4 ms·

"Hikvision has a long history of cybersecurity vulnerabilities affecting their products": https://ipvm.com/reports/hik-backdoor https://ipvm.com/reports/hik-ba

by trevyn 9y ago

"Hikvision has a long history of cybersecurity vulnerabilities affecting their products": https://ipvm.com/reports/hik-backdoor https://ipvm.com/reports/hik-backdoor It's not pretty. You're bordering on negligence using Hikvision, much less recommending them.

mattferderer 9y ago
Thank you as I was unaware of this. At quick glance of what you shared, it doesn't seem like most users should be effected by this. I'm assuming the typical setup is putting your cameras on a router & then using software like Blue Iris if you want to allow remote access to the videos. I would hope no one actually allows someone to connect directly to a camera using the camera's software over the internet. Am I missing some larger vulnerability?
- trevyn 9y ago
  If your approach to network security is "putting your cameras on a router", I don't suppose you'd mind me attaching this little black box to your network?
  - mattferderer 9y ago
    That requires getting your box connected to my network through a network cable. I'm not saying that what I suggested is flawless security. I'm just asking if it is preventing the attacks in the link you included.
    - trevyn 9y ago
      That is the wrong question to ask.
  - mc32 9y ago
    Can't you put those cams on a poe and your sec machine would have two nics, one to the poe, one to your house network? Dont route btwn nics.
tacoman 9y ago
I have Hikvision cameras, but they are on their own private lan with no Internet connection. These things phone home by default and disabling that functionality is kind of buried in the web interface.
DrPhish 9y ago
IoT (and especially IIoT) devices are special beasts that really don't fit well into the existing network security models. For ones that need cloud access, they really shouldn't be accessible from the rest of the network, let alone the internet. They also shouldn't be able to talk to each other. This leads to either ACL hell, or VLAN hell (with a L2 wire type firewall or L3 router/firewall). There are some solutions like ForeScout that will do this for you automagically, and software defined networking also holds promise in making this less nightmare inducing, but for now it is a poorly addressed problem AFAIK. This isn't news, but the best way to deal with cameras is to isolate them on a VLAN that has no route out. Just connect one NIC of your DVR solution to that VLAN, and broker all access thru the DVR. Only view cameras via the DVR software. You really shouldn't be putting your security footage into the cloud anyway, IMO. It creates too many unneeded dependencies in this age of cheap LAN/CPU/HD space. Replicating that footage into the cloud is defensible, but that should still all be moderated via the DVR solution. A UPS and Cellular internet connection could make cloud options more resilient. Please correct me if I am unaware of some awesome way of doing this!

by trevyn 9y ago

mattferderer 9y ago

Thank you as I was unaware of this. At quick glance of what you shared, it doesn't seem like most users should be effected by this. I'm assuming the typical setup is putting your cameras on a router & then using software like Blue Iris if you want to allow remote access to the videos. I would hope no one actually allows someone to connect directly to a camera using the camera's software over the internet. Am I missing some larger vulnerability?

trevyn 9y ago
If your approach to network security is "putting your cameras on a router", I don't suppose you'd mind me attaching this little black box to your network?
- mattferderer 9y ago
  That requires getting your box connected to my network through a network cable. I'm not saying that what I suggested is flawless security. I'm just asking if it is preventing the attacks in the link you included.
  - trevyn 9y ago
    That is the wrong question to ask.
- mc32 9y ago
  Can't you put those cams on a poe and your sec machine would have two nics, one to the poe, one to your house network? Dont route btwn nics.

tacoman 9y ago

I have Hikvision cameras, but they are on their own private lan with no Internet connection. These things phone home by default and disabling that functionality is kind of buried in the web interface.

DrPhish 9y ago

IoT (and especially IIoT) devices are special beasts that really don't fit well into the existing network security models. For ones that need cloud access, they really shouldn't be accessible from the rest of the network, let alone the internet. They also shouldn't be able to talk to each other. This leads to either ACL hell, or VLAN hell (with a L2 wire type firewall or L3 router/firewall). There are some solutions like ForeScout that will do this for you automagically, and software defined networking also holds promise in making this less nightmare inducing, but for now it is a poorly addressed problem AFAIK. This isn't news, but the best way to deal with cameras is to isolate them on a VLAN that has no route out. Just connect one NIC of your DVR solution to that VLAN, and broker all access thru the DVR. Only view cameras via the DVR software. You really shouldn't be putting your security footage into the cloud anyway, IMO. It creates too many unneeded dependencies in this age of cheap LAN/CPU/HD space. Replicating that footage into the cloud is defensible, but that should still all be moderated via the DVR solution. A UPS and Cellular internet connection could make cloud options more resilient. Please correct me if I am unaware of some awesome way of doing this!