Hikvision security cameras, the subject of an extensive espionage campaign. Hackers in Russia are selling access data in bulk

Two years ago, the US Department of Defense published a list of 20 top companies active on US soil, including Hikvision, accusing them of connections to the Chinese Communist Party (CCP) and Chinese military-like entities.

Despite the extremely serious allegations, doubled last year by the disclosure of a very easily accessible vulnerability that turned any Chinese manufacturer’s surveillance camera into a private domain gateway for companies that chose such equipment to protect targets of interest, nothing has been done to shut it down. On signs that Hikvision’s manufacturer’s hidden interests trump the firmware flaw that de facto negates the very reason those products exist, as security devices.

Dubbed CVE-2021-6260, the vulnerability ranked 9.8 out of a possible 10 points on the risk scale of the security company that discovered it, CYFIRMA, was in no way addressed by the manufacturer Hikvision, which continued to unabashedly sell its equipment to uninformed customers.

In short, the vulnerability for which dedicated software exploits already exist allows undetectable access to surveillance cameras, making companies’ protected premises as public as possible for hackers interested in obtaining details inside the targets they wish to attack.

According to the data centralized so far, Hikvision security cameras “equipped” with this gateway have been deployed in over 100 countries, leaving approximately 80,000 protected premises accessible from the Internet. In total, the number of companies/organisations compromised in this way is estimated at 2300.