Follow Slashdot stories on Twitter


Forgot your password?
Security Bug Technology

Hard-Coded Password Exposes Video Surveillance DVRs To Hacking ( 41

itwbennett writes: Security researchers from vulnerability intelligence firm Risk Based Security (RBS) have found that DVRs from RaySharp and six other vendors have a basic vulnerability: They accept a hard-coded, unchangeable password for the root account. "RaySharp DVR devices provide a Web-based interface through which users can view camera feeds, manage recording and system settings and use the pan-tilt-zoom (PTZ) controls of connected surveillance cameras. Gaining access to this management interface would provide an attacker with full control over the surveillance system," writes Lucian Constantin. RaySharp claims on its website that it ships over 60,000 DVRs globally every month, but the Chinese company also creates digital video recorders and firmware for other companies. The RBS researchers confirmed that at least some of the DVR products from König, Swann Communications, COP-USA, KGUARD Security, Defender (a brand of Circus World Displays) and LOREX Technology, a division of FLIR Systems, contain the same hard-coded root password.
This discussion has been archived. No new comments can be posted.

Hard-Coded Password Exposes Video Surveillance DVRs To Hacking

Comments Filter:
  • Watching folks cut their lawn and the cars go by seems a little more entertaining.
  • Username = Admin, Password = Admin
  • Thanks for exposing this!


    So much for another fappening.

  • by bobbied ( 2522392 ) on Wednesday February 17, 2016 @07:41PM (#51531349)

    You get what you pay for. If you go for the cheap solution, you get the cheap solution, always. Or to quote the article....

    "Consumers should be aware that when buying especially lower-end devices made in China, there is a significant risk of the devices having serious flaws that won't ever be addressed," said Carsten Eiram, chief research officer at RBS

    Besides, if you REALLY are security minded, who puts this kind of device just out in the wild for all to see and use? At least put it behind a VPN, where you can hope to control access to it. If nothing else, use a protected proxy connection.... Don't just put the HTTP/HTTPS port from some cheap device you own on the internet unless you really don't care who access it..

    • by nnull ( 1148259 )
      The vast majority of security companies who consider themselves "Professional" install these crappy systems and not only that, they request the client to open the port on their firewall to access it from the outside. These are the equivalent of contractors who continuously cut corners and when caught by inspectors, claim they've been doing this for many years without issues, so the inspector is in the wrong. When I tell the owners that their system is out in the open and most likely already compromised, the
  • While there are certainly some benefits to be found in some of the IoT stuff, but - again - another case of people relying on providers who rely on suppliers who always shop on price and...tada! Lowest-common-denominator. Be very, very careful out there! Forget Big Brother, it's Big Everyone!
    • by nnull ( 1148259 )
      The thing is, even if you buy the more expensive gear, they would still install it so and so that it would get compromised regardless. The people installing these things have no clue what they're doing. IoT stuff is perfectly fine if the system is designed to keep it secure.
  • From the article...

    At the very least, a DVR that accepts root and 519070 as username and password should not be exposed directly to the Internet.

    Username root
    password 519070

    sweet free live drama :)

  • If you have a Q-SEE QC444 DVR, you can telnet as root and hit enter and you have CLI

    Then add your own account to /mnt/mtd/Config/passwd and you will have a username and password to log in to the box.

    The banner when you log in says "Welcome to HiLinux." so there may be other DVRs that use this version that are vulnerable too.

    • by Bert64 ( 520050 )

      A ton of vendors use the same software, just nominally rebranded... But often the passwords differ by vendor among other things.

      Given that these devices are all basically the same, and the default firmware is complete crap both from a security and usability perspective perhaps we could develop an open source replacement?

  • Told my parents to keep their surveillance cams offline and not connected to the internet. TFA is yet another confirmation that this was a good idea.

  • It's totally cool. Just like the FBI wants a backdoor for iPhones they can use this backdoor for surveillance systems! I'm sure nothing bad will ever happen from having this backdoor in place!

Logic is a pretty flower that smells bad.