We get quite a lot of posts about port forwarding - and quite a lot of good advice in response about the risks, and pointers to more secure remote access methods.
And we still get posts related to the Hikvision backdoor vulnerability, where camera passwords are mysteriously lost, or cameras disappear from the network.
So I thought it might be interesting to relieve a bit of the lockdown boredom and see how well a Hikvision camera survives being accessible from the internet.
The short answer - it doesn't.
I set up port forwarding and exposed to the internet a DS-2CD2432F-IW cube camera, running the backdoor-vulnerable 5.4.0 firmware, using wireshark to record the traffic.
There was no shortage of probes - though there were actually very few that were Hikvision-specific.
The majority of probes were against the high ports - with only a few against SSH, telnet and HTTP/80
I'd guessed that ports probed might be targeting known weaknesses in the very many types of devices that allow inbound access from the internet.
But there did seem to be quite a spread. Maybe graphing them would show a picture.
Here is a summary of the types of probes, simplistically just using the wireshark built-in stats to get the proportions of packets.
9655 packets over five and a half hours, about 30 packets per minute.
60/40 split UDP / TCP.
7939 probe sources.
Just 3 probe sources made up 30% of the total - Alibaba Germany, Alibaba CA, Alisoft CN. Weird.
1.1% of the probes were against telnet/23
Just 0.5% of the probes were HTTP/80 with most just doing a "GET /" as opposed to something more interesting.
And 0.2% of the probes were SSH
0.5% of the probes were TCP/8000 and about half resulted in an HTTP GET, so were aimed at alternate web access.
The rest pushed a few bytes at the camera, but were presumably not part of the Hikvision API as the camera didn't respond back.
OK, so far, so normal. At 30 packets per minute unsolicited, it really underlines the risks of using port forwarding to remotely access your cameras.
And the predominance of the high ports in use also underlines that using high ports doesn't really provide much protection.
So what next?
I shut down wireshark and left the camera on overnight.
Next morning, the camera was still normally accessible. I started up wireshark again.
After a short while, the captured packet rate shot right up.
The camera had been hit!
Immediately after a TCP 3-way handshake to port 80, there was a PUT using the Hikvision backdoor to change the admin password to asdf1234
This was used to log in to the camera web GUI.
Then a couple of snapshots were retrieved, and a long series of SDK and ISAPI commands issued to profile the camera and assess capabilities.
Judging from the rapid rate of these, the interaction was automated / scripted.
There was no attempt to start a video stream.
The final activity was to issue a PUT /ISAPI/System/factoryReset?mode=full HTTP/1.1 command and leave it with a pending reboot.
A normal user would have been left with an admin password problem, and an inaccessible camera after being rebooted.
So, after just under 24 hours, a Hikvision camera subject to port forwarding was probed by nearly 8000 sources, and hacked.
I'm not at all surprised.
Hopefully this experiment may open up a few eyes as to the genuine risks associated with port forwarding for remote access.
Easy to do and convenient that it is, it's certainly not cyber-safe.
And we still get posts related to the Hikvision backdoor vulnerability, where camera passwords are mysteriously lost, or cameras disappear from the network.
So I thought it might be interesting to relieve a bit of the lockdown boredom and see how well a Hikvision camera survives being accessible from the internet.
The short answer - it doesn't.
I set up port forwarding and exposed to the internet a DS-2CD2432F-IW cube camera, running the backdoor-vulnerable 5.4.0 firmware, using wireshark to record the traffic.
There was no shortage of probes - though there were actually very few that were Hikvision-specific.
The majority of probes were against the high ports - with only a few against SSH, telnet and HTTP/80
I'd guessed that ports probed might be targeting known weaknesses in the very many types of devices that allow inbound access from the internet.
But there did seem to be quite a spread. Maybe graphing them would show a picture.
Here is a summary of the types of probes, simplistically just using the wireshark built-in stats to get the proportions of packets.
9655 packets over five and a half hours, about 30 packets per minute.
60/40 split UDP / TCP.
7939 probe sources.
Just 3 probe sources made up 30% of the total - Alibaba Germany, Alibaba CA, Alisoft CN. Weird.
1.1% of the probes were against telnet/23
Just 0.5% of the probes were HTTP/80 with most just doing a "GET /" as opposed to something more interesting.
And 0.2% of the probes were SSH
0.5% of the probes were TCP/8000 and about half resulted in an HTTP GET, so were aimed at alternate web access.
The rest pushed a few bytes at the camera, but were presumably not part of the Hikvision API as the camera didn't respond back.
OK, so far, so normal. At 30 packets per minute unsolicited, it really underlines the risks of using port forwarding to remotely access your cameras.
And the predominance of the high ports in use also underlines that using high ports doesn't really provide much protection.
So what next?
I shut down wireshark and left the camera on overnight.
Next morning, the camera was still normally accessible. I started up wireshark again.
After a short while, the captured packet rate shot right up.
The camera had been hit!
Immediately after a TCP 3-way handshake to port 80, there was a PUT using the Hikvision backdoor to change the admin password to asdf1234
This was used to log in to the camera web GUI.
Then a couple of snapshots were retrieved, and a long series of SDK and ISAPI commands issued to profile the camera and assess capabilities.
Judging from the rapid rate of these, the interaction was automated / scripted.
There was no attempt to start a video stream.
The final activity was to issue a PUT /ISAPI/System/factoryReset?mode=full HTTP/1.1 command and leave it with a pending reboot.
A normal user would have been left with an admin password problem, and an inaccessible camera after being rebooted.
So, after just under 24 hours, a Hikvision camera subject to port forwarding was probed by nearly 8000 sources, and hacked.
I'm not at all surprised.
Hopefully this experiment may open up a few eyes as to the genuine risks associated with port forwarding for remote access.
Easy to do and convenient that it is, it's certainly not cyber-safe.
