Ukraine Warns Hackers Exploiting Dahua Surveillance Cameras via Easy4IP Feature

Unauthorized Access to Dahua Devices

Ukraine's computer emergency response team, CERT-UA, reported that hackers are compromising internet-connected surveillance cameras and video recorders manufactured by Dahua. The attackers are gaining unauthorized access, modifying device settings, and establishing new user accounts without permission. The agency did not specify the number of compromised devices, the timeline of the attacks, or the identity of the perpetrators.

Exploiting the Easy4IP Feature

The method of attack appears to involve Dahua's Easy4IP feature, which enables remote access to cameras through the manufacturer's cloud service. This feature connects devices using their serial numbers, even if they are behind firewalls. CERT-UA noted that these serial numbers follow predictable patterns, allowing attackers to guess them and identify vulnerable cameras connected to the cloud. Devices with Easy4IP enabled are at risk even if their serial numbers have not been publicly disclosed.

Vulnerability Exploitation

Once a device is identified, attackers attempt to gain control by guessing weak or default passwords. They also exploit known security flaws in outdated firmware to bypass authentication. CERT-UA specifically highlighted two critical vulnerabilities, CVE-2021-33044 and CVE-2021-33045, which were disclosed in 2021 and affect certain Dahua camera and video recorder models.

Previous Incidents and Broader Impact

In August, cybersecurity firm Hunt.io reported that over 14,500 Dahua devices were compromised earlier in the summer, with infections concentrated in Ukraine and Russia. While the techniques used in those incidents were similar, it is not confirmed if they are directly linked to the cases described by CERT-UA. Chinese-made surveillance equipment, including Dahua products, is widely deployed in Ukraine, affecting government institutions and military units.