Why so apprently limited options to secure the admin account on Dahua cameras?

P

Perplexer

n3wb
Apr 15, 2023
28
9
Slovenia
I just watched the short video at and while checking my IP camera's user list I realized that the default admin user on Dahuas was really rather poorly protected, and I can't really do much about it, at least not as much as I can with other users.

We know that one half of an account is the username and the other half is the password. Then you can additionally protect accounts by editing their Restricted login (Authority) parameters and locking them to a specific IP or validity period / time range. I sometimes obfuscate the usernames by adding something like _200 at the end, to avoid dictionary attacks (for example John_200 ).

But with the default 'admin' account, you can't edit the username. It is fixed at 'admin' which every hacker will try. So essentially 50% of the account is already known. You also can't edit any Authority parameters for admin, locking it to a specific IP. You can't even disable it. I added a separate 'admin_200' account to serve as admin, but couldn't remove the default 'admin' one, nor could I make it any safer or harder to access. I kinda find it pointless to try to secure any of the other accounts when I know that hackers will by default logically only try to hack 'admin' since they know its username and they know it 100% exists since I can't change or disable it. I also can't IP block it. So if the camera is on the Internet, I can't do anything to make it more difficult for the hackers to hack this account. All I can basically do it set a really long and complex password. But still, it feels like a weak link in the whole chain.

Am I right here or did I miss something ?
 
Why would it be exposed to the Internet?

Using a VPN or even the serial number with P2P would essentially make this a non-issue?
 
  • Like
Reactions: Revo2Maxx
In my case the users have to be able to access my camera from different IPs over the Internet. They do not have access to my network via VPN. Their IPs are static so I can lock their accounts to their specific IPs, but the admin account remains protected essentially only by a password. I have never considered or looked into that P2P thing so I don't really know what it is. Would it offer any benefit? I always thought it involves opening the camera to Dahua's services which I didn't like.
 
All things I have done before I tested my Devices to the internet lol.. I did it in a controlled area and I kept an eye to know when I was being attacked and in some cases the attackers were reported with log files to the ISP and or IP owners abuse emails.. Some took care of things and banned or stopped the attacks and others just ignored my reports but there are many things that can happen if you happen to add your devices Direct to the internet Don't DO IT and one of the main things is they can get your SN of your product because part of the search for that device that happens is it list everything that the device will openly give and now once you remove that device the attacks can keep going if P2P is enabled and if they use correct tools but they normally are only trying to gain access over WAN or your ISP Ip address.. There are alarming number of connected Dahua and Hikvision devices. Some knowingly and others have no clue and are only connected because they had the device connected over LAN with UPnP enabled and if your router is UPnP open it will then load that.. Your IP cameras are only as secure as your Weakest link... NVRs that are open to the WAN if they are trash or have ability to unlock RTSP login requirements can now make it so your very secure IP cameras are no longer secure.. P2P is very safe.. Not CLOUD but true IP camera P2P.. The attacker has to have DMSS, or App for your device know the Serial Number and then have to figure out your password... Using a normal GPU and 14700 CPU would take 22 years to learn my passwords so my testing has said.. Sure there are Crypto Miners that could get it maybe in 22 days but they not using it for that lol.. I have my password exposed and someone could figure it out for 1/2 of my devices ifi they knew where to find it under Social Engineering tactics but would need to have the first part of the puzzle and that is my devices SN.. Be Safe.
 
  • Like
Reactions: bigredfish
Correct.

If you can't do VPN then I would look into P2P built into most Dahua NVRs. FW should be updated to something on or after July of 2024
 
  • Like
Reactions: looney2ns
You must log in or register to reply here.
Top Bottom