Having bought the CantonK version of the S500 (KIP-500DR20H) and tested it in various locations currently occupied by Hikvision 2-series cameras I really liked the image quality and build quality and am going to give it a permanent home at the expense of one of my Hiks.
But before I do that, I thought it would be prudent to look a bit under the covers to see if there were any obvious risks, especially having read some of the posts and concerns and findings here:
https://www.ipcamtalk.com/showthread.php/10420-Looking-for-outfoor-WiFi-IP-camera-that-doesn-t-phone-home-to-China-random-IPs
So the first thing to do was to have a good look at the network traffic and see if it was doing anything I'd prefer it didn't.
And the result was - there appears to be absolutely zero strange traffic going out to the internet, the device looks clean.
I'm pleased and maybe a bit surprised at that.
Especially as there is a P2Pserver running and consuming a few CPU cycles:
Code:
Mem: 47604K used, 11948K free, 0K shrd, 0K buff, 19236K cached
CPU: 10.5% usr 0.5% sys 0.0% nic 88.8% idle 0.0% io 0.0% irq 0.0% sirq
Load average: 5.66 5.75 5.71 1/113 1234
PID PPID USER STAT VSZ %VSZ CPU %CPU COMMAND
849 1 root S 163m279.8 0 9.7 /usr/AVServer
1116 1 root S 229m392.7 0 0.3 /boaServer/boa
1114 1 root S 88408147.8 0 0.3 /usr/freep2p_server
854 1 root S 128m219.9 0 0.2 /usr/SystemServer
1118 1 root S 36088 60.3 0 0.1 /usr/DeviceSearch
1234 1230 root R 1768 2.9 0 0.1 top
3 2 root SW 0 0.0 0 0.1 [ksoftirqd/0]
1230 844 root S 1784 2.9 0 0.0 -sh
844 1 root S 1780 2.9 0 0.0 telnetd
841 1 root S 1768 2.9 0 0.0 /bin/login
1 0 root S 1764 2.9 0 0.0 init
1120 1 root S 1268 2.1 0 0.0 /usr/WatchDog
593 1 root S < 1068 1.7 0 0.0 udevd --daemon
670 593 root S < 1068 1.7 0 0.0 udevd --daemon
661 593 root S < 1068 1.7 0 0.0 udevd --daemon
845 1 root S 848 1.4 0 0.0 /usr/Main
1080 1 root S 840 1.4 0 0.0 /usr/HWatchDog
579 2 root SWN 0 0.0 0 0.0 [jffs2_gcd_mtd2]
249 2 root SW 0 0.0 0 0.0 [kworker/0:1]
161 2 root DW 0 0.0 0 0.0 [kusbotg]
~ #
So next up was a good old vulnerability scan to see if there were any known vulnerabilities that might make the device into a foothold on the LAN. Not that the LAN is configured with inbound access, but that's not the only way the bad actors get around your network.
I gave the scanner root telnet access so it could have a good look around.
There were the expected dozen or so 'informational' findings - such as what OS is running, what type of web server etc.
The only finding above 'information' was a 'medium' one - yes, you've guessed it - telnet traffic including credentials are passed in plain text.
And that was all.
Quite comforting.
But there was one surprising finding - which nmap on my normal settings did not spot - there is a small set of ports which are set up presumably for debug purposes.
They chat away on various topics, a bit like the kernel msg log would do.
I know that doesn't make this camera a hardened appliance, but it does provide a degree of comfort that there is nothing major to worry about.
Time to have another look at Hikvision IP cameras to see if they've sorted that vulnerable 'dropbear' version yet ...
