The Computer Emergency Response Team of Ukraine (CERT-UA) has issued an urgent alert regarding unauthorized access incidents involving Dahua-manufactured video surveillance systems. This security warning highlights the compromise of IP cameras and DVRs, including unauthorized access to video streams, modifications to device settings, and the creation of unauthorized accounts.
Exploitation via Easy4IP Platform
The primary method attackers are utilizing to gain access is the Easy4IP platform, a peer-to-peer (P2P) service designed for remote monitoring of Dahua devices through smartphones or web browsers. This service allows users to connect to their devices by scanning a QR code or entering a hardware Serial Number (SN).
Unfortunately, the serial numbers have a predictable format, including a 10-character model prefix and a nearly sequential five-character hexadecimal counter. This predictability enables attackers to utilize brute-force methods to ascertain connected devices without triggering rate limits or lockouts. Consequently, devices with active P2P functionality are vulnerable, even if they are not directly accessible via the internet.
Authentication and Firmware Vulnerabilities
Attackers bypass authentication using weak or known passwords, or by exploiting vulnerabilities in outdated firmware, such as CVE-2021-33044 and CVE-2021-33045. CERT-UA recommends deactivating the P2P feature if unnecessary, avoiding direct internet exposure, and regularly updating the software.
Indicators of compromise include unknown accounts, unauthorized configuration modifications, and unusual authentication events using the DVRIP protocol from local addresses, indicating potential P2P access.
Wider Implications and Threat Actor Campaigns
While the precise targets and timeline of these attacks remain undisclosed, similarities have been noted with activities identified by Hunt.io, which reported campaigns against IP cameras in Ukraine and Russia. One campaign, involving a Russian-speaking operator, compromised 58 devices in Ukraine using known vulnerabilities.
In another campaign,
