Security research firm Shodan shows 3,291 HikVision cameras in the Philippines could be vulnerable to the “Watchful IP” bug. This bug allows hackers to remotely control them.According to Security Week: “[The vulnerability](https://watchfulip.github.io/2021/09/18/Hikvision-IP-Camera-Unauthenticated-RCE.html) can be exploited to gain root access and take full control of a device. An attacker could also use compromised devices to access internal networks.” Aka: If left unpatched or unprotected, hackers have a “access keys” to your network via the camera devices and do further damage.While Quezon City and Lipa City had the most HikVision Cameras connected to the Internet, I zoomed in on my hometown, Dagupan City to find 5 installed cameras:These 5 HikVision Cameras are likely to be vulnerable to the ‘Watchful IP” vulnerability as their firmware shows it to be below the patched version: V5.5.800
Background:
My interest was piqued when our monitoring saw a spike in attacks on our own HikVision Camera using TCP port 8:
The Dashboard shows that PLDT owned IP addresses accounted for about 16,426 incidents. Of these incidents, one device (IP:49.150.46.42) made 12,165 attempts on our network using TCP Port 8.I have reached out to sir Angel Redoble (PLDT Group’s head of security) and alerted him to this IP address. This IP could also be actively exploiting or attacking other HikVision Cameras.Pending resolution from PLDT side, we should update the firmware to remove the vulnerability. Network admins could also block outside access by limiting the IP addresses to only those authorized to do so.Your thoughts are welcome! Please continue the conversation and connect with me on Twitter: [https://twitter.com/wilsonchua](https://twitter.com/wilsonchua)
Technews
These 5 HikVision Cameras are likely to be vulnerable to the ‘Watchful IP” vulnerability as their firmware shows it to be below the patched version: V5.5.800
