CERT-UA Warns of Dahua IP Camera Hijacking via P2P Access and Auth Weaknesses

The Computer Emergency Response Team of Ukraine (CERT-UA) issued an alert warning about unauthorized remote access to Dahua video surveillance systems. According to reported information, attackers have compromised IP cameras and digital video recorders (DVRs), gaining access to video streams, altering device configurations, and creating unauthorized third-party accounts.

CERT-UA noted that the primary initial access vector involves the Easy4IP peer-to-peer (P2P) platform. The agency reported that device serial numbers feature a predictable structure containing a 10-character model prefix and a 5-character hexadecimal counter. This structure can allow attackers to perform brute-force attacks at scale to identify cloud-connected devices without triggering rate limits.

Key Findings and Attack Mechanisms

• P2P Platform Exploitation: Attackers leverage the Easy4IP platform to reach devices behind network address translation (NAT).
• Authentication Weaknesses: Intruders bypass authentication barriers using weak passwords or by exploiting known firmware vulnerabilities, specifically CVE-2021-33044 and CVE-2021-33045.
• Indicators of Compromise: CERT-UA highlighted audit logs showing authentication events using the native DVRIP protocol from a local address (127.0.0.1) as a sign of P2P access.
• Persistent Backdoors: Similar independent research by Hunt.io identified instances where threat actors installed persistent backdoor accounts ('p2pwn / p2password') that can survive password changes and factory resets on certain firmware.

Practical Implications and Recommendations

Security authorities advise organizations and individuals utilizing Dahua surveillance equipment to evaluate their exposure and implement defensive measures:

• Disable the P2P feature if remote monitoring is not strictly required.
• Avoid exposing surveillance devices directly to the public internet.
• Apply available firmware updates to mitigate known authentication bypass flaws.

To verify official advisories and technical indicators, consult the official CERT-UA or State Special Communications Service of Ukraine (SSSCIP) web portals for direct alerts.