Internet Provider BELL warning vulnerabilty HIK Vision Camera

[fyler2013]

Hello,
I got email warning about my HIKvision camera do i need to update firmware?? or what should i do?
Model= DS-2CD1141-I
V5.4.5build 170124
Device Serial # DS-2CD1141-I20170407BBWR********
DSP Version V7.3 build 170119

HERE is the Emailed;

Dear ****,
Bell Internet has received a report from Public Safety Canada indicating
an IP camera device detected operating behind your Bell Internet
connection maybe vulnerable and open to exploitation. We have provided
the complete report below & recommend that you review the references &
secure the device to prevent data theft, misuse of the device by unknown
parties, and misuse of the internet connection. If you are unable to
secure your device we suggest you consult the operation manual or
contact manufacturer directly.

Regards,

Chris
Internet Abuse Analyst
Bell Internet
abuse@bellnet.ca / abuse@bell.ca

From: "CCIRC / CCRIC (PS/SP)" <ps.ccirc-ccric.sp@canada.ca>
To: "abuse@bell.ca" <abuse@bell.ca>
Subject: CE18-25566 [Vulnerable Network Device - Hikvision IP Cameras]
Date: Wed, 28 Mar 2018 12:12:38 +0000

Original Message Follows:
------------------------

In support of Public Safety's mission to build a safe and resilient
Canada, CCIRC's mandate is to help ensure the security and resilience of
the vital non-federal government cyber systems that underpin Canada's
national security, public safety and economic prosperity.

CCIRC has been made aware of devices which are hosted on your network
and may be vulnerable to remote unauthorized access. Successful
exploitation of these vulnerabilities could lead to a malicious attacker
escalating his or her privileges or assuming the identity of an
authenticated user and obtaining sensitive data.

You are receiving this notification because you are identified as a
technical contact for the affected asset(s). CCIRC recommends that
security personnel locate, investigate and apply appropriate mitigation
measures.

If you are not the correct person to be dealing with this incident,
please forward this request to the appropriate person or agency.
Hikvision reports that the following cameras and versions are affected:


DS-2CD2xx2F-I Series
V5.2.0 build 140721 to V5.4.0 build 160530
DS-2CD2xx0F-I Series
V5.2.0 build 140721 to V5.4.0 Build 160401
DS-2CD2xx2FWD Series
V5.3.1 build 150410 to V5.4.4 Build 161125
DS- 2CD4x2xFWD Series
V5.2.0 build 140721 to V5.4.0 Build 160414
DS-2CD4xx5 Series
V5.2.0 build 140721 to V5.4.0 Build 160421
DS-2DFx Series
V5.2.0 build 140805 to V5.4.5 Build 160928
DS-2CD63xx Series
V5.0.9 build 140305 to V5.3.5 Build 160106

The following brands of IP cameras may be affected: 3xLogic, Abus,
Acegear, Activecam, Advidia, Alibi, Alkam, Allnet, American Video
Equipment, Annke, Arcvision, Armix, ASAP Technology, AVUE, Balter
Security, BV Security, Clare Controls, CMR, Derytech, Diamond,
Digiguard, Digital Watchdog, DigitalNet, Dinox, DMP, Dunlop,
EasternCCTV, Easy Peace, Elisa Live, Epcom, evision, Ewlon, GovComm,
HeiVision, HQ Vision, HUNT CCTV, Huviron, Imago, Interlogix, InVid,
KNIGHT, Ksenia, KT&C, LaView, Lorex (older hardware than current
offerings), LTS, LTV, Luxon, Matrix, Mazi, Nelly's Security, NetVision,
netZeye, Nodac Technology, Novicam, Oco, Oculur, Onix Systems, People
Fu, Perseus, Provision ISR, PTZ Optics, Rainvision, RVI, Safire,
SavvySecu, Secuinfo, Simply Monitored, Sonitrol, Space Technology,
Swann, Tecvoz, TrendNet, Unix, Vantage, Vertina, Vertiv, Video Insight,
Videoteknika, W-Box, Watcher Total Protection, Winic, Wonderx and ZNV.

 

[mat200]

Hi Fyler2013,

Sounds like port forwarding on going on at your home.

Check for port forwarding rules on your router, disable UPnP, disable port forwarding, run anti-virus scan on your network devices, watch for your cameras wanting to send packets outside your network, read VPN notes here and setup a VPN. If your cameras / NVR got jacked you will need to reflash them.

 

[fyler2013]

Thanks Mat200 will check my router setting and ip camera for UPnP

 

[Mr_D]

After securing your network, run a scan at GRC | ShieldsUP! — Internet Vulnerability Profiling   to see if you still have any open ports. Disabling uPnP is critical since it allows devices to open holes in your firewall without your knowledge or consent.

 

[c hris527]

So The Canadian Government is telling a private ISP's that they have customers who's devices that are compromised. Imagine how much they really know about you. It goes on here in the states too, We have seen how easy it is to search for those devices by the example from Shodan and IPVM. I have mixed feelings about that but I guess its a good thing in this case.

 

[fyler2013]

Thanks Mat200, Mr_D and c hris527.
I did check router and Hik camera and both UPnP are ON and port forwarding is ON. Now I turn it OFF all. Will this fixed my issue?? or should update the camera?
I did Shield UP test, and now everything is green/PASS

 

[c hris527]

did you do one before? for a comp

Thanks Mat200, Mr_D and c hris527.
I did check router and Hik camera and both UPnP are ON and port forwarding is ON. Now I turn it OFF all. Will this fixed my issue?? or should update the camera?
I did Shield UP test, and now everything is green/PASS

?

 

[fyler2013]

Yes, i did one before I turn OFF the UPnP and Port forwarding and shows port 1018, 80 and others, and shows red.
After fixing router and camera, run test and now green/pass

 

[mat200]

Hi Flyer2013,

I would try to isolate your security cameras and see what they maybe doing, as there is a good chance they've been compromised by a bot and are silently waiting to become a zombie...

One way to do this is to put a router or firewall type device between your camera network and your LAN.

You can also use programs like wireshare to check packets.

To be safe, and yes I know it will be some work - I would re-flash ( re-install ) the cameras and NVR w/their software

 

[58chev]

@fyler2013 ,
You should run the "All Service Ports" not just the "Common Ports" test from ShieldsUP.

 

[tmushy]

This was actually a very good email for you to receive. UPNP is a definite NONO.
I actually disable my hikvision nvr from accessing the outside internet and its only viewable when I connect through my home VPN

The vulnerability is in your cameras firmware. That specific version allows anyone to see your cameras without a username password. The fact that UPNP was on and ports were forwarded means that anyone can view your cameras (and probably has).

Disable UPNP! If your are computer savvy enough, use the tutorials in the forum to hack your cameras and update it to the latest 5.4.5. Vulnerability was patched

If you dont know how to disable UPNP ill be able to help. Just give me your routers model number and ill look it up online for you.

If you still cant figure it out, I can teamviewer in and do it for you.

 

[fyler2013]

Hello Thanks for everyone for the help and suggestion.

I'm planning to update the firmware of this camera before I put it back is service.
Can someone please point me, where can get or download the current firmware PLEASE!!!
Then I will redo the testing of all ports.

Model= DS-2CD1141-I
V5.4.5build 170124
Device Serial # DS-2CD1141-I20170407BBWR********
DSP Version V7.3 build 170119

 

[58chev]

For a camera with WR in the serial, your firmware should come from the UK site.

Just hunt for the proper one for your camera model.

DOWNLOAD PORTAL

 

[john-ipvm]

@58chev, US / NA cameras also have WR in their serial numbers so I don't think that 'WR' alone indicates UK firmware.

 

[fyler2013]

Hello,
Its very HARD to find firmware for my camera and very confusing.
I found something but not sure IF its the one I need for my camera.

IPC_EN_NEU_5.4.5_170124 -------I think this is current firmware just downloaded online

IPC_R6_EN_STD_5.5.0_170725----I think this is the latest one NOT sure coz its R6 ????


Model= DS-2CD1141-I
V5.4.5build 170124
Device Serial # DS-2CD1141-I20170407BBWR********
DSP Version V7.3 build 170119

 

[c hris527]

Check nellys security, they might have the firmware you are looking for.

 

[58chev]

I search you model number in the Excel sheet http://www.hikvisioneurope.com/portal/portal/Product Firmware/Front-ends/01--IPC/List of IPC R0,R1,R2,R3,R4,R6,R7,G1,E0,E2_ V2.1_170313.xlsx

Shows it under the R6 but V5.4.5

 

[fyler2013]

Thanks C hris and chev.

I tried looking in Nellys security but no luck.
I tried again on HIKvision europe and found it I think? Yes I think its R6

I think this is the one:

IPC_R6_EN_STD_5.5.5_180111

Now just reading how to backup my current firmware and update the new one

 

[bp2008]

Why upgrade the camera firmware at all? It won't make it safe to port forward, and you'll lose the ability to use password-resetting tools that exploit the commonly-known backdoor vulnerability. Then you will be at the mercy of Hikvision support when your camera gets hacked again and the hacker changes your password (if you left the camera accessible to the internet).

 

[Mr_D]

Why upgrade the camera firmware at all? It won't make it safe to port forward, and you'll lose the ability to use password-resetting tools that exploit the commonly-known backdoor vulnerability. Then you will be at the mercy of Hikvision support when your camera gets hacked again and the hacker changes your password (if you left the camera accessible to the internet).

Because there's a chance his camera was already owned while it was exposed. Taking it offline and restoring the firmware to a known-good image is the only way to make sure it isn't still compromised.