Xiongmai Technology IP Cameras and DVRs HACKED

[fenderman]

Xiongmai Technology IP Cameras and DVRs | ICS-CERT
Xiongmai Does not respond.
AFFECTED PRODUCTS
The following versions of Xiongmai Technology IP cameras and DVRs are affected:

• All IP Cameras and DVRs using the NetSurveillance Web interface.

 

[EMPIRETECANDY]

Xiongmai is the supplier for many IP cams manufactures from China..

 

[fenderman]

Xiongmai is the supplier for many IP cams manufactures from China..

yes, that is the big issue...there are lots of devices affected...

 

[EMPIRETECANDY]

yes, that is the big issue...there are lots of devices affected...

I checked with dahua guys, they not use their solutions. Most cheap IP Cams use their solutions as i know.

 

[fenderman]

I checked with dahua guys, they not use their solutions. Most cheap IP Cams use their solutions as i know.

this is not the first time the have had problems..Hacked Cameras, DVRs Powered Today’s Massive Internet Outage — Krebs on Security

 

[marku2]

That was a good read (and all the comments turn off upnp ) as you always say.
soon there will be camera control around the world

 

[alastairstevenson]

For the determined researcher it's remarkable what you can find when you look.
Another widely-used firmware is that from Herospeed Technology.
I wonder if I should report my 'enable telnet with root access' hack that is so easy on their V7.x series of firmware with the 'Lucky787' access protection.

 

[Kawboy12R]

I'm sure the Chinese gov't is already aware of that one Alastair but you might let Herospeed know as well.

 

[framednlv]

Xiongmai Technology IP Cameras and DVRs | ICS-CERT
Xiongmai Does not respond.
AFFECTED PRODUCTS
The following versions of Xiongmai Technology IP cameras and DVRs are affected:

• 
  
  
  • All IP Cameras and DVRs using the NetSurveillance Web interface.

Does anyone have a snapshot of the user interface for this?

 

[c hris527]

Does anyone have a snapshot of the user interface for this?

A quick google search turned up this.
Standalone DVR CCTV DVR recorder{5008E-S} shop for sale in China (Mainland) - Hangzhou Xiongmai Technology Co., Ltd.

 

[framednlv]

I have a couple NVRs and the one I bought my father that uses that setup. One was from Nelly's and one is a new board I bought for $30. I guess I need to block them and use my VPN.