Dahua devices password in public search cache

Forums › Gadgets, robotics, home automation, electronics (including wearables) › Dahua devices password in public search cache

freitasm

BDFL - Memuneh
79250 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#239407 16-Jul-2018 15:03

As per this article: "Passwords for Tens of Thousands of Dahua Devices Cached in IoT Search Engine"

1 | 2

5346 posts

Uber Geek

Trusted

#2057148 16-Jul-2018 15:13

1. Never heard of Duhua before this thread.

2. I'd trust all these companies plugging the Internet of Things about as much as I trust Trump.

mattwnz

20141 posts

Uber Geek

#2057167 16-Jul-2018 15:42

A company I just got a quote for a security system quoted on this brand of cameras and I always understood they were good. Maybe I just won't have it connected to the internet so it only stores data locally.

sbiddle

30853 posts

Uber Geek

Retired Mod

Trusted

Biddle Corp

Lifetime subscriber

#2057172 16-Jul-2018 15:51

Dahua is the second largest supplier of CCTV gear in the world. Like Hikvision (#1) they've faced security issues in part because of sloppiness, and in part simply because they have so many devices in use.

While some of these exploits are very bad, they're made worse by people who continue to leave devices accessible on the internet, and those who don't understand the risks of port forwards. IMHO you should have to complete a course and sign a waiver before you're allowed to get firmware to enable port forwards in a router!

Dahua make great gear, but many of their issues in part are the huge parallel supply chains of "hacked" firmware that exist. Because they sell different products in the Chinese market as well as International markets at different price points many Aliexpress sellers (as an example) sell Chinese hardware with dodgy 3rd party firmware that allows the Chinese hardware to have English menus. This hardware has no update path and can't have official Dahua firmware loaded on it.

mattwnz

20141 posts

Uber Geek

#2057173 16-Jul-2018 15:53

Where is the best place to source them from, as consumers don't know if NZ retailers are just buying them direct from China or the like.

neb

11294 posts

Uber Geek

Trusted

Lifetime subscriber

#2057174 16-Jul-2018 15:53

DarthKermit:
1. Never heard of Duhua before this thread.

They make reasonably high-end security/surveillance/DVR/NVR gear, and also OEM for huge numbers of other vendors. I've got Dahua gear and I'm quite impressed by it, so far it's been better than anything else I've worked with, great-quality video, good low-light performance, doesn't crash or lock up every few weeks (how hard can it be to create a camera system where you don't have to unplug and re-plug in the cameras every few weeks?), good motion detection, etc.

neb

11294 posts

Uber Geek

Trusted

Lifetime subscriber

#2057175 16-Jul-2018 15:55

mattwnz:
Where is the best place to source them from, as consumers don't know if NZ retailers are just buying them direct from China or the like.

They don't sell to end users, what you need to do is find an OEM and buy through them. I use Amcrest, they'll ship to NZ and you pay around the USD80-100 mark for a camera that'd cost you $700 wholesale in NZ if it had the Dahua name on it.

neb

11294 posts

Uber Geek

Trusted

Lifetime subscriber

#2057178 16-Jul-2018 15:57

sbiddle:
Dahua make great gear, but many of their issues in part are the huge parallel supply chains of "hacked" firmware that exist. Because they sell different products in the Chinese market as well as International markets at different price points many Aliexpress sellers (as an example) sell Chinese hardware with dodgy 3rd party firmware that allows the Chinese hardware to have English menus. This hardware has no update path and can't have official Dahua firmware loaded on it.

They also don't sell to, or deal with, end users in any form. The preponderance of dodgy grey-market Dahua gear is driven by this, unfortunately, if you want the real thing (Dahua-branded Dahua gear) you need to go through either ridiculously expensive Dahua-approved resellers/installers, or source it on the grey market.

Equinox IT

Cloud spending continues to surge globally, but most organisations haven’t made the changes necessary to maximise the value and cost-efficiency benefits of their cloud investments. Download the whitepaper From Overspend to Advantage now.

sbiddle

30853 posts

Uber Geek

Retired Mod

Trusted

Biddle Corp

Lifetime subscriber

#2057234 16-Jul-2018 16:09

neb:
sbiddle:

Dahua make great gear, but many of their issues in part are the huge parallel supply chains of "hacked" firmware that exist. Because they sell different products in the Chinese market as well as International markets at different price points many Aliexpress sellers (as an example) sell Chinese hardware with dodgy 3rd party firmware that allows the Chinese hardware to have English menus. This hardware has no update path and can't have official Dahua firmware loaded on it.

They also don't sell to, or deal with, end users in any form. The preponderance of dodgy grey-market Dahua gear is driven by this, unfortunately, if you want the real thing (Dahua-branded Dahua gear) you need to go through either ridiculously expensive Dahua-approved resellers/installers, or source it on the grey market.

This isn't really any different to the business model of most big security companies.

The issue is also compounded by them selling non Dahua branded OEM gear which is exactly the same product but at a cheaper price.

amanzi

Amanzi
1292 posts

Uber Geek

ID Verified

Trusted

Lifetime subscriber

#2057235 16-Jul-2018 16:11

sbiddle:

Dahua is the second largest supplier of CCTV gear in the world. Like Hikvision (#1) they've faced security issues in part because of sloppiness, and in part simply because they have so many devices in use.

While some of these exploits are very bad, they're made worse by people who continue to leave devices accessible on the internet, and those who don't understand the risks of port forwards. IMHO you should have to complete a course and sign a waiver before you're allowed to get firmware to enable port forwards in a router!

Dahua make great gear, but many of their issues in part are the huge parallel supply chains of "hacked" firmware that exist. Because they sell different products in the Chinese market as well as International markets at different price points many Aliexpress sellers (as an example) sell Chinese hardware with dodgy 3rd party firmware that allows the Chinese hardware to have English menus. This hardware has no update path and can't have official Dahua firmware loaded on it.

With regards to port forwarding -- isn't there a bigger risk with routers having UPnP enabled by default?

neb

11294 posts

Uber Geek

Trusted

Lifetime subscriber

#2057242 16-Jul-2018 16:27

amanzi:
With regards to port forwarding -- isn't there a bigger risk with routers having UPnP enabled by default?

That would make for an interesting security product, it fires up on your phone/PC/whatever, uses UPnP on the router to turn off UPnP on the router, and then shuts down again.

sbiddle

30853 posts

Uber Geek

Retired Mod

Trusted

Biddle Corp

Lifetime subscriber

#2057245 16-Jul-2018 16:44

amanzi:

sbiddle:

Dahua is the second largest supplier of CCTV gear in the world. Like Hikvision (#1) they've faced security issues in part because of sloppiness, and in part simply because they have so many devices in use.

While some of these exploits are very bad, they're made worse by people who continue to leave devices accessible on the internet, and those who don't understand the risks of port forwards. IMHO you should have to complete a course and sign a waiver before you're allowed to get firmware to enable port forwards in a router!

Dahua make great gear, but many of their issues in part are the huge parallel supply chains of "hacked" firmware that exist. Because they sell different products in the Chinese market as well as International markets at different price points many Aliexpress sellers (as an example) sell Chinese hardware with dodgy 3rd party firmware that allows the Chinese hardware to have English menus. This hardware has no update path and can't have official Dahua firmware loaded on it.

With regards to port forwarding -- isn't there a bigger risk with routers having UPnP enabled by default?

Yes and no. While Dahua supports UPnP it's not enabled so won't pose a risk even if the router has it enabled.

rscole86

4973 posts

Uber Geek

Moderator

Trusted

Lifetime subscriber

#2057305 16-Jul-2018 20:26

mattwnz:

Where is the best place to source them from, as consumers don't know if NZ retailers are just buying them direct from China or the like.

For Dahua the most popular seller appears to be Andy at Empire Technology. Aliexpress and Amazon (does not ship to NZ). He supplies them unbranded, or you can wait for branded products.

sbiddle

30853 posts

Uber Geek

Retired Mod

Trusted

Biddle Corp

Lifetime subscriber

#2057309 16-Jul-2018 20:42

Andy is a great guy. If you're wanting to go down the path of buying cameras from Aliexpress he's the only person I'd recommend. Genuine English Dahua or OEM products.

cyril7

9058 posts

Uber Geek

ID Verified

Trusted

Subscriber

#2057310 16-Jul-2018 20:43

Quote,
For example, we found nearly over 15,800 Dahua devices with a password of "admin", over 14,000 with a password of "123456," and over 600 with a password of "password".

These people should not be allowed to manage a toaster.

Cyril

Yoban

447 posts

Ultimate Geek

#2057346 16-Jul-2018 21:49

sbiddle:

Andy is a great guy. If you're wanting to go down the path of buying cameras from Aliexpress he's the only person I'd recommend. Genuine English Dahua or OEM products.

Does he supply new firmware version if camera's purchased from him? Or a case of using some google-fu.

1 | 2