Dahua IP Camera Hijacking Exposes Critical Surveillance Risks
Attackers are exploiting P2P access and authentication flaws in Dahua devices across Ukraine. CERT-UA warns of compromised video streams and unauthorized configuration changes.
TL;DR
- Threat actors gained remote access to Dahua IP cameras and DVRs in Ukraine
- Exploited weaknesses include P2P connectivity and poor authentication
- Incidents involved video stream access, config changes, and new account creation
- CERT-UA advises immediate firmware updates and network segmentation
- Organizations should audit device credentials and disable unused services
Security researchers have uncovered a significant compromise targeting Dahua IP cameras and digital video recorders across Ukraine. According to alerts from CERT-UA, attackers are leveraging peer-to-peer (P2P) access mechanisms and authentication weaknesses to gain unauthorized control over these devices.
The State Special Communications Service of Ukraine reported multiple cases where threat actors accessed live video feeds, modified device configurations, and created unauthorized administrative accounts. These incidents highlight critical security gaps in widely deployed surveillance infrastructure that could expose sensitive operational data.
Attack Vectors and Exploitation Methods
- Attackers exploited default or weak credentials combined with P2P connectivity features
- Remote access was achieved without physical interaction with the devices
- Compromised devices showed evidence of configuration tampering and backdoor account creation
- Many affected units lacked recent firmware updates or security patches
Security Recommendations
- Immediately update all Dahua devices to the latest firmware versions
- Disable P2P connectivity features unless absolutely necessary for operations
- Implement strong, unique passwords and consider multi-factor authentication
- Segment surveillance networks from primary corporate infrastructure
- Conduct regular vulnerability assessments on IoT and edge devices
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.