Security Cameras with Security Flaws
Dahua and Hikvision Poor Track Record
Both Dahua and Hikvision have a poor cybersecurity track record, with Dahua’s backdoor gaining a 9.8 out of 10.0 score from DHS ICS-CERT and Hikvision’s backdoor gaining a 10.0 out of 10.0 score from DHS ICS-CERT.
Both DHS advisories were issued in May 2017 and are therefore quite recent. That is not all. Dahua’s security vulnerabilities were a key factor in the large-scale Mira botnet attacks of Fall 2016. And Hikvision continues to have new vulnerabilities discovered regularly.
Moreover, both companies struggle to responsibly, pro-actively and appropriately communicate the risks involved. For example, Dahua claimed to be a ‘victim’ of Mirai, has never released a full list of products impacted by their backdoor and failed to properly address another vulnerability in July 2017. Likewise, Hikvision has repeatedly shown they will hide known vulnerabilities until and unless they face bad press.
Cyber security is clearly an increasing problem for Dahua and Hikvision.
Both companies are fundamentally fast moving, mass market, hardware focused, low price models.
This fits poorly with the more careful and thorough software development expertise and open communication processes needed to be strong at cyber security. And this is a concern even without the role of the Chinese government and their control of Hikvision.
Combining those elements, we expect large corporations and Western government institutions to become even more concerned about Dahua and Hikvision especially as understanding of these company’s risks increases.
Less expensive options are not always the best options.