Internet Scans Target Hikvision Intelligent Security API
Researchers observe widespread scans probing Hikvision's Intelligent Security API (ISAPI) for vulnerabilities, potentially exposing device control and credentials.
Internet-wide reconnaissance scans targeting the Intelligent Security API (ISAPI) of Hikvision cameras have been detected, according to the SANS Internet Storm Center. This API, designed for integration with third-party products, offers extensive control over camera settings and management functions. While ISAPI has been available since at least 2018, recent scans are specifically targeting the /ISAPI/System/status endpoint, a likely indicator of efforts to identify ISAPI-enabled devices and probe for weaknesses.
The ISAPI supports both Basic and Digest authentication methods, and messages can be transmitted in XML or JSON formats. Hikvision cameras also offer encryption capabilities using AES 128 or 256 in CBC mode. However, the security of this encryption is significantly weakened if passwords are transmitted in cleartext over HTTP, especially when Basic authentication is employed. The encryption key derivation and the exposed initialization vector (IV) in the URL further compromise its effectiveness in such scenarios. HTTPS, when properly configured with keys and certificates, is recommended for more robust protection.
The /ISAPI/System/status endpoint is a prime target for attackers because it is expected to return system information, confirming the presence and accessibility of the ISAPI interface. A successful response, even an authentication error (401 or 403), indicates the API is active, whereas a 404 response would suggest it is not. This information is valuable for attackers looking to map vulnerable devices and potentially initiate brute-force attacks against credentials.
While the SANS honeypot network has observed these scans, full request details, particularly those containing authentication attempts, have not yet been captured. The researchers plan to update their findings if more comprehensive data becomes available. This ongoing activity highlights a persistent trend of attackers targeting Internet of Things (IoT) devices, particularly those with known histories of vulnerabilities, like Hikvision cameras.
The primary recommendation for users and organizations deploying Hikvision cameras, and similar IoT devices, remains consistent: avoid exposing them directly to the internet. Furthermore, these devices should not be placed in sensitive areas where a compromise could lead to significant security or privacy breaches. Proper network segmentation and access controls are crucial to mitigate the risks associated with such devices.
This discovery underscores the importance of continuous monitoring for new attack vectors against widely deployed hardware. The ISAPI, despite its intended purpose for integration, presents an attractive surface for attackers seeking to gain unauthorized access or control over surveillance infrastructure. The ease with which attackers can identify and probe these interfaces necessitates vigilant security practices and prompt patching or disabling of unnecessary services.
As the landscape of connected devices continues to expand, so too does the attack surface. The targeting of specific APIs like Hikvision's ISAPI demonstrates a maturing threat actor methodology, moving beyond generic vulnerability exploitation to more targeted reconnaissance of specific device functionalities. This proactive scanning for system status endpoints is a common precursor to more sophisticated attacks, including credential stuffing and exploitation of other potential flaws within the API's implementation.