Thousands of Hikvision cameras in South Africa affected by critical security flaw

[Jan]

Critical security vulnerability affects thousands of Hikvision cameras in South Africa

CYFIRMA security researchers have discovered thousands of Hikvision cameras used in over 100 countries worldwide that are vulnerable to a critical command injection security flaw.

The flaw is tracked as CVE-2021-36260 and has a critical Common Vulnerability Scoring System rating of 9.8.

 

[lkswan747]

Is there a way to see if my system is affected?

 

[MikeaMatrix]

 

[deweyzeph]

This is exactly why I have all my IP cameras on a separate VLAN with no internet access on my network. The only device that can access my cameras is my Synology NAS. They have no way of connecting to the internet at all.

 

[airborne]

This is exactly why I have all my IP cameras on a separate VLAN with no internet access on my network. The only device that can access my cameras is my Synology NAS. They have no way of connecting to the internet at all.

How do you remotely monitor your cameras?

 

[deweyzeph]

How do you remotely monitor your cameras?

From the NAS device. Synology Surveillance Station.

 

[RonSwanson]

Putting a camera directly on the Internet is not a good idea. I don’t care whose camera it is.

--Chuck Davis, Hikvision's Cybersecurity "guru"

Hikvision’s cybersecurity guru - SP&T News

Many surveillance vendors have come under increased scrutiny in recent years as critics point to the industry’s spotty record on cybersecurity.

www.sptnews.ca

 

[RonSwanson]

How do you remotely monitor your cameras?

Very carefully, with a strategy that includes some security tech-savy implementation and operations.

 

[RonSwanson]

Is there a way to see if my system is affected?

shodan.io
LOL
or you can just implement a properly configured VPN.

 

[ubercal]

This is exactly why I have all my IP cameras on a separate VLAN with no internet access on my network. The only device that can access my cameras is my Synology NAS. They have no way of connecting to the internet at all.

try get the cctv installers to understand vlans and even better implement it ... good luck

 

[lkswan747]

shodan.io
LOL
or you can just implement a properly configured VPN.

It was asked "tongue in cheek"

 

[deweyzeph]

try get the cctv installers to understand vlans and even better implement it ... good luck

That's why I do it myself. CCTV installers are useful for running conduits and laying cable and doing all the shitty manual labour but generally they know fokol about configuring advanced networks.

 

[Mystic Twilight]

try get the cctv installers to understand vlans and even better implement it ... good luck

Cost will be an issue, your average consumer is going to complain about buying a vlan capable switch that is at least five times the cost of a dumb switch.

 

[ubercal]

Cost will be an issue, your average consumer is going to complain about buying a vlan capable switch that is at least five times the cost of a dumb switch.

most businesses that run cctv dont evem use vlans.Sommer just plug in and disppear.

 

[RonSwanson]

most businesses that run cctv dont evem use vlans.Sommer just plug in and disppear.

vlans aren't a guarantee of security

 

[ubercal]

vlans aren't a guarantee of security

its 1 layer of multiple layers uncle.Still better then 99% of installers where the default username and password is left unchanged.

 

[Paul_S]

<snip> they know fokol about configuring advanced networks.

VLANs are basic networking to be honest and should be a requirement for any security installation. VLAN capable managed switches are not that expensive compared to a couple of decent 4MP+ IP CCTV cameras.

I'd consider advanced networking to be more along the lines of IS-IS, OSPF, BGP, etc. but that's highly unlikely to be a requirement with the vast majority of SMB/residential installations. Installers should up their game and offer a secure package including a Ubiquiti/Mikrotik firewall.

 

[ubercal]

VLANs are basic networking to be honest and should be a requirement for any security installation. VLAN capable managed switches are not that expensive compared to a couple of decent 4MP+ IP CCTV cameras.

I'd consider advanced networking to be more along the lines of IS-IS, OSPF, BGP, etc. but that's highly unlikely to be a requirement with the vast majority of SMB/residential installations. Installers should up their game and offer a secure package including a Ubiquiti/Mikrotik firewall.

you would be surprised at how many IT people dont even know how to setup vlans

 

[BrandonJ]

That's why I do it myself. CCTV installers are useful for running conduits and laying cable and doing all the shitty manual labour but generally they know fokol about configuring advanced networks.

Seems to me you are the guys using refugees to do your installs for cheap labour. Clearly not using reputable cctv installation companies.

Generally, network management in corporates or business is the domain of that it department or provider. They don't exactly want anybody else physically intruding to their systems.

We do however meet with the providers and advise on our requirements for the establishment of the vlan and the ports and protocols that we will be using.

Generally I find that 50% of those it providers battle to follow along.

 

[LCBXX]

That's why I do it myself. CCTV installers are useful for running conduits and laying cable and doing all the shitty manual labour but generally they know fokol about configuring advanced networks.

Respect shitty, manual, labour.