The Computer Emergency Response Team of Ukraine, CERT-UA, identified intrusions in which attackers altered device configurations and created unauthorised accounts, potentially giving them continuing access to surveillance equipment. The agency has not disclosed the number of affected devices, the dates of the attacks or the identity of those responsible. Its alert concerns cameras and network video recorders, which can manage footage from multiple surveillance feeds.
The warning follows findings by cybersecurity company Hunt. io that more than 14,530 Dahua devices were compromised during a documented campaign between 17 June and 22 July. That figure comes from the company’s investigation, rather than a confirmed tally issued by CERT-UA, and should not be interpreted as the number of newly identified breaches.
CERT-UA highlighted Easy4IP, Dahua’s cloud-based remote access facility, as a significant exposure. The service enables customers to connect to cameras and recorders using device serial numbers, including when equipment sits behind firewalls or network address translation systems that normally prevent unsolicited external connections.
The agency said predictable serial-number patterns allow attackers to identify connected devices by testing possible identifiers. Discovering a camera through the relay does not necessarily grant access to its video or administrative controls, but it can expose a route through which attackers attempt further authentication attacks.
Those attempts may involve default credentials, easily guessed passwords or vulnerabilities in older firmware. CERT-UA specifically identified CVE-2021-33044 and CVE-2021-33045, two authentication-bypass weaknesses disclosed five years ago that affect certain Dahua cameras and recording products.
The US National Vulnerability Database assigns each flaw a critical severity score of 9.8 out of 10. Dahua has published firmware fixes for affected products, making the continued use of vulnerable software an important factor in the exposure described by the Ukrainian authorities.
Hunt. io’s investigation, designated Operation CameraSwarm, reconstructed an extensive intrusion campaign from an exposed directory containing operational records, software and logs. Researchers found evidence of several attack methods operating alongside one another, rather than a single exploit responsible for every compromise.
Their analysis identified 12,324 unique internet addresses targeted through credential attacks, 1,923 cameras on which attackers established persistent accounts using authentication bypasses, and 283 cameras accessed through the peer-to-peer relay route. The categories describe different aspects of the operation and should not be added together as an independent total.
The confirmed compromises were concentrated in Ukraine and Russia, although the researchers observed wider scanning activity. Hunt. io did not establish that a government directed the operation, and CERT-UA has not publicly attributed the attacks to a named group.
One particularly serious finding concerned unauthorised accounts installed after exploitation of the older authentication flaws. Such accounts can preserve an attacker’s access even when legitimate administrators change their normal passwords, complicating efforts to secure devices after a suspected intrusion.
The cloud relay issue presents a different security problem. Research by ITRES Labs found that some Dahua firmware released before mid-2024 permitted connections to a device’s web interface through Easy4IP after its serial number was identified, without requiring an exposed public network port. Authentication at the device could still be necessary. The researchers said the relay mechanism and the older authentication-bypass vulnerabilities were distinct weaknesses, requiring different protective measures.
ITRES Labs also found that certain camera interfaces indicated that firmware was current even when newer versions were available from the manufacturer’s website. That discrepancy means administrators cannot always rely solely on an automatic update message to establish whether equipment has received security fixes.
Dahua has advised customers affected by the documented authentication weaknesses to install repaired software or newer firmware. Security specialists additionally recommend disabling cloud relay access where unnecessary, replacing default credentials, reviewing unfamiliar user accounts and separating surveillance equipment from other network systems.
For organisations using cameras across multiple buildings, the immediate checks include comparing installed firmware with the vendor’s published versions and examining device settings for unexplained changes. Operators may also need to assess whether remote access is essential for each camera rather than leaving the feature enabled throughout a deployment.
The Easy4IP feature is described in Dahua’s own camera manuals as allowing mobile access through a serial number or scanned QR code, illustrating why it is convenient for legitimate users as well as relevant to the warning.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
