The government computer emergency response team of Ukraine CERT-UA, which operates under the State Service for Special Communications, has warned of mass cases of unauthorized remote access to Dahua brand video surveillance systems.
Attackers gain access to video streams from IP cameras and DVRs, change device configurations, and create third-party accounts to maintain control.
The government computer emergency response team of Ukraine CERT-UA, which operates under the State Service for Special Communications, has warned of mass cases of unauthorized remote access to Dahua brand video surveillance systems.
Attackers gain access to video streams from IP cameras and DVRs, change device configurations, and create third-party accounts to maintain control.
The main attack vector was the P2P/Easy4IP (cloud access) function. It allows the device to independently connect to the manufacturer's cloud using its serial number, CERT-UA reports .
This allows access to the camera to bypass firewalls and NAT — even if the device does not have a dedicated IP address or open ports to the outside. Therefore, the camera's lack of direct access to the Internet does not guarantee its security if P2P is enabled.
The penetration scheme is that the attackers first perform a mass search of Dahua equipment serial numbers, which have a predictable structure, and check for the presence of registered devices in the cloud. Having gained access to the camera or DVR through the cloud system, the hackers bypass authentication by selecting standard or weak passwords, as well as by exploiting old vulnerabilities in outdated firmware (in particular CVE-2021-33044 and CVE-2021-33045), which allows them to seize control without knowing the password at all.
CERT-UA specialists recommend checking the equipment for the following symptoms:
unknown accounts or third-party linked cloud accounts appeared in the system;
settings have been changed or third-party text captions have been superimposed on the video stream. Note: the absence of captions does not guarantee security;
The audit logs contain DVRIP login events from the local address 127.0.0.1 — this is a direct access token via a P2P network.
Disable P2P/Cloud Access in your device settings if you don't use cloud browsing on a regular basis.
Do not publish cameras on the open internet. For secure remote viewing, set up a VPN connection and restrict access to only authorized IP addresses.
Conduct an account audit: check the user list and disconnect any suspicious or unknown accounts.
Update the firmware: manually download and install the latest software versions from the manufacturer's official website and continue to update them regularly.
