Ukraine Warns of Hackers Exploiting Dahua Surveillance Cameras
Ukraine's cybersecurity agency has issued a warning about ongoing exploitation of Dahua surveillance cameras and recorders, with attackers compromising devices and creating unauthorized user accounts.
Ukraine's Computer Emergency Response Team (CERT-UA) has alerted the public to a concerning trend: hackers are actively compromising Dahua surveillance cameras and recorders, gaining unauthorized access to video feeds and remote control capabilities. The agency reported that attackers have been observed altering device settings and creating new, unauthorized user accounts on these internet-connected devices.
The compromised devices, manufactured by Chinese firm Dahua, are widely used in Ukraine, including by government institutions and military units. CERT-UA indicated that the attackers are likely exploiting a feature known as Easy4IP, which enables remote access to cameras via the manufacturer's cloud service. This feature connects devices using their serial numbers, even if they are behind firewalls or not directly accessible from the internet. The attackers reportedly leverage predictable serial number patterns to identify vulnerable cameras connected to the cloud service.
Once a target device is identified, threat actors can attempt to gain access through brute-force attacks on weak or default passwords, or by exploiting known security flaws in outdated firmware. CERT-UA specifically highlighted two critical vulnerabilities, CVE-2021-33044 and CVE-2021-33045, which were disclosed in 2021 and affect certain Dahua camera and recorder models. These vulnerabilities could allow attackers to bypass authentication mechanisms.
This warning follows similar reports from cybersecurity firm Hunt.io, which in August noted that hackers had compromised over 14,500 Dahua devices, with a significant concentration of infections in Ukraine and Russia. While the techniques used in those incidents appear similar, it remains unclear if they are directly linked to the CERT-UA findings.
Dahua, a major global manufacturer of video surveillance equipment, has previously faced scrutiny in the United States due to national security and human rights concerns. In 2018, U.S. federal agencies were prohibited from purchasing certain Dahua products, and the company was later placed on a trade blacklist over its alleged involvement in the surveillance of Uyghurs in China's Xinjiang region.
The alert from CERT-UA arrives amidst heightened concerns in Ukraine regarding the potential misuse of surveillance cameras by Russian intelligence services. Since Russia's full-scale invasion in 2022, Ukraine's security agency (SBU) has identified and secured approximately 40,000 surveillance cameras that could be exploited for military intelligence gathering. Earlier this year, the SBU reported instances where Russian operatives allegedly hacked cameras on residential buildings in Kyiv to monitor air defense activities and critical infrastructure.
Despite these ongoing security concerns, Ukrainian public procurement records indicate that government institutions and military units have continued to purchase Dahua equipment in recent years. It is currently unknown if any of the devices identified in CERT-UA's latest warning belong to these sensitive organizations.
The exploitation of IoT devices like surveillance cameras remains a significant threat, particularly in geopolitical conflict zones. The ability of attackers to compromise these devices for surveillance, disruption, or as entry points into larger networks underscores the critical need for robust security practices, regular firmware updates, and careful vendor selection.