Internet Provider BELL warning vulnerabilty HIK Vision Camera

F

fyler2013

n3wb
Apr 19, 2018
8
6
Hello,
I got email warning about my HIKvision camera do i need to update firmware?? or what should i do?
Model= DS-2CD1141-I
V5.4.5build 170124
Device Serial # DS-2CD1141-I20170407BBWR********
DSP Version V7.3 build 170119

HERE is the Emailed;

Dear ****,
Bell Internet has received a report from Public Safety Canada indicating
an IP camera device detected operating behind your Bell Internet
connection maybe vulnerable and open to exploitation. We have provided
the complete report below & recommend that you review the references &
secure the device to prevent data theft, misuse of the device by unknown
parties, and misuse of the internet connection. If you are unable to
secure your device we suggest you consult the operation manual or
contact manufacturer directly.

Regards,

Chris
Internet Abuse Analyst
Bell Internet
[email protected] / [email protected]

From: "CCIRC / CCRIC (PS/SP)" <[email protected]>
To: "[email protected]" <[email protected]>
Subject: CE18-25566 [Vulnerable Network Device - Hikvision IP Cameras]
Date: Wed, 28 Mar 2018 12:12:38 +0000

Original Message Follows:
------------------------

In support of Public Safety's mission to build a safe and resilient
Canada, CCIRC's mandate is to help ensure the security and resilience of
the vital non-federal government cyber systems that underpin Canada's
national security, public safety and economic prosperity.

CCIRC has been made aware of devices which are hosted on your network
and may be vulnerable to remote unauthorized access. Successful
exploitation of these vulnerabilities could lead to a malicious attacker
escalating his or her privileges or assuming the identity of an
authenticated user and obtaining sensitive data.

You are receiving this notification because you are identified as a
technical contact for the affected asset(s). CCIRC recommends that
security personnel locate, investigate and apply appropriate mitigation
measures.

If you are not the correct person to be dealing with this incident,
please forward this request to the appropriate person or agency.
Hikvision reports that the following cameras and versions are affected:


DS-2CD2xx2F-I Series
V5.2.0 build 140721 to V5.4.0 build 160530
DS-2CD2xx0F-I Series
V5.2.0 build 140721 to V5.4.0 Build 160401
DS-2CD2xx2FWD Series
V5.3.1 build 150410 to V5.4.4 Build 161125
DS- 2CD4x2xFWD Series
V5.2.0 build 140721 to V5.4.0 Build 160414
DS-2CD4xx5 Series
V5.2.0 build 140721 to V5.4.0 Build 160421
DS-2DFx Series
V5.2.0 build 140805 to V5.4.5 Build 160928
DS-2CD63xx Series
V5.0.9 build 140305 to V5.3.5 Build 160106

The following brands of IP cameras may be affected: 3xLogic, Abus,
Acegear, Activecam, Advidia, Alibi, Alkam, Allnet, American Video
Equipment, Annke, Arcvision, Armix, ASAP Technology, AVUE, Balter
Security, BV Security, Clare Controls, CMR, Derytech, Diamond,
Digiguard, Digital Watchdog, DigitalNet, Dinox, DMP, Dunlop,
EasternCCTV, Easy Peace, Elisa Live, Epcom, evision, Ewlon, GovComm,
HeiVision, HQ Vision, HUNT CCTV, Huviron, Imago, Interlogix, InVid,
KNIGHT, Ksenia, KT&C, LaView, Lorex (older hardware than current
offerings), LTS, LTV, Luxon, Matrix, Mazi, Nelly's Security, NetVision,
netZeye, Nodac Technology, Novicam, Oco, Oculur, Onix Systems, People
Fu, Perseus, Provision ISR, PTZ Optics, Rainvision, RVI, Safire,
SavvySecu, Secuinfo, Simply Monitored, Sonitrol, Space Technology,
Swann, Tecvoz, TrendNet, Unix, Vantage, Vertina, Vertiv, Video Insight,
Videoteknika, W-Box, Watcher Total Protection, Winic, Wonderx and ZNV.
 
  • Like
Reactions: mat200
Hi Fyler2013,

Sounds like port forwarding on going on at your home.

Check for port forwarding rules on your router, disable UPnP, disable port forwarding, run anti-virus scan on your network devices, watch for your cameras wanting to send packets outside your network, read VPN notes here and setup a VPN. If your cameras / NVR got jacked you will need to reflash them.
 
Last edited:
So The Canadian Government is telling a private ISP's that they have customers who's devices that are compromised. Imagine how much they really know about you. It goes on here in the states too, We have seen how easy it is to search for those devices by the example from Shodan and IPVM. I have mixed feelings about that but I guess its a good thing in this case.
 
  • Like
Reactions: alastairstevenson and mat200
Thanks Mat200, Mr_D and c hris527.
I did check router and Hik camera and both UPnP are ON and port forwarding is ON. Now I turn it OFF all. Will this fixed my issue?? or should update the camera?
I did Shield UP test, and now everything is green/PASS
 

Attachments

  • Test1.PNG
    Test1.PNG
    97.8 KB · Views: 19
  • Like
Reactions: mat200
did you do one before? for a comp
fyler2013 said:
Thanks Mat200, Mr_D and c hris527.
I did check router and Hik camera and both UPnP are ON and port forwarding is ON. Now I turn it OFF all. Will this fixed my issue?? or should update the camera?
I did Shield UP test, and now everything is green/PASS
Click to expand...
?
 
  • Like
Reactions: fyler2013
Yes, i did one before I turn OFF the UPnP and Port forwarding and shows port 1018, 80 and others, and shows red.
After fixing router and camera, run test and now green/pass
 
  • Like
Reactions: mat200
Hi Flyer2013,

I would try to isolate your security cameras and see what they maybe doing, as there is a good chance they've been compromised by a bot and are silently waiting to become a zombie...

One way to do this is to put a router or firewall type device between your camera network and your LAN.

You can also use programs like wireshare to check packets.

To be safe, and yes I know it will be some work - I would re-flash ( re-install ) the cameras and NVR w/their software
 
  • Like
Reactions: fyler2013 and c hris527
@fyler2013 ,
You should run the "All Service Ports" not just the "Common Ports" test from ShieldsUP.
 
  • Like
Reactions: fyler2013
This was actually a very good email for you to receive. UPNP is a definite NONO.
I actually disable my hikvision nvr from accessing the outside internet and its only viewable when I connect through my home VPN

The vulnerability is in your cameras firmware. That specific version allows anyone to see your cameras without a username password. The fact that UPNP was on and ports were forwarded means that anyone can view your cameras (and probably has).

Disable UPNP! If your are computer savvy enough, use the tutorials in the forum to hack your cameras and update it to the latest 5.4.5. Vulnerability was patched

If you dont know how to disable UPNP ill be able to help. Just give me your routers model number and ill look it up online for you.

If you still cant figure it out, I can teamviewer in and do it for you.
 
  • Like
Reactions: mat200 and fyler2013
Hello Thanks for everyone for the help and suggestion.

I'm planning to update the firmware of this camera before I put it back is service.
Can someone please point me, where can get or download the current firmware PLEASE!!!
Then I will redo the testing of all ports.

Model= DS-2CD1141-I
V5.4.5build 170124
Device Serial # DS-2CD1141-I20170407BBWR********
DSP Version V7.3 build 170119
 
For a camera with WR in the serial, your firmware should come from the UK site.

Just hunt for the proper one for your camera model.

DOWNLOAD PORTAL
 
Hello,
Its very HARD to find firmware for my camera and very confusing.
I found something but not sure IF its the one I need for my camera.

IPC_EN_NEU_5.4.5_170124 -------I think this is current firmware just downloaded online

IPC_R6_EN_STD_5.5.0_170725----I think this is the latest one NOT sure coz its R6 ????


Model= DS-2CD1141-I
V5.4.5build 170124
Device Serial # DS-2CD1141-I20170407BBWR********
DSP Version V7.3 build 170119
 
Thanks C hris and chev.

I tried looking in Nellys security but no luck.
I tried again on HIKvision europe and found it I think? Yes I think its R6

I think this is the one:

IPC_R6_EN_STD_5.5.5_180111

Now just reading how to backup my current firmware and update the new one
 

Attachments

  • Capture1.PNG
    Capture1.PNG
    57.6 KB · Views: 6
  • Capture2.PNG
    Capture2.PNG
    63.3 KB · Views: 5
  • Like
Reactions: c hris527 and 58chev
Why upgrade the camera firmware at all? It won't make it safe to port forward, and you'll lose the ability to use password-resetting tools that exploit the commonly-known backdoor vulnerability. Then you will be at the mercy of Hikvision support when your camera gets hacked again and the hacker changes your password (if you left the camera accessible to the internet).
 
  • Like
Reactions: fenderman
bp2008 said:
Why upgrade the camera firmware at all? It won't make it safe to port forward, and you'll lose the ability to use password-resetting tools that exploit the commonly-known backdoor vulnerability. Then you will be at the mercy of Hikvision support when your camera gets hacked again and the hacker changes your password (if you left the camera accessible to the internet).
Click to expand...

Because there's a chance his camera was already owned while it was exposed. Taking it offline and restoring the firmware to a known-good image is the only way to make sure it isn't still compromised.
 
You must log in or register to reply here.
Top Bottom