Hikvision and Dahua Surveillance Cameras: Global Locations Report

Chinese firms Hikvision and Dahua have enjoyed stratospheric growth to become the biggest video surveillance technology firms in the world.^[1]

Yet there are serious questions around the companies’ cybersecurity track records, as well as the data privacy risks arising from their ownership by the Chinese government. Hikvision and Dahua have also received international condemnation for the central role their IP camera networks play in the repression of the Uyghur people.

The goal of this research was to map out exactly where this Chinese surveillance technology was most used outside of its native country. We hope that our findings will raise public awareness of both the pervasiveness of these IP camera networks and the privacy and cybersecurity risks associated with this technology.

What is an IP camera network?

Each IP camera in the network functions as an independent device with its own unique Internet Protocol (IP) address, enabling it to transmit and receive data over a network, typically a Local Area Network (LAN) or the Internet.

The networked nature of IP cameras allows them to be accessed remotely from various devices such as computers, smartphones, or tablets.

The system may include a Network Video Recorder (NVR) or use cloud-based storage for archiving video footage.

This investigation is the first to comprehensively map Hikvision and Dahua camera networks active outside China.

In doing so, we identified the countries and cities most surveilled by these controversial firms’ technology.

Despite facing a variety of trade restrictions in the U.S.,^[2] this investigation shows that efforts to decouple the American and Chinese tech sectors have had limited success. In fact, more than one in ten camera networks identified in this report are in the U.S.

Note that this report identifies networks of cameras, each on a single IP address, rather than individual cameras. As networks tend to comprise multiple devices, the total number of individual Hikvision and Dahua surveillance cameras covered by this report will likely be many times higher than six million.

Hikvision and Dahua have faced accusations that their technology poses a risk to citizens’ cybersecurity and digital privacy.

Dahua has been described as “terrible at cybersecurity”,^[3] and Hikvision has been subject to similar criticism.^[4]

A critical vulnerability affecting Hikvision cameras was discovered by a security researcher in September 2021, who found dozens of models of Hikvision devices could be hijacked remotely without requiring log-in credentials.^[5]

While this vulnerability was patched by Hikvision, tens of thousands of networks across 100 countries had still not applied the update more than a year later.^[6]

As a result, a Mirai-based botnet called Moobot spread aggressively by exploiting this vulnerability in the webserver of many Hikvision products.^[7]

A month later, two similar authentication bypass vulnerabilities were disclosed that affected an extensive list of Dahua products. A further vulnerability was discovered in 2022 that allowed attackers to hijack Dahua cameras and take full control over the devices.^[8][9]

Another critical vulnerability, disclosed in September 2022, allowed hackers to remotely access Hikvision devices and steal admin credentials. This affected over 400,000 Hikvision cameras, many of which were older devices with no fix made available.^[10]

These cybersecurity concerns have been exacerbated by the companies’ links to the Chinese state.

Hikvision, or Hangzhou Hikvision Digital Technology Co., Ltd. as it is formally known, is 42% owned by Chinese state investors, while Dahua Technology Company is 2.4% owned by such investors.

More broadly, the degree of autonomy provided private companies in China has repeatedly been called into question.

In 2018, a US-China Economic and Security Review Commission report warned:

“Through IoT products and services, Chinese firms may be transferring data from their U.S. consumers to China, where the government retains expansive powers to collect and exploit data with little regard for privacy or ownership concerns.”^[11]

Hikvision and Dahua have faced a series of trade restrictions in the U.S. due to their alleged role in the repression of the Uyghurs and other minority groups in Xinjiang, north western China.

In October 2019, both companies were added to the Department of Commerce’s ‘Entity List.’^[12] The Bureau of Industry and Security states that “transactions of any nature with listed entities carry a ‘red flag'” and U.S. companies must now receive a special license to sell to either Hikvision or Dahua.^[13]

The decision followed the 2019 National Defense Authorization Act which prevented either company from selling their equipment to U.S. federal agencies.^[14]

Despite Hikvision and Dahua both facing restrictions in the U.S., we found that both companies are being technically supported by U.S. companies, including web hosting providers Amazon, Digicert and Entrust.

More recently, Norway’s Council on Ethics recommended excluding Hikvision from the country’s wealth fund investment portfolio because of the company’s “role in the mass surveillance of the population in the Xinjiang region of China.”^[15]

In its 2021 report, the UK Foreign Affairs Committee called for a ban on Hikvision operating in the UK among measures intended to “pressure the Chinese government to end its persecution of Uyghurs”.^[16]

According to a report by IPVM, Hikvision “is financing around $145m worth of Xinjiang police video surveillance projects” and both companies have faced accusations that their technology can be used to automatically detect Uyghurs.^[17][18][19]

Hikvision has stated that it “takes global human rights very seriously”. A spokesman told Reuters that “all our business is required to align with the company’s compliance policy” but declined to say what its compliance policy was beyond that it was in line with local laws.^[20]

Dahua has similarly claimed that the company “adheres to the business code of conduct, and follows market rules as well as international rules.”^[21]

In the Oct 2021 update, Dahua and Hikvision surveillance camera networks were identified via Shodan scans and compiled from all relevant searches over the course of Sep 2021, generating almost 11 million results. Camera networks were inferred from unique IP address and port combinations. Additional geolocation data was sourced via MaxMind and combined with the dataset using in-house tools, following extensive data cleansing.

This data replaces the original findings that were derived from data collected in Oct-Nov 2020. Due to changes in the way Shodan scans operated in the intervening period, it was not possible to perform a fair comparison between the two datasets.

Findings for all countries and the top 1,000 cities are available via this Google Sheet.

About Us

Since 2016 we’ve focused on testing and reviewing VPN services, and over the years we’ve helped our readers find secure VPNs to stay safe and private on the web.

We also inform our readers about digital rights, privacy and security matters through our expert research and investigations.

^{[1] https://www.technologyreview.com/2022/06/22/1054586/hikvision-worlds-biggest-surveillance-company/ ↩}

^{[2] https://www.reuters.com/article/us-china-usa-restrictions/factbox-trump-administration-measures-against-chinese-companies-idUKKBN29C17E?edition-redirect=uk ↩}

^{[3] https://ipvm.com/reports/dahua-psa-sia ↩}

^{[4] https://www.csis.org/blogs/technology-policy-blog/hikvision-corporate-governance-and-risks-chinese-technology ↩}

^{[5] https://www.forbes.com/sites/leemathews/2021/09/22/widely-used-hikvision-security-cameras-vulnerable-to-remote-hijacking/ ↩}

^{[6] https://www.malwarebytes.com/blog/news/2022/08/thousands-of-hikvision-video-cameras-remain-unpatched-and-vulnerable-to-takeover ↩}

^{[7] https://www.bleepingcomputer.com/news/security/moobot-botnet-spreading-via-hikvision-camera-vulnerability/ ↩}

^{[8] https://www.bleepingcomputer.com/news/security/unpatched-dahua-cams-vulnerable-to-unauthenticated-remote-access/ ↩}

^{[9] https://thehackernews.com/2022/07/dahua-ip-camera-vulnerability-could-let.html ↩}

^{[10] https://ipvm.com/reports/hik-2472 ↩}

^[11]

^{[15] https://www.uscc.gov/annual-report/2018-annual-report-congress ↩}

↩

^{[12] https://www.federalregister.gov/documents/2019/10/09/2019-22210/addition-of-certain-entities-to-the-entity-list ↩}

^{[13] https://www.bis.doc.gov/index.php/cbc-faqs/faq/281-1-what-is-the-entity-list#faq_285 ↩}

^{[14] https://www.congress.gov/115/bills/hr5515/BILLS-115hr5515enr.pdf ↩}

^{[15] https://etikkradet.no/hangzhou-hikvision-digital-technology-co-ltd-2/ ↩}

^{[16] https://committees.parliament.uk/committee/78/foreign-affairs-committee/news/156425/foreign-affairs-committee-publish-report-never-again-the-uks-responsibility-to-act-on-atrocities-in-xinjiang-and-beyond/ ↩}

^{[17] https://ipvm.com/reports/xinjiang-dahua-hikvision ↩}

^{[18] https://ipvm.com/reports/dahua-uyghur ↩}

^{[19] https://ipvm.com/reports/hikvision-uyghur ↩}

^{[20] https://uk.reuters.com/article/us-hikvision-china-insight/hikvision-a-surveillance-powerhouse-walks-u-s-china-tightrope-idUKKCN1VJ05C ↩}

^{[21] https://www.dahuasecurity.com/my/newsEvents/DahuaNotice/647 ↩}