New massive security whole in many dahua devices (ip-cam,vdp,...)!

[riogrande75]

Just found the reason why dahua produced so many new firmware's in mid of july: Seems to be related to CVE-2021-33044 and CVE-2021-33045 (Dahua-Authentication-Bypass).
So I warmly recommend to upgrade all devices, if they are placed in exposed areas.

 

[wittaj]

One of the many reasons why we say to isolate the cameras from the internet and never port forward, UPnP, P2P, etc...

It is ironic that security cameras have some of the worse internet security in them LOL....

 

[handinpalm]

Or they want you to upgrade to reveal more vulnerabilities. I would not trust a damn thing they say.

 

[sone]

Hah! My cams are isolating and not stepping a foot outside.

 

[eggzlot]

Quick question - back in 2018 I purchased a few Dahua cameras from Empire Andy based on this forum's help. I noticed one of the cameras falls into this latest security bulletin. When I click into the camera and go to update the firmware via a manual check it says it has the latest firmware (dated 2018). On the Dahua website there is a ton of additional firmware files relevant to this series of camera - SD1A1. Should I download something from the Dahua site, or just let it go because maybe these are gray market with different firmware?

 

[wittaj]

Quick question - back in 2018 I purchased a few Dahua cameras from Empire Andy based on this forum's help. I noticed one of the cameras falls into this latest security bulletin. When I click into the camera and go to update the firmware via a manual check it says it has the latest firmware (dated 2018). On the Dahua website there is a ton of additional firmware files relevant to this series of camera - SD1A1. Should I download something from the Dahua site, or just let it go because maybe these are gray market with different firmware?

These cameras can be updated with stuff on Dahua website, but if your camera is isolated from the internet, then there is no need to update it.

But to be safe, I would search this forum for the latest firmware on that camera that Andy posted.

 

[eggzlot]

These cameras can be updated with stuff on Dahua website, but if your camera is isolated from the internet, then there is no need to update it.

But to be safe, I would search this forum for the latest firmware on that camera that Andy posted.

Thanks - I don't port forward if that is what you mean. I use Blue Iris to view the cameras. UPnP is off. I don't see a P2P option. Anything else I should look at?

 

[wittaj]

Are your cameras on a different IP address like a dual NIC or VLANs?

 

[eggzlot]

Are your cameras on a different IP address like a dual NIC or VLANs?

no - my internal LAN scheme is 10.xx.x.xx and Blue Iris and my Cameras are both on that IP scheme.

 

[wittaj]

What about the rest of your internet? Is every device at home on the same 10.x.x.x. scheme and do the cameras go thru the router?

If so, you could do the child protect in the router to prevent them from accessing the internet.

 

[eggzlot]

What about the rest of your internet? Is every device at home on the same 10.x.x.x. scheme and do the cameras go thru the router?

If so, you could do the child protect in the router to prevent them from accessing the internet.

Yes all devices 10.x.x.x scheme and cameras go through the my PoE switch which is plugged into my Mikrotik router. I can look at those settings (its like a foreign language) to see if I can do some sort of prevention from accessing the internet.

 

[cmos]

More information on the issue..

Unpatched Dahua cams vulnerable to unauthenticated remote access

Unpatched Dahua cameras are prone to two authentication bypass vulnerabilities, and a proof of concept exploit that came out today makes the case of upgrading pressing.

www.bleepingcomputer.com

 

[bashis]

You should keep an eye on Cyber Security at IPCamTalk, then you would have seen "Dahua CVE-2021-33044; CVE-2021-33045"

Have a nice day

 

[looney2ns]

Quick question - back in 2018 I purchased a few Dahua cameras from Empire Andy based on this forum's help. I noticed one of the cameras falls into this latest security bulletin. When I click into the camera and go to update the firmware via a manual check it says it has the latest firmware (dated 2018). On the Dahua website there is a ton of additional firmware files relevant to this series of camera - SD1A1. Should I download something from the Dahua site, or just let it go because maybe these are gray market with different firmware?

How to Secure Your Network (Don't Get Hacked!) | IP Cam Talk

 

[EMPIRETECANDY]

Yes, IPVM report this after dahua release. Dahua also has 3rd party lab now to test their product cyber security.
Most firmware i already posted on the forum EmpireTech Andy

 

[eggzlot]

Thanks all - I have UPnP off, Port Forwarding off and I don't use a VPN but as mentioned I use Blue Iris. I'll update the firmware from Andy as listed above too just to be safe.

 

[tibimakai]

How you use Blue Iris remotely? I have to use VPN to use UI3. That is the correct way, right?

 

[sebastiantombs]

VPN and either UI3 or the BI app on an Android phone here.

 

[sdkid]

Thanks all - I have UPnP off, Port Forwarding off and I don't use a VPN but as mentioned I use Blue Iris. I'll update the firmware from Andy as listed above too just to be safe.

When you say you use BI --- you mean when you are at home on your LAN-- right? If you are viewing it away from home, then you have your network open and vulnerable to the outside. You need some kind of VPN for encrypted access to your LAN when you are away from home.

 

[eggzlot]

When you say you use BI --- you mean when you are at home on your LAN-- right? If you are viewing it away from home, then you have your network open and vulnerable to the outside. You need some kind of VPN for encrypted access to your LAN when you are away from home.

I am using BI remotely via their encryption at or at least I assumed (maybe incorrectly) that there was some level of encryption/security on the end of BI. I do have a VPN that I use for other tasks, I guess I could not let BI speak to the outside world and just turn on my VPN then open the BI app.