![]() The number of Hikvision cameras that have been hacked in some way are certainly far greater, since this map only shows IP cameras that have not been fixed by December 2017. These cameras, by definition, are excluded, since they can no longer be reached. Many Hikvision IP cameras have been reported as being brought offline, either to update firmware and resolve the vulnerability or to remove remote connectivity to them when users realize the risks of placing vulnerable cameras on the internet. Devices are added (or removed) daily, IP addresses may have changed, or units may have been temporarily offline during scans. While it is impossible to estimate what percentage of accessible Hikvision devices are in Shodan's database, we can guarantee there are more vulnerable/hacked devices than just those shown on the map.Įxcludes Bricked / Hacked Offline Cameras This map shows only Hikvision-branded cameras, if OEMs are included (see 80+ Hikvision OEM Directory), the map would have 5,000+ points in the US alone, and many more in Europe.Īdditionally, while Shodan has a large number of Hikvision devices in its database, Shodan does not represent all of the internet-accessible Hikvision devices. Many owners of these cameras are unaware of this backdoor which exposes their cameras. Though Hikvision argues they patched the backdoor once they were made aware of it, they still shipped millions of cameras with this vulnerability, of which numerous are installed across Europe. By shipping cameras with a hard-coded backdoor, Hikvision exposes EU citizens to such data disclosures without consent. The EU General Data Protection Regulation (GDPR), set to go in effect May 25, 2018, specifies potential fines for companies that expose data that can directly or indirectly identify a citizen of the EU without their consent. The geolocation data was used to plot points, using Google Maps, with the snapshots associated with each camera/location to be displayed when hovering over the point. IP address geolocation services typically do not provide precise locations, so camera locations shown will be accurate to a general area but not the exact location. These scans were done throughout December 2017, though some devices had inaccurate time stamps that may indicate other dates. If the above criteria were met, a snapshot image using a public URL (/onvif-http/snapshot?auth=YWRtaW46MTEK) was taken and logged, along with latitude/longitude coordinates provided by the IP geo lookup. Did the camera have its name changed to some variation of "HACKED".Was it a Hikvision device, - Hikvision OEM's were excluded.Was it located in the US or Europe, based on results of an IP Geo Lookup.Each device was evaluated against 3 key criteria: Device IPs were exported from Shodan, the result of a search for Hikvision cameras globally. This is how IPVM built the interactive map. This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply. The average firmware found on the vulnerable cameras had a build date over 2 years old, showing that many users do not update firmware once a device is setup. There are ~3,400 yellow markers for vulnerable cameras, and ~700 red markers for "HACKED" cameras (note in some cases, the OSD text is disabled, so while the camera name has been altered, it may not be shown in the image). ![]() ![]() ![]() Hikvision cameras vulnerable to the backdoor exploit are accessible across the US. Many of these cameras have already been exploited, altered to show "HACKED" in place of the camera name as one example: The devices mapped above all suffer from the Hikvision IP Camera backdoor, demonstrated in the video below: This map helps visually demonstrate how wide the practical impact and risk of easy to exploit vulnerabilities. Hover over a marker to see an image from that camera: The interactive map below shows a sample of hacked and vulnerable Hikvision IP cameras across the USA and Europe.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |