FCC to ban sales of some Chinese video products

[v4m]

Just saw this:

On Oct. 5, FCC Chairwoman Jessica Rosenworcel circulated a draft order among her fellow commissioners. The order — which still needs to be voted on — would effectively ban new equipment sales in the U.S. from firms that pose a threat to national security, two sources with direct knowledge told Axios.

• The order would ban telecommunications equipment from Chinese telcos Huawei and ZTE. The FCC previously prohibited companies from using federal funding to purchase equipment from these firms, but the new order would extend this ban to all purchases.
• The FCC order will also determine the scope of a ban on sales of video surveillance equipment used for public safety. This would affect the Chinese companies Hytera Communications Corporation, Hikvision and Dahua Technology Company, the sources told Axios.

Source

What struck me was the inclusion of Dahua, since the 5442 is so well liked here. I actually just installed 3 of them myself (on a vlan, they can't see "out"). So, if you're on the fence about buying more, might be time to move... or to start exploring alternatives. :/ Then again, the wording makes it sound like buying from Aliexpress and the like (sales outside of the US, just shipped here) will still be an option.

 

[tech_junkie]

Just saw this:



Source

What struck me was the inclusion of Dahua, since the 5442 is so well liked here. I actually just installed 3 of them myself (on a vlan, they can't see "out"). So, if you're on the fence about buying more, might be time to move... or to start exploring alternatives. :/ Then again, the wording makes it sound like buying from Aliexpress and the like (sales outside of the US, just shipped here) will still be an option.

Consumers are not going to be effected by this. Only people that buy or install then for civil and federal governments. Because they can't use their government funding to buy them.

 

[john-ipvm]

The FCC process is different and broader than the NDAA.

 

[The Automation Guy]

I've stated several times on the forum that I am in complete favor of a government use ban for all Chinese devices (anything that plugs into a network) because they theoretically could be used in a trojan horse attack on a specific target (even if that target isn't connected to the internet). However to extend the ban to the general public is either fear mongering, a political move, or both. There is no more risk to the general public in using these Chinese CCTV cameras as there are with using any other brand. The general public should be handling their network security the same regardless of the country of origin.

If there is any good news, it is that the proposed ban is only for FCC approvals of NEW equipment. Anything previously approved by the FCC is not effected. This means that any equipment currently being sold can still be sold without issues.

It also seems to be targeting only Huawei and ZTE. So Dahua products could/should still be able to get approvals - at least that is how I understand the proposed ban. EDIT - the ban goes on the specifically target video surveillance devices from Hytera, Hikvision, and Dauhua. The Huawei and ZTE ban is complete (regardless of device) while the Hytera, Hikvision, and Dauhua is specifically for video surveillance devices.

 

[wittaj]

Keep in mind that EVERY camera has security issues. It is why most of us here isolate cameras from the internet. If you don't use P2P and UPnP, no reason for worry.

Hacking vulnerabilities are the same regardless of who makes the cameras...or any IoT for that matter...and that is why most of us here isolate our cameras from the internet...it's just irony that they are surveillance cameras...it flows better saying security cameras are not very secure but many here do not consider them security cameras as they are for surveillance!

And our wonderful government decided to "ban" Hikvision and Dahua from government installations due to being partly owned by the Chinese government and the potential to be hacked...yet our government fails to recognize the real problem are the cameras can be breached and then they get exploited with other manufacturer cameras because they failed to isolate them from the internet. End result is people/governments that shouldn't see the camera feeds are now seeing them...

Keep in mind this proposed ban is for government installations....not your home, private business, etc...and even at that the ban is just words at this point with no official document for agencies to go upon. The bill requires new rules for FCC approval and authorizations be established. Those new rules must be published before 11/22 - a lot can happen between now and then...

Yep, instead of our government forbidding public agencies from using Chinese brand cameras like Dahua and Hikvision because they could be used to be spied on by the Chinese government, they should have been looking at what the real issue is, and it is this issue that will be same regardless of who makes a camera. You need to get the cameras off the internet period.

Or maybe they want cameras going thru American servers so they can be big brother....

We have already seen countless examples where governments facilities that installed expensive AXIS cameras that are NDAA compliant were hacked into...

And of course other camera companies are now going to try to use this ban to their advantage, but as a consumer, you need to decide what marketing nonsense to believe and which one to pass on.

Regardless of who makes the camera, it should be limited in its ability to reach the internet. So at that point, go with the camera that is going to give you the best chance of a good capture.

Now the other manufacturers they targeted make mobile phones, so those are on the internet, so I can potentially see why for those.

TL : DR - isolate the cams from the internet and they will not phone home.

 

[john-ipvm]

We have already seen countless examples where governments facilities that installed expensive AXIS cameras that are NDAA compliant were hacked into...

Can you share some examples of this being reported? I have not seen this.

 

[The Automation Guy]

@wittaj - I feel like you are limiting your risk assessment to the same threats that we face as the general public. We both sleep like a babies with Chinese equipment installed on our personal network, but the reality is the risk to government facilities, utility infrastructure, and other high value targets is much greater than what we face and is greater than just having their cameras compromised over the internet. While I am sure they are some boneheaded government IT people out there, I also know that the vast majority of them are good at their jobs and have set their networks up correctly to isolate these devices from the internet. But isolating a network from the internet is not enough to protect it from ALL threats facing these facilities. For example, it won't prevent a trojan horse style attack that doesn't even need internet connection to be successful.

This threat extends beyond just CCTV cameras too. Anything that plugs into a network - whether the device has internet access or not - can be weaponized in some form or fashion. Plus, there are plenty of situations were equipment has to have internet access to even work (like switches and other equipment being used in the backbone of the internet and telecommunications in general) making security even harder. The ban is an effort to try to protect these systems from a determined "enemy of the state" with very impressive electronic warfare capabilities. It's obviously not a perfect solution, but I certainly feel better NOT having Chinese network equipment being installed in key infrastructure and government facilities.

 

[wittaj]

Can you share some examples of this being reported? I have not seen this.

Maybe saying government facilities is too strong, but I seem to recall reading somewhere about a hospital camera feeds were hacked, and an article about many hospitals use Axis systems, and I am sure one of them had to be a "government" hospital like a University hospital or even a VA hospital.

But nonetheless, even high end Axis that is NDAA compliant has had breaches, as recently as this year, and the point is just because it is NDAA compliant doesn't make it immune from being hacked.

 

[Mike A.]

I remember something about that one too but I think that was just a proof-of-concept vs actual exploit...

New PoC Shows IoT Devices Can Be Hacked to Install Ransomware on OT Networks

In this PoC, the ransomware attack dubbed R4IoT uses vulnerable IoT devices (in this case, vulnerable security cameras) to gain access, IT for traversal, and

www.hackread.com

"As it can be seen in the video above, a simulated ransomware attack is used against a fictional hospital, and the Forescout team accessed an IP camera to access the hospital’s network and camera..."

I'm torn on this one... I'm glad that they're finally at least trying to get some of this stuff out of our networks. But my cam addiction wants to argue otherwise.

 

[wittaj]

I can't find the article now either, but here was one where NDAA compliant Verkada was hacked and 150,000 cameras in private companies, along with prisons and public school systems were part of it, which would be government funded..

150,000 security cameras hacked, exposing Tesla, prisons, hospitals

Hackers gained access through a 'Super Admin' account, allowing them to peer into the cameras

www.business-standard.com

 

[john-ipvm]

I can't find the article now either, but here was one where NDAA compliant Verkada was hacked and 150,000 cameras in private companies, along with prisons and public school systems were part of it, which would be government funded..

150,000 security cameras hacked, exposing Tesla, prisons, hospitals

Hackers gained access through a 'Super Admin' account, allowing them to peer into the cameras

www.business-standard.com

Yes, that was Verkada. Verkada's hack is particularly noteworthy because all of their cameras are cloud connected and controlled by Verkada. Worse, Verkada gave out admin access to all cameras and that leaked, causing this.

While it's popular on IPCamTalk to airgap one's cameras, the trend for buyers and manufacturers generally (including Dahua and Hikvision) is moving to the cloud.

 

[Daniel15]

Consumers are not going to be effected by this

That's not what the first post says:

The FCC previously prohibited companies from using federal funding to purchase equipment from these firms, but the new order would extend this ban to all purchases

Not sure if Dahua or Hikvision make any wifi products (like wireless doorbells), but my understanding is that if the FCC is no longer going to certify their hardware, it means that new products can't legally connect to any wifi networks in the USA. I could be wrong though, but I know manufacturers can't directly sell wifi equipment in the USA until they get FCC certification. This is explained in detail in the 2 other threads discussing this issue.

 

[fenderman]

That's not what the first post says:



Not sure if Dahua or Hikvision make any wifi products (like wireless doorbells), but my understanding is that if the FCC is no longer going to certify their hardware, it means that new products can't legally connect to any wifi networks in the USA. I could be wrong though, but I know manufacturers can't directly sell wifi equipment in the USA until they get FCC certification.

You are simply wrong. This is why it is important to actually read the FCC report and order.

 

[Daniel15]

You are simply wrong. This is why it is important to actually read the FCC report and order.

Can you please link to a source that says this? I've seen a lot of conflicting information.

 

[fenderman]

Can you please link to a source that says this? I've seen a lot of conflicting information.

FCC Amends Equipment Authorization Program

The Commission amends our rules related to equipment authorization to further secure our communications networks and supply chains from equipment that poses an unacceptable risk to national security of the United States

www.fcc.gov

There are at least two threads on the forum where I explain it in detail.

 

[TRLcam]

I am a Dahua dealer and just received this email from Dahua.

Dear Valued Customer:

As you may already be aware, on Friday evening the FCC issued its Order regarding the ability of Dahua and certain other companies to secure authorizations for our products.
The Order is lengthy and Dahua is continuing to review it closely. Based on our preliminary analysis we can share the following important information.

First, there are elements of the Order that we object to and which we believe fall far outside the FCC’s legal authority.

However, more importantly for the marketplace, the FCC also made clear that the Order does not affect our ability to sell, or your ability to use, products that have already received authorization under the existing FCC rules.

Moreover, there is a pathway available for Dahua to continue to secure authorizations for new products going forward. Specifically, the FCC’s Order states that our products can be authorized for purposes other than public safety, critical infrastructure, or national security, once we provide the FCC with a plan to assure compliance with these sector-specific restrictions.

As you may know, Dahua does not market its products for public safety or national security purposes and has not for several years - our products are principally intended for business and residential customers. Therefore, we are reasonably confident that we will be able to secure authorizations that enable us to continue to do business as we have been in the US market.

We understand that the media has widely reported that Dahua has been “banned” and that the Order cuts off access to future authorizations. That reporting is unequivocally inaccurate. If you have questions, please feel free to reach out to your Dahua’s sales representative at any time.


Dahua Technology USA Inc.

 

[wittaj]

I am a Dahua dealer and just received this email from Dahua.

Dear Valued Customer:

As you may already be aware, on Friday evening the FCC issued its Order regarding the ability of Dahua and certain other companies to secure authorizations for our products.
The Order is lengthy and Dahua is continuing to review it closely. Based on our preliminary analysis we can share the following important information.

First, there are elements of the Order that we object to and which we believe fall far outside the FCC’s legal authority.

However, more importantly for the marketplace, the FCC also made clear that the Order does not affect our ability to sell, or your ability to use, products that have already received authorization under the existing FCC rules.

Moreover, there is a pathway available for Dahua to continue to secure authorizations for new products going forward. Specifically, the FCC’s Order states that our products can be authorized for purposes other than public safety, critical infrastructure, or national security, once we provide the FCC with a plan to assure compliance with these sector-specific restrictions.

As you may know, Dahua does not market its products for public safety or national security purposes and has not for several years - our products are principally intended for business and residential customers. Therefore, we are reasonably confident that we will be able to secure authorizations that enable us to continue to do business as we have been in the US market.

We understand that the media has widely reported that Dahua has been “banned” and that the Order cuts off access to future authorizations. That reporting is unequivocally inaccurate. If you have questions, please feel free to reach out to your Dahua’s sales representative at any time.


Dahua Technology USA Inc.

Thanks for posting this! Pretty much what many of us having been saying!

 

[Daniel15]

FCC Amends Equipment Authorization Program

The Commission amends our rules related to equipment authorization to further secure our communications networks and supply chains from equipment that poses an unacceptable risk to national security of the United States

www.fcc.gov

There are at least two threads on the forum where I explain it in detail.

Thank you for clarifying - I appreciate it! So I guess all the news articles are incorrect? For example I just saw one from The Verge that said something similar to what I said (which I now understand is probably incorrect):

The FCC just banned these Chinese cameras and telecom hardware from reaching the US

Clearly-marked consumer products are likely exempt.

www.theverge.com

 

[fenderman]

Thank you for clarifying - I appreciate it! So I guess all the news articles are incorrect? For example I just saw one from The Verge that said something similar to what I said (which I now understand is probably incorrect):

The FCC just banned these Chinese cameras and telecom hardware from reaching the US

Clearly-marked consumer products are likely exempt.

www.theverge.com

The article is correct. You need to read it in its entirety.
From the article
"So if they agree to market the cams to consumers, or small businesses, they can probably be imported and sold just fine. Also, it’s not like the FCC is revoking authorizations for existing products."

 

[Daniel15]

The article is correct. You need to read it in its entirety.
From the article
"So if they agree to market the cams to consumers, or small businesses, they can probably be imported and sold just fine. Also, it’s not like the FCC is revoking authorizations for existing products."

Ahh, interesting. I was just scared by this:

The Federal Communications Commission has just announced it’ll no longer authorize some of their equipment — which is a big deal, because companies can’t legally import or sell anything with a radio in the US without that authorization.

but I guess it's common for articles to start with hyperbole and then clarify later in the article...