRC | ShieldsUP! — Internet Vulnerability Profiling  

mendark said:
I have another DS-2CD3345-I working well which is at firmware 5.3.8.
Click to expand...
That version of firmware still has the Hikvision backdoor vulnerability.

mendark said:
Copy the partitions from the working one onto the non working one. Has it been done?
Click to expand...
That would need serial console access.
If you have that, you 'own' the camera and could simply retrieve or delete the configuration.
 
  • Like
Reactions: fenderman
Thanks! It was indeed hacked and password was asdf1234. Any idea of how they get to exploit it when is behind a firewall? Could be malware that got inside the network? I assume they hack these en masse....

I am NATed however UPnP was enabled on the router (my bad). I noticed that port 80 was enabled on the router by UPnP and I am positive was this camera that did it (was enabled in settings). The port was going to the router management page and the router seems to have not been compromised.

Camera was hacked last Friday at 4 AM...that is when it lost its feed to the Synology.

I downloaded the Diagnostic info from the camera and I am noticing:

Lots of [ 10.442046] yaffs: checking block XXX bad
__________

[ 11.945910] base module init version.
[ 11.953200] hikcomm: module license 'Proprietary' taints kernel.
[ 11.953225] Disabling lock debugging due to kernel taint
__________________

192.168.X.XX:52536 115.231.107.23:6801 ESTABLISHED


115.231.107.23 is an IP in China and on the list of malicious IPs. I blocked the entire class B and the connection dropped. However, this makes me believe the camera now has some malicious code in it, in spite of me upgrading it. (unless that is a Chinese cloud server which I also disabled in the camera config)


alastairstevenson said:
The common cause of those symptoms is that it has been hacked.


How did you do this? And did the login prompts change to Chinese?
Presumably using the Hikvision tftp updater as you don't know the password.
What were the last few lines on the tftp updater status window?
Click to expand...

Yes, I used TFTP and now the camera is in Chinese. I wish I would have not upgraded it but here I am. Any idea of how to make it English again? Plus I have the other one with the vulnerable firmware that I might want to upgrade...

At least now is live again, but I cannot use it with iVMS anymore...Synology does not care it is Chinese and works just fine...
 
mendark said:
Lots of [ 10.442046] yaffs: checking block XXX bad
Click to expand...
Perfectly normal - just scary phrasing. It's looking for bad blocks, not finding bad blocks.
mendark said:
[ 11.945910] base module init version.
[ 11.953200] hikcomm: module license 'Proprietary' taints kernel.
[ 11.953225] Disabling lock debugging due to kernel taint
Click to expand...
Again, normal, no worries there.

mendark said:
Any idea of how they get to exploit it when is behind a firewall?
Click to expand...
You've already answered that question yourself.
UPnP enabled on the router allows ANY device on your LAN to control the router to allow inbound access.
As it's a Hik camera, it will likely be 80, 554, 8000 that were opened inbound.
And with the Hikvision backdoor, full access to the camera is available, and through that, potentially, your LAN and the devices on it.

mendark said:
However, this makes me believe the camera now has some malicious code in it,
Click to expand...
It's certainly possible with that file system, though not very likely.
mendark said:
in spite of me upgrading it.
Click to expand...
With Hikvision's file-by-file update method on that firmware, theoretically there could be foreign residual files not cleaned out by the update process.

mendark said:
(unless that is a Chinese cloud server which I also disabled in the camera config)
Click to expand...
It's not clear to me what that server does - apart from being in Hikvision home territory - but if the access is linked to one of Hikvision's configurable services, there's probably been no harm done.

mendark said:
Any idea of how to make it English again?
Click to expand...
On that model it will need 'hacked to English' firmware applied.
I don't have any for that specific model, or I'd slip you a copy.
 
  • Like
Reactions: fenderman
Thanks again!!


Is there a way to unpack the 5.5.53 firmware, make the change and repack it for upload? I heard now there is crypto on them so checksums might not suffice...I may have to find my cracking hat from 20 years ago and dust it off :) of course, benefit vs time spent is now more important than it was 20 years ago and if will take me one week, will likely just buy a new one, heh
 
mendark said:
Is there a way to unpack the 5.5.53 firmware, make the change and repack it for upload? I heard now there is crypto on them so checksums might not suffice...I may have to find my cracking hat from 20 years ago and dust it off :) of course, benefit vs time spent is now more important than it was 20 years ago and if will take me one week, will likely just buy a new one, heh
Click to expand...

You're better off buying an English camera and shipping the chinese camera to alastair so he'll have another sample to play with.
 
  • Like
Reactions: alastairstevenson
FYI,
For anyone else who ends up here on this thread.

I have been exactly the same experience, with 2 of these identical cameras constantly having the password reset without being touched.
My cameras are on internal network only with firewall.
It happens pretty much every ~6 months, so I think there is just something screwy in the firmware.
I always have to use the "Hikvision Password Reset Helper" to reset the password, though today for the first time both cameras went "Inactive" and I had to Activate them again.
I have 5 other Hikvision cameras (with same p/w) and they are never affected.

This is the version of my cameras:
DS-2CD3345-I
Firmware version: V5.4.20 build 160726

Both cameras are Chinese versions that had been set to English language.
For this reason, I won't be trying to update the firmware.
 
pjsaunders75 said:
My cameras are on internal network only with firewall.
It happens pretty much every ~6 months, so I think there is just something screwy in the firmware.
Click to expand...
Suggestion :
Check for open ports inbound using ShieldsUp! full ports scan : GRC | ShieldsUP! — Internet Vulnerability Profiling
Then access the cameras web GUI and see if UPnP is enabled. It usually is, by default. Disable it.
Then access your router and check if UPnP is disabled. If so disable it.
Then check ShieldsUp! again.

I'm speculating that the cameras have automatically opened ports inbound via UPnP and have been hacked.
The firmware you quoted suffers from the Hikvision 'backdoor vulnerability'.
 
  • Like
Reactions: pjsaunders75
Hi guys,
My results are:
I did check with "ShieldsUp!" and it did not detect any issues.
My cameras DID have UPnP enabled - I have now disabled for all cameras.
My router does have UPnP enabled - if I disable would that cause issues with playing multiplayer games etc?

Thanks,

Pat
 
pjsaunders75 said:
My cameras DID have UPnP enabled - I have now disabled for all cameras.
My router does have UPnP enabled - if I disable would that cause issues with playing multiplayer games etc?
Click to expand...
OK, with those settings, the cameras will be letting the whole internet in to access them.

pjsaunders75 said:
I did check with "ShieldsUp!" and it did not detect any issues.
Click to expand...
All service ports, and Hikvision's port 8000 command and control port?
 
alastairstevenson said:
OK, with those settings, the cameras will be letting the whole internet in to access them.


All service ports, and Hikvision's port 8000 command and control port?
Click to expand...

I did disable UPnP for all cameras and NVR.

The instant UPnP test: ACTIVELY REJECTED OUR UPnP PROBES!
Common Ports: Failed on 5000 (only)
Port 8000 probe: result = Stealth. (OK)

Not perfect, but much better now thanks.

BTW, what is the purpose is there in resetting the cameras...?
 
You must log in or register to reply here.
Top Bottom