Cyber Security Penetration Test Report

Background

Hanwha Vision has performed penetration tests on its products through trusted third-party white hackers. These hackers utilize professional diagnostic techniques and hacking tools. Hanwha Vision believes this activity enhances product security and expects that disclosing the processes and results will build customer trust.

Testing Purpose

Penetration testing is conducted for various reasons, including:

• Preventing vulnerabilities that could lead to serious personal information leakage, particularly relevant for surveillance equipment.
• Identifying vulnerabilities inadvertently introduced during development, such as from source code changes or platform upgrades.
• Demonstrating a commitment to product security from a customer's perspective, fostering trust in the protection of private information and control systems.
• Proactively assessing for emerging or newly discovered vulnerabilities that may not be widely published.

For more robust testing, Hanwha Vision collaborates with trusted third-party security agencies.

About STEALIEN

STEALIEN specializes in analyzing vulnerabilities across various service environments, including web, mobile, IoT, and cloud services. They create realistic threat scenarios and suggest appropriate countermeasures. STEALIEN has won international hacking competitions like CodeGate and DefCon and has experience identifying vulnerabilities in products from global vendors such as Windows Kernel, Google Chrome, Adobe, and VMware. STEALIEN has a strong relationship with Hanwha Vision and conducted this penetration test.

Testing Target and Scope

Penetration tests were conducted on network cameras in the X.XY.YY format from June 12, 2023, to August 4, 2023, by six vulnerability researchers. Further tests on cameras in the XX.XY.YY format were performed from September 18, 2023, to October 27, 2023, by five vulnerability researchers. Hanwha Vision network cameras utilize different software platforms depending on the version type, but cameras of the same type are guaranteed to operate consistently.

Target Network Camera #1

• Version types: X.XY.YY
• Targeting firmware: 2.XY.YY

Target Network Camera #2

• Version types: XX.XY.YY
• Targeting firmware: 23.XY.YY

The testing covered the camera's system and services, network, and security functions. This included:

• Device System: OS, firmware, and root file system.
• Device Built-In Service: http/s, rtp/rtsp, onvif, ntp, upnp, and running environment.
• Security Features: secure boot, secure update, digital signature, authentication, secure communication, and secure storage of sensitive information.

Testing Methods

Testing was performed using STEALIEN's standard black box security assessment methodology and techniques, including:

• System and Firmware Test: firmware forgery, memory corruption, memory leak, denial of service, reverse engineering of firmware.
• Network Test: packet replay, sniffing, spoofing, and forgery.
• Web Application Test: file download/upload, XSS/CSRF, directory listing/traversal, SQL injection, parameter injection.
• Security Features Test: authentication bypass/forgery, privilege escalation, secure boot/update, cipher key cracking, decrypting cipher text, inferring hashed plain text.
• Others: hardware debug port access, known open-source vulnerability attacks.

Summary of Findings

Target Network Camera #1 (X.XY.YY format, firmware 2.XY.YY)

User input validation and memory protection techniques are well-applied, effectively responding to memory-based attacks. Attack codes are filtered by data validation logic, neutralizing many attack techniques. Security functions like encryption are appropriately implemented in firmware, communication, authentication, and video transmission/reception. A misconfiguration in the boot stage allowed acquisition of a UART shell.

Target Network Camera #2 (XX.XY.YY format, firmware 23.XY.YY)

Firmware file protection, including digital signature, secure boot, and firmware encryption, is excellent. Hardware debug physical ports are access-controlled. Input value validations are generally well-implemented, protecting against memory-based attacks like Buffer Overflow. However, some web UI input sections had incorrect validation logic, and access to the hardware debug physical port was not fully controlled at the time of the firmware update.

Mitigation

Hanwha Vision has addressed all identified vulnerabilities by updating the firmware for network cameras. Cameras in the X.XY.YY format received firmware updates in October 2023, and cameras in the XX.XY.YY format received updates in November 2023. These firmware updates are available for download from the Hanwha Vision homepage. It is recommended to always use the latest available firmware version for your camera.

The model names of the enhanced cameras are listed below: