Password Changing on Re-Branded Hikvision cameras and Hikvision cameras alike - Need Help

[BJOSuser]

Some background information. So this has been an on going thing that's been happening more often as of late. I work for a distributor and we've installed several different camera brands/models through the years. Depending on the system, we will set it up so it can be reached remotely through our own DDNS and port forwarding. We've never had any cameras with open ports have default passwords. As of late and at random with no pattern that I've been able to see, the passwords are getting changed on random devices on different systems. It will often be a singular camera that has it's password changed, resulting in the NVR no longer being able to connect to it. The passwords aren't being defaulted as I still can't get in with default credentials.
If I were to guess, the cameras are being hacked. One thing that may dispute this is that it has happened on one of our older systems, where we did not do any port forwarding. The camera has never had access to public networks, but was still having the password changed, the customer locally was a farmer with no knowledge to change it himself, and without the means as he has his own user account without those permissions. How I usually fix this issue is change the password to default with the Hikvision backdoor tool. Then get into the web interface, update firmware and default the camera and set it back up again, with a completely different password.
This takes me to my current issue. An LTS camera (3 years old) doing the same thing. It does have a non-default HTTP port and it is forwarded in the router. The issue I have is that I can't update the firmware. LTS sent us a camera with newer firmware than what is available on their website. I contacted them and they don't have the same firmware version anywhere. The LTS support person suggested reverting the firmware, but I have a strong superstition that doing so would brick the camera (let me know if this is accurate). Defaulting it alone isn't fixing the problem, as the password will be changed in around 2-3 days again. I'm wondering if anyone has any other ideas or solutions to possibly fix this. The only thing I'm thinking to do would be taking the port off the camera, in case it is getting hacked, and removing the forwarding info from the router. Another thing I have yet to look at is the logs in the camera, and I'm going to do that next time I can remote into a computer that's on site and update this post.
TLDR: Camera's password keeps changing, I can't update/flash FW and am not sure what else to do.

 

[alastairstevenson]

We've never had any cameras with open ports have default passwords. As of late and at random with no pattern that I've been able to see, the passwords are getting changed on random devices on different systems

These are being hacked, pure and simple.
Opening ports lets the ENTIRE internet have access.
Opening inbound ports presents a massive risk not just to the cameras, but to the underlying network and the data and devices that reside on it.
It doesn't make much difference changing the ports away from the defaults.
For those installations where ports are not explicitly opened, they can be implicitly opened by the devices themselves when UPnP is enabled on the router, and the camera, as it is by default.

With firmware vulnerabilties, it often does not matter what passwords are set.
After the passwords change, try -
1111aaaa
asdf1234
These are commonly used by the hackbots.

Check this out for how changing ports doesn't help much :

Hikvision Honeypot Hackathon

We get quite a lot of posts about port forwarding - and quite a lot of good advice in response about the risks, and pointers to more secure remote access methods. And we still get posts related to the Hikvision backdoor vulnerability, where camera passwords are mysteriously lost, or cameras...

ipcamtalk.com

 

[BJOSuser]

Thanks for taking the time to respond, and that link to the other thread was very insightful. Now I've got to figure out how to make his camera accessible remotely without having ports opened. In the post he talked about setting up a VPN for remote connection, but I'm not sure if that's going to be feasible on a large scale like we've got (Let alone, even figure out how to do that). Got any ideas? Again thank you so much.

 

[saniaowner]

Thanks for taking the time to respond, and that link to the other thread was very insightful. Now I've got to figure out how to make his camera accessible remotely without having ports opened. In the post he talked about setting up a VPN for remote connection, but I'm not sure if that's going to be feasible on a large scale like we've got (Let alone, even figure out how to do that). Got any ideas? Again thank you so much.

Easy. In the place where the camera is installed, specify trusted addresses in the router settings. As a result, the ports will not be accessible when scanning on the Internet, but you will be able to access the camera from a trusted IP

 

[BJOSuser]

The unfortunate part about that is most of our customers are using their phones to access the cameras, as well as an uptime monitor pinging them. The uptime monitor is easy, but the phones are where a big issue would lie. I can agree that a VPN would be best, but the costs of that as well as getting a VPN onto all the customers phones, computers, etc is possible but not really feasible. It's something we should have always been doing, but unfortunately have not been.