Who is the culprit behind the mass surveillance camera attack in Vietnam?

Millions of surveillance cameras of Hikvision (China) globally have been attacked by hackers, including those in Vietnam. A hacker has claimed responsibility for the attack.

In recent days, on the content viewing software interface of many Hikvision-branded surveillance cameras, a message in English has appeared: "Your security camera is in a vulnerable state and can be compromised. Let's fix it. Do it yourself or contact me via telegram account – faxociety”.

Phần mềm xem nội dung của camera Hikvision tại Việt Nam bị hiện dòng thông báo lạ bằng tiếng Anh (Ảnh: Đ.L).
Software to view the content of Hikvision cameras in Vietnam shows a strange message in English (Photo: Đ.L).

It is not too difficult for users to realize that their surveillance cameras have been hacked by hackers and leave messages on the content monitoring screen.

The situation of Hikvision's security cameras showing strange messages on the surveillance screen appeared on a global scale since mid-May, but users in Vietnam have only encountered this situation in recent days.

Recently, Reddit user @faxociety has claimed responsibility for a series of attacks on Hikvision's surveillance cameras. This person identifies himself as a "white hat hacker", which is hackers who attack the network for the purpose of warning, rather than destruction.

@faxociety said he noticed that many people install surveillance cameras but do not update the firmware to patch security holes, nor change the login password to manage the camera's content.

This makes the user's camera vulnerable to bad guys, much of the content recorded from the camera is stolen, shared or publicly sold online.

“This prompted me to notify people with a message on the camera screen. This announcement will let people know how vulnerable their systems are and what kind of world they live in,” @faxociety wrote on Reddit.

Một người dùng camera an ninh của Hikvision tại Ả Rập Xê Út cũng bị xuất hiện cảnh báo tương tự (Ảnh: Twitter).
A user of Hikvision's security camera in Saudi Arabia also received a similar warning (Image: Twitter).

“There are hundreds of thousands of vulnerable surveillance cameras around the world, and 90% is the reason why the cameras are compromised because of using weak passwords,” the hacker added.

In fact, @faxociety just exploited an old security hole, which existed on hundreds of millions of Hikvision surveillance cameras. This is a security bug discovered since 2021 and Hikvision has released a firmware upgrade to patch it, but it seems that many people still don't bother to update the firmware for their cameras.

Besides, many users still keep the habit of leaving the default login password on the camera, which allows hackers to easily penetrate and peek into the content recorded by the surveillance camera, including private and sensitive images.

Currently, surveillance cameras have become a very commonly used device in Vietnam, however, many users do not pay due attention to security issues when installing and using surveillance cameras.

There are many websites that are sharing or selling content recorded directly from surveillance camera systems globally, including in Vietnam. These are surveillance camera systems that have been compromised by hackers and stolen content, leading to the risk of users exposing private and sensitive images on the Internet.

Nhiều hình ảnh riêng tư, nhạy cảm của người dùng bị tin tặc lấy cắp thông qua các hệ thống camera giám sát (Ảnh: Twitter).
Many private and sensitive images of users are stolen by hackers through surveillance camera systems (Image: Twitter).

To ensure the safety of security cameras, @faxociety advises users to always upgrade the firmware for surveillance cameras as well as update the camera viewing software; Make sure to create a password strong enough to not allow hackers to break into the camera system…

In particular, users need to check if their camera has been created with another administrative account. This could be an account created by a camera installer to spy on the user's camera content. If one or more suspicious camera management accounts appear, immediately delete these accounts.