The US Government wants to make it ILLEGAL to own these security cameras. NDAA and SEA explained.

In 2017 the National Defense Authorization Act (NDAA) banned government agencies from using security cameras made by Hikvision and Dahua, and in 2021 the Secure Equipment Act aimed to broaden that ban to include private companies and citizens. This video will get you up to speed on how these laws came to be and how they might affect you.
My recommended NDAA and SEA Compliant Cameras:
Reolink RLC-811A (AmazonUS): amzn.to/3nVC8jI
Reolink Duo (AmazonUS): amzn.to/32qMNdY
Reolink 8 Camera NVR Package (AmazonUS) amzn.to/3kuNzfW
My recommended NDAA and SEA Non-Compliant Cameras:
Empire Tech T5842 (Amazon): amzn.to/3i4AuYO
*As an Amazon Affiliate I earn a commission on qualifying purchases at no cost to you*
Security Camera Playlist: • Security Cameras
Visit my website: www.TheSmartHo...
Follow me on Twitter: @TheHookUp1
Join me on Facebook: www.facebook.c...
Support my channel:
Patreon: / thehookup
Music by www.BenSound.com

[@TheHookUp]

Lots of people are projecting their geopolitical views onto this video. I want to state CLEARLY the intended messages of this video: 1) The NDAA does not apply to private citizens, but the SEA could if the FCC revokes certifications as they have hinted at. 2) Every internet connected camera or device has a chance of being compromised regardless of its country of origin. Whether the 2017 backdoors were accidental or purposeful is not anything that can be proven and is largely unimportant. Blindly trusting a device based on some trust of that county's government is not a cybersecurity best practice and should not be done. 3) If cybersecurity best practices are followed the risks can be reduced to nearly zero regardless of a device's country of origin. 4) This is not a pro-China video, this is a pro-cybersecurity and anti complacency video.

[@Dudleydogg]

I used to be heavy port forwarder, having RDP gateways online using MFA to access Virtual machine Desktops, and was Con - VPN, in later years i have completly changed my Security thinking process, Now Nothing is online, and I have Group Rules and Policies via VPN to access internal Resources. I even blocked Home Assistant from Internet. I use VPN that Requires MFA type authentication and Certificate authenitcation and this is just for my Home Netowrk. So anyone in Enterprise not ahearing to even the most basic Network Security is at fault and not Bad Firmware. Even Ring got Hacked and pedo's were watching little children, Did we oust Ring from USA, nope. Thank you for this Video otherwise I was totally Unaware of this and I am 100% hikvision and non of them have internet Access.

[@johnsmith2247]

Exactly! Unlike Dahua and Hikvision that one can completely isolate from the internet, what happens if you try that with a Ring device - the device becomes useless. I would be more concerned about the Chinese hacking the billions of Alexa devices and Ring and other Amazon IoTs and doing more harm than the partially China owned cameras that I can completely isolate!

[@maxdouglas5239]

You sound pretty pro CCP to me.

[@johnsmith2247]

I wonder how many of these people saying you are pro CCP actually live their life with not a single product in their life not made, produced, or a component sourced from China LOL. Only way that happens is if someone is growing all their own food, making their own clothing and shoes from the cotton they are growing on their own land, and has the capability to make their own computers and phones solely with the material on their land and developed their own cellular and internet that doesn't allow a single bit of data to go thru any peripheral anywhere that was produced in China LOL. Oh yeah and they walk everywhere and do not have a car LOL. The fact is too much is relied on outsourcing and until that changes and goods and services can be competitively produced locally, folks are living in a dream world as it is impossible to live like that. Heck even the Amish use stuff made from China LOL.

[@empiretech-andy9543]

These dahua and hikvision cams are much safer than anytime, because all world are watching on it. The small brands cybersecurity will be big concerns. This no one real care about, maybe dahua and hikvision are big enough to eat up some big local companies, this is the main point.

[@kevincedeno8899]

The definition of a backdoor provided in this video is incorrect. Backdoors are usually not accidental in nature. "A backdoor is a typically covert method of bypassing normal authentication or encryption"

[@Darlemonte]

Exactly. That's why I have a problem with how he covered this. It seems bought and highly misleading. Unless he "accidentally" studied the wrong thing.

[@asleepawake3645]

Yes, politicians can't differentiate between bug and backdoor, but they skillfully use any term for the purpose of swaying public opinion to manufacture FUD.

[@andrewsmith9980]

This guy is getting being paid by someone. I have had a Chinese company try and remotely access my cameras. They only needed the Mac address of the camera and they can fully access the camera remotely. This is a backdoor.

[@boboutelama5748]

Like Cisco, LG or Microsoft did in the past, to collect their customer's data.

[@alexandrjackson]

up comment

[@chukah9484]

I do agree that the government should just significantly increase their network security and have specific standards met for government buildings and business partners. But I also believe that the Chinese government would utilize their cameras buggy firmware as a surveillance strategy even if it wasn't initially designed for that purpose.

[@TheHookUp]

I think the Chinese government is equally likely to utilize buggy firmware in any camera or device, regardless of where it was manufactured.

[@danroot84]

1. It was designed for that purpose. This is fact. 2. Of course they are going to exploit vulnerabilities… we are constantly under attack from China. They are an adversary, not a friend. All reasons we should NOT be using their “cheap” cameras subsidized by their government. The same government attacking us…

[@74357175]

@@TheHookUp but it's much easier if the Chinese government puts the backdoor there. It's naive to assume they won't, given 1. The surveillance state they already have, and 2. The US government also wanted to backdoor chips in the past, and the Chinese government has way more ability to get this done, given their ownership of so many companies

[@Wombbatts]

Nothing is better than a cheap a$$ communist china booster who really has no idea what they are talking about. Think of china as a giant security apparatus, where all companies are owned by the ccp and are required by law to turn information into the ccp. Gee what can the chinese learn from millions of cameras. Oh I don't know, what can millions of people observe with their eyes? There there is the ability for china to s3witch off the cameras, what cou,ld go wrong with switching off security cameras?

[@Infrared73]

I would expect any buggy firmware to be utilized by any unscrupulous party. The ability of a company to create a secure product has nothing to do with where that company is based. Look at Solar Winds for example. Or Google with their recent emergency update to Chrome. Creating these types of laws, and politicizing "vulnerabilities" will make security worse. Now a company is more incented to hide and suppress vulnerabilities rather than sharing them.

[@jjdawg9918]

I don't know how or when the definition of a backdoor evolved into "accidental" but that did not used to be the case. They were always intentional and "installed" by someone who had full access to the source software..... at least when that term was first used. Vulnerabilities and exploits are unintentional and due to sloppy programing and "external" malicious actors. Now if the government is basing their actions upon an old de-facto use of the term backdoor then I can see why they are so excited. If this is however just an exploit of a vulnerability then that is also a problem, one of misinformation. Imagine a naive advisor using the wrong term to describe a vulnerably/exploit...hmmmm That said, my 75 year old mother has more tech smarts than any US politician. They have no idea what they are doing or signing when it comes to security, privacy or tech in general. And anything used by the DoD should be manufactured in the US and be FIPS certified.

[@Arkryal]

This is politics. ITAR would have already covered such things with defense contractors and the like. Lawmakers wanted to extend the scope beyond defense, and that's easier done through new legislation. And you are correct, a "Backdoor" is deliberately placed, whereas a "hole" is accidental. But you must treat every hole as a potential backdoor, as the intentions of the parties that left it open are unknowable. That's where this conversation started circling the drain. From a security standpoint, you must assume every hole is a backdoor, is known to the person who left it open and has been actively exploited. So security guys tend to use the terms interchangeably, as in their world, they are the same thing, you must assume the worst. But when it comes to assigning liability, there's a world of difference between a deliberate and accidental act. Tech jargon is oddly very imprecise, but politicians usually come from law backgrounds where words have explicit meanings and implications. So it's no wonder when tech guys inform politicians, much is lost in translation. It's not that politicians don't understand, it's that they over-estimate their understanding because their view of the topic is narrow and acutely focused. They understand the issue completely, from an extremely constrained viewpoint, but end up missing the mark on bigger-picture stuff with tech. Or the inverse, they grasp the big picture very well, but understand none of the nuance. I work right where the law intersects technology, and miscommunications are a persistent obstacle. Understanding digital security and the law are mutually exclusive. To do either adequately is a full-time job, you're forever learning new things, everything is in a constant state of change, and there just aren't enough hours in a day to master both. It's the same thing with doctors, they are shockingly tech-illiterate, despite working with some of the most advanced technology humanity has ever produced. They trust that it works without understanding how, and when they tell you how they think it works, they're usually very, very wrong, lol. It's been getting better in recent years as younger professionals join these fields and have grown up with this technology. There's a little more innate understanding with some of the more junior people, but this problem will always exist, save for a very small handful of people who can manage to be successful in both areas. And those people don't have time to campaign for political office, so...

[@MartinJab]

Backdoor is vulnerability by design. If it isn't intentional, it isn't backdoor.

[@TheHookUp]

Incorrect, sorry: www.malwarebytes.com/backdoor

[@linuxrules25]

@@TheHookUp I pulled this from the link you provided "Exploits are accidental software vulnerabilities used to gain access to your computer and, potentially, deploy some sort of malware. To put it another way, exploits are just software bugs that researchers or cybercriminals have found a way to take advantage of. Backdoors, on the other hand, are deliberately put in place by manufacturers or cybercriminals to get into and out of a system at will."

[@Hessijames79]

Thank you! To add to that: Backdoors are often made to look like programming errors to allow for plausible deniability.

[@TheHookUp]

@Brian Grohe well that's embarrassing. But it does also say "A backdoor refers to any method by which authorized and unauthorized users are able to get around normal security measures and gain high level user access (aka root access) on a computer system, network, or software application." Which is the definition I'm most familiar with. Doesn't matter if it's intentionally placed or accidental (though if it referred to as a backdoor exploit I believe accidental is implied).

[@danroot84]

@@Hessijames79 Exactly.

[@brianl5631]

Backdoors are not accidental. Programmers use them while testing during the coding process. Now, a programmer may have forgotten to remove it, but it is just as likely it was left there on purpose. Your choice whether it was the actual government doing it, or a programmer looking for a way to extort or sell access later. Either way, of course they are gonna say it was unintentional and harmless.

[@garethbraid937]

Agreed, however basic coding errors that introduce exploits can also be characterised as backdoors by those who have a position on the manufacturer/country of origin, or a potential solution, to sell.

[@EbuzzNYC]

Most Americans don't understand that China has an actual law, called the National Security Law that embeds member of the CCP into corporations, especially those that are deemed of national security importance. This gives the CCP a great amount of power into decision making, and making sure those companies are helping China's security interests.

[@threepe0]

"backdoors are not accidental" - backdoors aren't all anything. From exploits to intentional features, from requiring local access to the ones that "phone home" to servers, they vary wildly. Blanket statements like this aren't helpful or accurate.

[@monti409]

I previously owned a security system made up of HIK Vision cameras, they worked fine for the first two years, that is until HIKVison would not permit me to updates unless they ( Hikvision ) had access to my contacts and photos on my iphone. I removed the camera setup entirely from my home.

[@TheHookUp]

That's super strange. You were updating firmware through the app? Why not through the web interface?

[@garethbraid937]

So, you were relying on a phone app to use/manage the cameras? IMO the only access your phone should have to a camera is an RTSP stream - and that's only if it's critical. Technically, I assume that you actually mean the app required access to your contacts and photos. Whether this data would/could then be seen by Hikvision I would assume is unknown?

[@Zeric1]

You are missing the point on cybersecurity, your phone shouldn't even have an app installed for the cameras, nor should the cameras have access to the internet.

[@PatrickRigney]

If the government is doing it for our protection, it's probably going to cost us. If they're doing for their protection, it certainly will.

[@TexasWebbCom]

I do generally agree with everything you said.. I would like to point out some items you skipped over. 1. Legal liability. If there is a breach as a result of "sloppy" programming. We have far more action available to us if it's a US company. Good luck going after a Chinese company! 2. We, as Americans, have gotten too complacent in the purchasing "cheaper" good while complaining about US manufacturering jobs. Can't have it both ways.

[@TheHookUp]

The only serious US camera manufacturer is Avigilon by Motorola and their cameras are astronomically expensive. Other big names are Bosch (German), Axis (Swedish), and Hanwah (Korea), so I'm not sure if we would have actions available to them either.

[@TexasWebbCom]

@@TheHookUp I understand. But as long as the cheapest alternative is available. No one in the US will produce. This falls in line with "security for economy" parallel you implied in the vid. I agree that's this has a huge economic drive and I would be very curious what US producers are on standby to grab gov contracts.

[@macemoneta]

This is a fallacy. US manufacturing that is innovative, develops new technology, and exploits existing technology to lower the cost of manufacture can easily be the best and lowest cost option. See SpaceX as an example. The problem, and the reason overseas manufacturing took over, is the complacency US companies had/have. As soon as a disruptor enters the market, they suddenly find new, modern ways of doing business. Status quo or government protection allows reinvestment to die off, to the detriment of consumers.

[@LowJSamuel]

@@macemoneta What you are saying is untrue. You can tell by just looking at how many American companies move their manufacturing to China. Clearly they do that for a reason. It is possible for some particular industries to be the lowest cost option by remaining in the States. SpaceX is just an example of this.

[@tvathome562]

Even in Europe manufacturers close shop and take it to Asia or Eastern Europe where labour is cheaper, yes we still have industry leaders in tech but they don't cater to the mass markets, producing budget products.

[@mikeward1701]

When it comes to security vulnerabilities and backdoor exploits; it doesn’t matter if they were caused by malice or incompetence, the end result is the same.

[@MartesWigglesworth]

I love that last reference to economic motivations because I found that the UNV brand I had never heard of is literally hundreds of dollars, and within NDAA regulation however, the same features on Dahua or HikVision would only be around $80. That is the first thing I noticed about this NDAA business. All the "authorized" camera manufacturers are literally four times the price they should be since they can market to government and large entities and demand a premium because they are not on the blocked list.

[@SmartLifeEnthusiast]

Not to nitpick, but imo the initial statement that a "backdoor" is accidential doesn't seem to fit with the common usage of the term. Being able to bypass authentication/authorization could be because of e.g. a remote code execution vulnerability, os command injection vulnerability, insecure direct object reference vulnerability, ... The idea of the backdoor is that it's an _intentionally_ installed feature to bypass the auth'n/auth'z flow put in place for regular users and hidden from those same users. Like a override code for a hotel safe, but with more effort done to hide it; or a mathematical shortcut in an encryption algorithm that would allow LEA to decrypt secured communications. That being said, the crux of the US banning CN tech is based more on political motives than technological evidence of backdoors. And of course, keep cameras offline and locally managed

[@rob-toolsandtech2521]

Yeah, we recently found out Wyze knew about a security flaw that they took 3 years to fix.

[@TheHookUp]

Yeah, that was a big oof for sure.

[@adamjhuber]

1:17 in my opinion these back doors were not put in on purpose. So this statement was made based on feelings not facts. Are you that naïve to think that “back door” was just accidentally put there? You sound like a spokesperson for the Chinese government.

[@TheHookUp]

"So this statement was made based on feelings not facts", yes that's what an opinion is. However, I do hold cybersecurity and computer science certifications and have taught courses on both, so my opinion may be slightly more valid than some. I'm certainly not a cybersecurity expert, but well above average.

[@Catsrules1]

"Never Attribute to Malice, that which can be explained by stupidity/incompetence." We will probably never know for sure if this was done by malice or stupidity I personally think it was done by stupidity/incompetence because if you think about it most cameras will never be internet accessible and the vulnerability as far as I understand it need to have access to the camera's webpage to compromise the camera. There are have so many vulnerability like this from multiple companies from cameras to printers to routers. No software is perfectly secure it is only a matter of time until someone finds a way to bypass the security.

[@SL-vs7fs]

Wow, dude! Loved your straightforward and no BS explainer.

[@MichaelCur]

Good explanation, but disagree with your definition of 'backdoor'. Some backdoors are put there purposefully so the developer can bypass authentication for testing or other purposes.

[@TheHookUp]

Yeah, that was perhaps a bit of a misstep. After doing a bit more research today think the distinction is "backdoor exploit" vs "backdoor vulnerability". A backdoor exploit is accidental while a backdoor vulnerability can be intentional. Seems like semantics to me though.

[@danroot84]

@@TheHookUp Extremely important semantics. Especially when you are on a platform like YT and have 300k+ subs….

[@thugpug4392]

@@danroot84 I don't see how it's that important.

[@danroot84]

@@thugpug4392 Because intent matters here. The Chinese Government (CCP) is an adversary who intends to infiltrate our networks and cause harm. In layman’s terms: they don’t like us. Suggesting they innocently stumbled upon some firmware “vulnerability” located within a CCP subsidized camera manufacturer’s product is factually wrong. Human nature forgives innocent missteps, but not intentional attacks. If this determines support or opposition to these cheaper brands - multiplied out at scale for his subs and the platform… that’s a lot of misguidance.

[@TheHookUp]

"Suggesting they innocently stumbled upon some firmware “vulnerability” located within a CCP subsidized camera manufacturer’s product is factually wrong." But that's exactly what happened. The user of an online security camera forum discovered the vulnerability.

[@evancombs5159]

Your definition of a backdoor is incorrect. Them being intentional is the whole reason why they are called backdoors instead of something else. So if the exploits are unintentional then they should have a different name. Being Chinese companies I could see these being intentional, but I could also see them being mischaracterized as backdoors as well.

[@jh61]

Is there any validity to the backdoor being used to retrieve lost passwords for Users who become locked out but had provided an email address in setup for that reason? I think my Amcrest recorders are setup in someway like that.

[@BowWowPewPewCQ]

I can't believe our legislators are making laws about something they are totally ignorant about. Without mentioning specifics, the same thing applies to a current very high profile topic affecting 100s of millions of Americans. Every time I talk to people about security cams I stress to not use the EZ install method and to NOT give the camera access to the internet. I do the same with any IoT device. Staying local is where it's at!

[@ejones6616]

They do it all the time. Saw a clip of a congresswoman saying she held an AR15 and it weighed as much as 10 suitcases and shoots a .50 cal round. 😂

[@DDDarkz]

If we step back and look at the all the damage US govt has done to the top Chinese companies at this point (even after 9 month of your vid), it is very clear these are not security related concerns, simply political but also pushing out the competitions. The open market concept was a great idea when US was ahead of everyone, but once other countries starting to catch up, the US will close every door to block the competition instead of improving themselves.

[@ianbutler1983]

You are sympathetic towards Chinese companies?

[@DDDarkz]

@@ianbutler1983 Keep in mind is the consumers that will always suffer from garbage policies created by the terriorist elites. This will only teach other countries to steer away from the US on this so called "free market" scam.

[@LosOjosTristes]

@@ianbutler1983 More like, critical of the U.S. government giving monopolies to certain companies.

[@Lejackal]

9 months late to this convo, but i love how a government organization sees limits on their power and scope as loopholes that need to be closed…every time I see this i hear Cartman from South Park “I do what i want!, Respect my authariti

[@flo5767hgy]

First thanks for your great videos. They are usually well informed. However in this case you may be lacking some cybersecurity background. There are assumptions you’re making that are wrong or lack data, examples: - the vulnerability is unintentional. Btw: backdoor is a malevolent vulnerability set on purpose. Many backdoors are disguised as unintentional vulnerabilities. The cybersecurity community works with intelligence and law forces. An assessment is not only based on technical analysis - cameras should be disconnected from internet. That’s the theory but really isolated networks are incredibly hard and expensive to set. Attackers are very good at bridging these isolated networks with 1/internet compromising firewalls for standard isolation, 2/ hardware to bypass vnet, 3/ radio waves or similar to breach air gaped networks etc. At the same time, most corporations are not implementing a good enough security. The standard practice is to assume breach: no network is safe - the government is focusing on cameras when there is more important things to do. it is part of a global approach. Take a look at the executive order for cybersecurity to see what’s being done regarding supply chain risks. It is good to challenge these regulations as they can easily hurt our liberties, but please ask yourself if your opinion is based on facts or biases. 😁 Anyway, that is tu he only time I disagreed with one of your videos, they are great! Thanks!

[@TheHookUp]

I'm by no means a cybersecurity professional, but I do hold certifications in both computer science and cyber security, so my opinion is probably more valid than the majority. As discussed in other comments a backdoor doesn't imply that it was set on purpose, only that it allows an unauthorized user to gain high level access without credentials. Specifically a backdoor exploit is unintentional, and looking at the dahua backdoor specifically it is a simple pass the hash attack seems like it was just overlooked when designing the CGI command interface. I disagree that isolated networking is difficult. If there are secretly installed RF components capable of crossing air gaps then that is certainly a different issue, but I haven't seen any evidence of that, or even anyone alleging that vs Dahua or Hikvision. Any network engineer should be able to create and maintain isolated networks, period, if they can't then they need to find a new job. That would be like your mechanic not being able to change the oil in a vehicle.

[@flo5767hgy]

@@TheHookUp I cannot disagree with your statement on engineers but that’s not the reality. With your approach 99% of engineers would be fired and then? 😁 Securing a stack (network, hardware, infrastructure, software, logic, processes) for 100k persons worldwide is completely different than securing your house. Complexity is way higher, the level of threat also. I won’t try to convince you but hope that you will keep an open mind. We could continue the conversation if you’re interested but not here. Note: If experience makes an opinion more legit, I have 20 years of experience on cybersecurity with enterprises, cloud providers and governments 😀

[@stevedowns8601]

Thanks for posting this. I came here to say all this. This is the first thumbs down I’ve given to this channel.

[@danroot84]

@@TheHookUp Do please share what certs you have with us if you wish to use them to prop up your misinformed arguments... Been attending DEFCON for many years now, the best hackers on both sides (whitehat / blackhat) I know laugh at certs fyi.

[@duncan4307]

By definition, a backdoor is always set on purpose.

[@FRD-HDD]

All software have vulnerabilities, it is simply unavoidable. The questions should be: 1- Will the manufacturer issue software updates that address the discovered vulnerabilities until the product retires? 2- has the customer enough controls in place to prevent possible exploits or at least to detect and respond to those if they materialise?

[@uarenothelping3128]

they can't even update cus they are banned lmao

[@pfurrie]

Rob... this seems more like a political position essay. And some information you gave is incorrect/misleading, *and* you didn't provide references for your sources. First is when you gave your definition of "backdoor exploit," saying that it is an accidental software vulnerability. Why "accidental"? Certainly non-accidental backdoors can be crafted into software, so the definition is misleading. Indeed, if the security vulnerability was accidental, it would be more of a security hole than a door, the latter being something intentionally created (not accidental). If you have specific sources for backdoors being accidental, show your work (references). I'll start with the Wikipedia entry on "Backdoor (computing)." [NOTE: I'd provide a link, but as you said in the end of your video, KZbin may automatically delete my comment if links are included, so in case that's true, let's not tempt fate] You do point out that "in my opinion" that these exploits don't appear to be put there on purpose. However, you don't indicate that qualification in your graphic. Furthermore, you say this its a myth for backdoors to be intentionally written into code, but that's just not true, since backdoors obviously *can* be intentionally written. Whether or not they were in the case of these two camera brands isn't the point; you're backing up your stated opinion using flawed logic. This is disingenuous. If there really is sloppy programming (in your opinion), why not just show us how you arrived at that conclusion? Are you disassembling the firmware to analyze the security vulnerability in question? That would be interesting if that's the case, and would be much more compelling. Show, don't tell. Next, you list several "myths." Who is making the claims (myths) that you are then debunking? Were they claimed by someone in our government or someone with a public platform? Or are they a conglomoration of what you feel other people are thinking, so essentially these are strawman positions? Example: "Every camera with a backdoor can be accessed by hackers." Another error is saying that to use a backdoor exploits that the hacker would need to have access to the camera's web interface. Why? There's no reason a backdoor couldn't be installed that uses any of the myriad of other protocols (other than HTTP or HTTPS) in order to connect, or even some custom protocol custom made for this purpose. Maybe you were being specific about these *particular* backdoors (on these particular cameras); if so, you weren't sufficiently clear on that. As such, you give the impression that web access is a universal trait required for any backdoor exploit, which isn't the case and would be better that idea isn't spread. It would be like saying someone can't get something from the store if they don't own a car, but not acknowledging that there are many ways around that limitation (walking, taking a bike, calling Uber, having something delivered, etc). You *are* correct that the camera has to have access outside its own network in order for the vulnerability to manifest itself. So if it is a myth that the NDAA applies to private citizens and companies (you say it does not), then what's the point of the video? You seem concerned about this legislation. Moving on, you go on about how these cameras aren't part of the "communications supply chain" (as outlined in the NDAA), without even defining what "communications supply chain" is. If you know, tell us, and why the cameras aren't part of it. If you don't know what it is, how can you determine if the cameras aren't or can't be involved? And you point out that the cameras don't have wireless radios and therefore don't fall under the FCC's jurisdiction. But you don't describe what the FCC's jurisdiction is. For clarification, here is their mandate: "The Federal Communications Commission regulates interstate and international communications by radio, television, wire, satellite and cable in all 50 states, the District of Columbia and U.S. territories." (taken from the FCC's "What We Do" webpage). The FCC isn't limited to wireless communication, so hard to see your point on how they don't have jurisdiction. It would seem they do. At 5:46 in, you suggest this results in "kickbacks to lawmakers." I don't know if this is true... or not. You probably don't know either. If you do, share that important info with us as well, but if not, it falls into the realm of conspiracy thinking and isn't worthy for your channel. You do make a good point that any device can have security vulnerabilities and how devices are connected impacts how much of a threat they pose. It goes on to say security cameras shouldn't be connected to the network, or if they are, they should be blocked from the Internet using a firewall and then accessed remotely over a VPN. But then you go on to compare (rather than contrast) other unrelated security breaches by Ubiquiti and Axis. After your string of unsupported and loosely-sourced claims, you passively-agressivly finish by positing a government cover-up based on the previous erroneous claims. Given how prone a large chunk of our population is to misinformation, this seems out-of-character for a data-driven KZbin channel. Making analysis based on false logic leads to bad results.

[@TheHookUp]

Backdoor: "A backdoor refers to any method by which authorized and unauthorized users are able to get around normal security measures and gain high level user access (aka root access) on a computer system, network, or software application." Exploit: "Exploits are accidental software vulnerabilities used to gain access to your computer and, potentially, deploy some sort of malware" A backdoor could be intentional or not, but specifically a backdoor exploit implies accidental access. I don't think this semantic distinction is particularly important other than the fact that the term elicits negative imagery that I suspect influenced lawmakers. The myth of the NDAA applying to private citizens was mentioned because while the NDAA does ban Hik/Dahua it doesn't apply to private citizens, but the SEA will apply to everyone inside the US because it would be unlawful to operate a device that is banned by the FCC (if that ends up happening). The Axis and Ubiquiti security breaches were absolutely not "unrelated". Both of them use cloud based access for their camera systems, both of which were potentially compromised. In the case of Ubiquiti it was an internal bad actor while Axis breach was a full scale intrusion. Operating cameras locally and blocking outside reduces attack surface significantly and should be a precaution taken in any application where security and privacy are important.

[@pfurrie]

@@TheHookUp Your final sentence sums it up well, and I concur. Still, would be beneficial to your story to provide sources and links to backup the claims. Like so many classroom instructors say: "Show your work."

[@PeterShipley1]

was it back door is a hard-coded password in the firmware, it didn't get there by accident. As for acquiring network access to the camera, almost all camera companies encourage connecting cameras to the internet advertising remote access features

[@jennifertiffany363]

My husband (an electrician) has a work connection who used to install security systems professionally. He recommended Dahua to us. Should we consider another brand now?

[@TheHookUp]

Dahua makes good affordable cameras. If you are setting them up using an NVR you should consider keeping that NVR off the internet either by not plugging in the LAN cable at all, or by using some kind of a firewall. In fact, I would suggest doing that regardless of the brand of cameras that you buy.

[@daiwafrog]

Funny of those people in comment thought they are so important that China will waste their time spying on them...while the other hand happily using youtube, google, twitter under 5 eyes "govern"🤣

[@tvathome562]

They going to ban wyze as well? If I'm not mistaken it took 3 years for a serious security flaw to be corrected.

[@htnowpro]

Great points made. Thank you.

[@joelluth6384]

What a relief to know I don't have to worry abut backdoors on my devices, as long as those backdoors were unintentionally set

[@TheHookUp]

The point is it doesn't matter if it was intentional or not, good cybersecurity practices negate any issues, and just buying a different brand of camera does not relieve you of your duty to adhere to cybersecurity best practices.

[@dcentral]

For one, U.S. law makers do consult outside subject matter expertise and security experts within federal government before passing these sweeping laws. Both private sector and government experts showed how it is technically possible for Chinese intelligence agencies who have deep penetrations in the U.S. to use these cameras with what you call “accidental backdoors.” There is no such thing as private sector in China. All tech companies are required by law to submit access to China’s authoritarian regime. Why rely on security technology monopoly from a country like China? I rather pay more for equipment produced domestically or from none adversary states. Europe is learning the hard how unreliable it was to trust business relationships with Russia. U.S. gov shouldn’t wait till the day comes where China says no security cam imports into the U.S.

[@ItsMeGiga]

I think one topic that's a bit lightly touched on is firewalling the cameras. I love the nvr solution but if you're utilizing a poe switch that's a bit harder. One thing to look at isn't just access inbound to the camera (from the internet to the camera) but outbound as well. I noticed that my reolink cameras were reaching out to an aws ip address in China. So block outbound connections assuming you aren't using a company's cloud service

[@doric_historic]

It is called "Closed Circuit Television" for a very specific reason...

[@TheHookUp]

Technically these are IPTV, not CCTV.

[@doric_historic]

Hence stick to CCTV to avoid such legislation right.

[@SwervingLemon]

The NDAA is passed every year. It's part of the authorization for the military budget and it frequently has riders that make little sense. The first NDAA that Obama signed actually had an amendment that more or less suspended habeus corpus when the case involved national security. Petitioning government entities to learn how to properly utilize an air gap is probably the right answer, but probably also a fool's errand.

[@TheHookUp]

Absolutely. 2018 NDAA is the one that specifically mentions Dahua and Hikvision though.

[@AntonioCunningham]

I was going to post the same thing. I'm glad I read comments first.

[@johnward6516]

Thanks for clearing up the differences between the acts, however, I think you might have only lightly covered the cybersecurity aspects from certain angles and one that you missed what east-west attacks, this is becoming more common these days and even if you lock the cameras down fully internally if they do try these types of attacks you are still fully open (unless they are fully segmented off). I personally do not like cameras etc coming out of China these days due to the rules that any data stored on the provider's cloud sites by law can be requested by the Chinese government, in no one I'm I saying they are doing this but to have the power is enough to turn me off their cloud storage options. I 100% agree it isn't just these 2 brands and can happen to any network-connected device

[@Zeric1]

I think you may have missed what he said on cybersecurity as it relates to tcp/ip video: security cameras should not have direct internet access. In that situation, security camera data can't be stored on cloud sites, as they are simply not reachable by the camera. Just "shutting off" cloud storage is not sufficient, security cameras should not have open access to the internet, they need to be on a separate LAN segment with strict firewall rules (that is what was said in the video) If one's internal network is breached, regardless of by who, security cameras are only one of many areas to be concerned about, and not the one of greatest concern.

[@naveedkanji1]

Question: Blue Iris allows access to camera recordings through mobile app. Isn't that a security issue as well? Also, would love it if you made a video on how to access Blue Iris from mobile using their app. I am having a hell of a time with it.

[@ML_1515]

He recommends a vpn to access.

[@johnhaller5851]

The real question is if this ban came into effect because the US does that for equipment sold from the US. Look up Greek Cellphone Caper to see how state actors can infiltrate networks.

[@AdrianGon]

If you're allowing internet devices running unknown code to use the internet, you're doing it wrong and deserve what you get. None of my cameras are allowed internet access. They even have additional features to not use passwords for communication. I mean come on.

[@NAVYABHAN]

I went to College in the late 70’s. I majored in Computer Programming. Whenever we wrote any program, we were always taught to write in a Back Door to each program in order to make any changes whatsoever! It makes me laugh every time I hear someone say, “Oh, someone hacked into the program and made it rob some Bank, or steal someone’s identity🐂!

[@TheHookUp]

Backdoors are a development strategy and safeguard during the development process. Not removing them is an issue.

[@cvalerio3865]

How long have you worked for China?

[@TheHookUp]

This isn’t meant to be a pro china video, more of anti misinformation video.

[@michaelstarks7029]

Do you still beat your wife?

[@Budnbuf]

Excellent. Good to hear all your thoughts in this video.

[@K0gashuk0]

No it isnt. I have multiple HIKvision cameras that have issues. When you remove them from your normal LAN and put them on a VLAN with outside internet access it fixes the problem. Most recently I purchased a second HIKvision mini dome and installed it on my mailbox. I got it working and went on vacation. The mini POE switch does not work with VLANs and since I use a mesh AP on the mailbox to boost signal to my front yard those two cameras stay on the main LAN and require to get manually blocked from internet access. I forgot this right after I installed the second one. Suddenly, I lost connection with it on my NVR and when I typed it my home IP address it went to the camera's log in page. IE it bypassed the firewall to allow someone else to log in and do it on port 80 on my home IP. The password I set no longer worked nor the default. I remembered that a couple of years ago when I installed the other I had a similar issue but not it exposing the login screen from my WAN IP. I also remember multiple log file issues that showed suspicious activity on the device. I never had those issues on the airgaped VLAN. Anyone that uses UBNT equipment knows that it does not just let people log into your stuff from port 80 on the WAN side. So in short yes it was probably sloppy programming. This is probably sloppy programming that the chinese government would take advantage of. If you have good security practices this shouldnt be an issue. At the end of the day do I care of some hacker in China looks at cars going up and down my street? My concern is that it could be used as a sort of proxy to access the rest of my network. So good security choices are a good idea. That being said I think it is perfectly within the rights of the US government to ban the use of these cameras on US military bases or in sensitive areas. When I say sensitive areas I mean a military base or congressmen's office and not a park or city street like NY tried to ban CCW permit holders from.

[@TheHookUp]

You should turn off uPnP on your router, it's the only possible way for what you have described to happen.

[@nickr753]

Your coverage really should have included that a backdoor, by definition, is an intentionally-placed security vulnerability, whether placed by the manufacturer or by a bad actor after compromising the device via a different vulnerability. A vulnerability that allows remote access, but wasn't placed there intentionally by anyone, is just a remote access vulnerability -- not a backdoor.

[@Barry_McKockiner]

The Ubiquiti “hack” was essentially fake though, it was an extortion scheme by an ex-employee

[@FrankGraffagnino]

seems like the same vulnerability to me... if people are trusting data to a cloud service and it is breached (either by an ex employee or an outside hacker) the effect is the same... meaning we shouldn't be putting our services in the cloud in the first place. so perhaps "hack" isn't the right word, but the effect is the same.

[@mdjrsvbc14boys]

@@FrankGraffagnino The “hack” was by an actual employee. And wouldn’t have made a difference if it was in the cloud or in their own physical data center. Essentially he downloaded the data and was assigned to investigate the breach. The fact that they used the cloud had no bearing on the type of attack he used.

[@FrankGraffagnino]

@@mdjrsvbc14boys it matters if you hadn't given Ubiquiti any data in the first place!!! That is the cloud.

[@rogerjones9984]

@@FrankGraffagnino "meaning we shouldn't be putting our services in the cloud "- Come on get real! Modern commerce (and society) would grind to a halt without cloud services. The emphasis (as always) should be on better security, not a knee-jerk "The Cloud is evil don't use it" reaction

[@FrankGraffagnino]

@@rogerjones9984 for ubiquiti? There is no reason the logins for your network equipment or your network data to be in the cloud. This isn't a photo sharing service! This is a company thatbsells networking equipment!

[@OldManBadly]

If you operate a camera system, you should always have it air gapped. You should only be able to view video in the designated space where the NVR and other pieces are, or in security offices on dedicated computers attached only to your air gapped network. Cameras cannot "call home" without an internet connection!

[@anonymoususer13666]

Wait I only just now noticed that you're using a greenscreen. Seriously impressive editing job

[@LiAm-nf2ky]

This is a far more serious and complex issue than this video tries to make out. Take it with a grain of 🧂.

[@Zeric1]

Easy to say without any discussion. The overall topic of cybersecurity is complex, protecting cameras is fairly straight forward: don't allow security cameras to connect to the internet. It is a trade off of complexity/high security with easy of use. Each person or organization needs to decide what is right for them.

[@ericesev]

100% agree that the government should be using security best practices, and that other manufacturers' cameras are not free from defects either. I think the context matters a lot here. This isn't a mom & pop hardware store or an individual's home. This is the US Government. Whether or not the camera is accessible to the internet is largely irrelevant. I think it is safe to assume that a nation state actor is motivated enough and can get access to the same network as these cameras. They can phish a user who has access, they can pivot from a vulnerable externally accessible system, they can pay someone for access, they can splice into the network cable of a camera at the perimeter or running between sites, they can use the default Wifi as a bridge into the wired network, etc. At that point, we really need the cameras to be secure on their own. Defense in depth is important here. We don't want an outside actor to be able to access the video feeds, disable the camera, provide fake feeds from the camera, or use the camera for furthering access into the network. Supply chain attacks are also a very real threat here too. Regardless of whether or not the backdoor was intentional, the manufacturer's country of origin is important here. Again, the context, that this is to protect the US Government, is important to consider.

[@andrievbastichy8551]

i love this youtuber.. "naaah the govt wouldnt ...." lololol

[@keepingup2952]

There is no way to know what installing an app on your phone can compromise, let alone connecting a cheap camera to your wireless router.

[@TheDiverJim]

As a certified cyber professional in the defense industry, you are far to gracious and naive about how these “bugs”. As for the incompetence of the administration’s exec order solely on the fcc, it you expect effectiveness from this administration, you will only see smoke and mirrors.

[@rodf1021]

Good video and thanks for putting it together. One note, definition of backdoor is incorrect. It is not necessarily accidental. It could be purposeful and still be a backdoor.

[@honumoorea873]

America is going the wrong way on so many things.... there is an urgence for a better education.

[@JesseG2573]

Good video Rob... These cameras outperform most, that is why the government was using them. I'd like to add to this mix. The often-overlooked router information. Change that admin password and learn your router.!!! Any company can be listening/watching, stealing all your info, it's up to each person to minimize the vulnerability.

[@DrMathOfficial]

What do you mean by Learn your router? Please explain and further elaborate on your comment...

[@JesseG2573]

@@DrMathOfficial most people think a router is plug and play. There are a bunch of settings that can help keep an outsider off your network. Other settings like 2.4 and 5 GHz channel selection, VPN and so on.

[@SaXxLarkin]

It wasn't that they outperform it's because they cost a fraction of what the rest of the market is charging for the feature set. That in itself is a red flag.

[@JesseG2573]

@@SaXxLarkin IMHO, every piece of electronics that is connected to the internet is subject to snooping. it's up to the end-user to take measures and try to prevent it.

[@elrvengador]

I've been trying to avoid Chinese electronics for the past year. Any suggestions for 4k surveillance designed in the US or EU???

[@andrewcbartlett]

Arlo

[@uarenothelping3128]

Lmao why do you think they would be more secure? What has led believe made in US or EU is more secure?

[@empiretech-andy9543]

Buy AXIS , expensive, and hard to use, sure your ideal safe...

[@EbuzzNYC]

NightOwl markets itself as US designed and abiding by the laws, I'd like to know how much of that is true, that would mean that they still manufacture their stuff in China but might used some vital parts from other sources.

[@Darlemonte]

Dude, backdoor exploits, NO matter how "accidental" they seem have been utilized historically (not always) by their own creators for whatever gain in wealth they could plan for. Your first "myth"... Seems kind of forced. You being a tech dude should know full damn well that not all companies have their customers best interests at heart. Also if you can log into a web based account to view a camera as a user, I'm damn sure it's quite simple for a hacker to get into it. They've been viewing people's webcams for decades. By they I mean anyone with the knowhow and interest or reason to. If SECURITY is the main interest here? ANY kind of exploit is worthy of caution. I do not know you or your channel well so my first impression not even two minutes in is "this guy is bought".

[@TheHookUp]

You are conflating Dahua and Hikvision with the Chinese government. Even if the backdoors were intentionally placed by Dahua/Hik, the Chinese government using them would not constitute "their own creators using them to gain wealth". Furthermore, the point of the video is that choice of brands does not equate to cyber security. There are very simple ways to negate any backdoor/exploit issues that should be followed by any company that is interested in privacy, and just choosing a brand from a different country will not increase security.

[@torymblue2000]

I have all Hikvision cams. They have to actually get to it first., good luck!!

[@ErikThiart]

What alternative is their? I mean Hikvision is as good as it gets, the closest competition is probably Uniview

[@TheHookUp]

The highest performing cameras I've ever tested were made by Axis. However, they are extremely expensive compared to Hikvision and Dahua cameras.

[@Robert-ug5hx]

Back door access is not an accident, out clawing Chinese tech is a good idea

[@mikeh4327]

ok let's make a few things straight. the backdoor is on the chipset level. and yes, this is a threat because you cannot block it unless it's not connected to the internet. it's just like using P2P, but on a much more exposed way to the attacker. this threat is real, i am in the industry and i know first hand what i'm talking about. it's very wrong by you to spread wrong information to your listeners before you understand the entire picture. P2P doesn't need access to nothing, not your IP, not the GUI. it simply registers the moment it's online. i strongly recommend for you to retract this wrong information on this video because it's just not fair for the people that relay on your advice.

[@TheHookUp]

P2P servers have IP addresses too, and most rely on DNS. If you block a camera from the internet it cannot contact a P2P server. If you have evidence otherwise I'd love to see it.

[@mikeh4327]

@@TheHookUp you really have no idea what you are talking about, do you? I really hope your viewer can see through this and understand how misinformed this video is, and you to realize how dangerous it is to put videos you know nothing about. Not meaning to put you down, but rather look out for fellow users and put creators in place. Of course when a device is not connected to the internet it cannot be accessed... what kind of comment is that?! but what happened when you DO connected? it's not a simple fix or nothing to be worried about like you mentioned... the vulnerability is on a chipset level... and yes these companies are closely associated with the Chinese government and this vulnerability was there to be tempered with when needed and cannot be simply blocked by a fix from the manufacture - it was there for a reason all this time! the problems is the intention that these companies have, and also that it cannot be simply blocked - you will need to run some serious rules on an advanced firewall to (hopefully) effectively block it. but then which app you're going to use to view it? their app? so here we go again with tracing and scripts and cookies....

[@TheHookUp]

Sorry Mike, you appear to be the one with no clue. I didn't say that your cameras wouldn't be connected, I said they would be blocked. As I explicitly said in this video, the safest way to access cameras remotely is to block 100% of their outgoing traffic with firewall rules and then connect back using a VPN. Here's a step by step for creating a secure network with VLANs and firewall rules: kzbin.info/www/bejne/rKuWpml7aKurn5o

[@Zeric1]

Cameras should not be on the internet, the video states this more than once. 5:25 - "security cameras can and should be blocked from any outside communication." and 6:45- "no ip camera should have access to the internet. Period." Follow that advice and it doesn't matter about any intentional backdoors or unintentional exploits. You stated "... it simply registers the moment it's online" and that is the very issue, the camera shouldn't ever be online in the first place. None of my cameras have internet access, but I can still watch them remotely.

[@mikeh4327]

@@Zeric1 how does that even makes sense?!? cameras SHOULD be accessible to me when i need them! if there is a breakage or an activity, the first line of defense is that i get a notification from my DVR or camera. second the immediately back up to FTP (because whoever does something and know what he's doing, will break the DVR first). if my system is not online then it's as good as nothing! all i will have to come back to (when something happens), based on your advice, is a broken place and MAYBE a video of how it happened. and we all know these videos are not much help after the fact. what he mentioned about the cameras to be online, fine i can agree with that, but that's so obvious it's like saying don't try to breath water, come on! these systems are taking advantage of the common user! and that's why they are banned and dangerous. a security company needs to PROTECT ME, not that i need to find creative ways to protect myself from the people i count on protecting me. they are good companies out there that do just that - protect their clients! and these two companies do not have that in mind and it took a bunch of good white collars to bring it up and protect us. if you have nothing wise to say just be quiet! and you Mr. Hook Up, you owe your viewers an apology and retract your horrible advices!!

[@vista9434]

I personally will avoid Hikvision and Dahua cameras for ethical reasons. Both companies have active contracts in Xinjang to opress the local Uyghur population which has been labled a geocide by many governments. Cameras should (regardless of vendor) always be isolated from the rest of the network, either via VLANs or airgapping them but unfortunately these measures aren't always used.

[@Frem_Kra]

Welll so maybe finally GTFO from Europe from "ethical " reasons too. Keep your pying Software away.

[@BryceLovesTech]

We have HIK Vision cameras and the software is horrendously buggy

[@MetalheadAndNerd]

Sorry, but you can't just redefine the word backdoor. A vulnerability that allows access without credentials is not automatically called a backdoor! The term backdoor is only used if it is intentional or seems intentional.

[@TheHookUp]

Based on the research I have done I believe the semantics are as follows: 1. a "backdoor" is any vulnerability that allows an unauthorized user to gain high level access without credentials. 2. an "exploit" involves an unintentional use of a designed feature. A "backdoor exploit" would be an unintentional vulnerability that allows for an unauthorized user to gain high level access without credentials.

[@a9s2w5]

I've worked with pretty much every product that's came out in the past 30-40 years? Hikvision/Dahua has decimated competition in this market because other companies couldn't compete with the cheap/free money that was being given to these companies from China. Hikvision was quite literally founded from subsidiaries of the Chinese government and have the controlling interest. CETHIK, the China Electronics Technology HIK Group was explicitly created by the PRC government to run "HIK"vision.

[@djoj1986]

I have 2 hikvision and 2 armcrest and 2 loyrita cameras with a hikvision nvr. I have blocked internet access to all cameras except the nvr.

[@EM-ks5my]

Everyone knows if someone calls himself a cyber security expert...means shit. The only real IT security people I would hear are the PENTESTERS, and my old boss literally said Chinese, Russian, and others leave backdoors and holes on PURPOSE. This KZbinr getting those Chinese checks.

[@TheHookUp]

I don't remember calling myself a cyber security expert, but my knowledge is significantly above average and I do hold certifications in cybersecurity and computer science.

[@ciapsiagency3260]

In regards to the "BACKDOOR" he is not wrong and neither are you... BACKDOOR definition uses words like "typically and Most often" why? because backdoors are created everyday by software engineers without knowing it.

[@KayAndrews-hf4hm]

back doors are not accidental you’re just trying to save your reputation and career after this brand was exposed. Find something else to do with your life.

[@harkerhien]

My school uses Hikvision and Ubiquiti lol

[@goodman854]

I have to some what side (somewhat) with the government of America here, a company with DIRECT ties as a state owned company for China is at best a bit of a security risk, at least on a governmental aspect. For personal and Commercial use I think people should do as they please. We as a society tend to be too reliant on other countries and others in general. Some level of self sufficiency would be nice to see. But I'm aware there aren't to many good USA brands. Also suggesting that everyone have there NVR not online is pretty outlandish and is something you'd only here from someone in networking IT department. A bit like how if you become a specialist in bacteria studies you become a germaphobe. You know to much about the industry so your actions become almost overly extreme and unrealistic. Realistically that suggestion is out of the realm for most users. The VPN approach is really the only realistic thing you said there imo. You would be hard pressed to find any REAL business, home, etc that doesn't have there NVR on a network as it is fundamental for the device to function as one would want. Granted all my cams are outside, and i'm not worried about them being hacked, I don't live in a big city either. Also VPNs are also not bullet proof nothing is. As for the reason the government did this I'm sure economics played a roll yah, or incompetence. Though I do believe some real justified fear of foreign espionage does exist and is valid to be concerned about. China is far from being a country I'd give a A+ Kindness not evil award too. Yes USA has a lot of corruption as well. Great video though.

[@Arkryal]

I have a question: I'd like to add publically available traffic camera feeds to Lovelace. So I have no access to the physical device or configuration, but do have the raw feed URLs as standard BLOBs via M3U8 playlists. I could code something myself, but that would frankly suck, lol. I'm hoping there's already a solution I've just missed, being new to HA. Any thoughts?

[@spinkey4842]

now i know which cameras i'll buy for the next system..... yes it'll be one of these

[@sardissozo3399]

It is unwise to assume that they are not deliberately participating in such actions. Furthermore, it is unrealistic to expect people to always follow the "best practices". Whenever there is a LAN port available, there will inevitably be individuals who will recklessly use it. It is important to decrease our dependence on China and manufacture goods domestically, even if it results in higher expenses.

[@TheHookUp]

"It is important to decrease our dependence on China and manufacture goods domestically, even if it results in higher expenses." I full agree on that. However, that's not what we're doing. US companies are still doing almost all their manufacturing in China. We will end up with the same product paying more just so we can employ US management and sales teams to sell Chinese products. It's not just the US either, all the big Korean, Japanese, Taiwanese and even German companies outsource the majority of their manufacturing to China.

[@TheHookUp]

Also, it's not fair to expect everyone to follow best practices, but it's certainly okay to hold the government and military to those standards.

[@bradleysanker5625]

The NDAA is not about security cameras. It is the defense spending authorization to identifies how the government spends money budgeted for defense. The only portion that affects cameras is section (889) which restricts the purchase of electronic equipment from companies where the majority owner is the Chinese government. I greatly impacts commerce in that ALL companies must attest that they do not use any known equipment from specific companies in the day to day interaction with government contracts to include just completing transactions for sales. All defense purchases require a statement with each receipt that they do not use these communication methods, including cameras. Otherwise the NDAA is about how we pay the military and equipment and supplies.

[@shloomyshloms]

"accidental" backdoors.

[@jarrodwolf5101]

I had 5 or 6 of these older Hikvision cameras. Hikvision killed all online features years ago. They posted notices of the issue on the online manuals. They are still in use at my old house and work great as CCTV. I bought more of them sense they were discounted and I could never connect the NVR to the net.

[@johnszatkowski6898]

Hello! Look at Wyze and even Ring in that time era! D-Link also had MANY cameras that they no longer updated and became "hackable". I had several D-link cameras and many of them were "attempted" hacks but my router's firewall blocked these! Granted I'm using a less than a 1 1/2year old router with a good firewall built-in with constant updates. Ring and other companies have since "updated" their security protocols since but, WYZE had a vulnerability for over 2 YEARS and never did ANYTHING about it and thus dis-continued the V1 cams! Not VERY happy with this lack of transparency on their part and have been replacing my WYZE cams with other brands as a result! WYZE is turning out to be a "SUCK-ASS" company with cheap "China" products and lack "security" that should be "basic" with any setup!

[@Kevin-ht1ox]

I work in software and even have some security and SSL related patents. These vulnerabilities are sometimes engineered to appear as a bug or negligence -- see the Go to Fail bug as an example. An insecure source code change tracking system only needs to inject a single line of code to completely break SSL in a subtle way. The US govt definitely knows more about this than you do. You should probably take this video down.

[@antoniopatino8839]

I agree with you , but to say take down the video is a little much. He has a good point about protecting your cam and wired vs wifi ,you of all people know os is os rf or not

[@Kevin-ht1ox]

@@antoniopatino8839 the dangerous part of the video is the claim that this is politically motivated nonsense and that we should not trust the government claiming a perceived threat. There are plenty of videos that describe how to secure a network and IoT devices. The problem is that using these devices on a secure network is making an assumption that there isn't another vulnerable device through which access could be gained OR that there isn't actual wireless radios embedded in the hardware destined for sensitive facilities. The only way to properly screen these possibilities is to examine the firmware of all devices AND xray each one. Another thing is that there is a big conflict of interest here.

[@TheHookUp]

RE: "The US govt definitely knows more about this than you do", I'm definitely not saying I know more than everyone in the US government, I'm sure there are thousands of qualified cyber security professionals in the US government, but I question how many of those people were consulted in the writing of this legislation.

[@TheHookUp]

@Kevin curious what you think my conflict of interest is?

[@Kevin-ht1ox]

@@TheHookUp you have a channel that often centers around comparing the quality of the cheapest cameras available and the US government has targeted a ton of these manufacturers as potential threats to national security. Your reaction is to make a video that implies that the perceived threat is some sort of egotistical political stunt for attention and then downplay the risk and the intent behind some of these vulnerabilities. The conflict of interest is that a substantial percentage of the camera market being declared a national security risk will impact your ability to produce content. I don't think it is a conscious conflict of interest but it exists nonetheless. I love your videos btw but I think you should keep in mind that there are technological advances that are first implemented for espionage purposes well before they ever hit the commercial market. We regular people often do not know what we need to protect ourselves from because if the Govt reveals the knowledge of a technology then they are essentially aiding the "enemy". Also, the FCC being involved should be a hugely relevant detail here. These devices only need to receive a signal from somewhere to become hostile. In general, keeping it off your network "should be safe" for regular people but the reality is that we do not know. We live in a world where your fridge can be weaponized and everyone has a neighbor with an insecure wifi access point.

[@timothyn4527]

Your the greatest, lot fun hear, this help alot.. thxs

[@wibblywotsits]

I see lots of people taking umbrage with the definition of 'backdoor'. But that aside... I get what you're saying about "This stuff isn't malicious' ( debatable, but.. okay) and that "people shouldn't hook these things up to the intarwebs) - naïve. MOST people are just buying something to hook up to their garage, or front door or whatever. MOST people want to be able to look their camera while they're away from home / at work, etc.. MOST people will just go to amazon or whatever and pick some cheap (hik) camera that works. And those camera's are uploadin' stuff to the cloud in *order* for them to use whatever app to view them. Be it Blink, Ring, some kind of Hik thing. So, they HAVE to be internet connected. "You shouldn't enable internet, you should put it behind a firewall, you should do [xyz]" - that's fine, for you or I. I have a segmented network, with stuff [here], stuff [there], stuff over on the other side. I don't want things talking to [here] or [there] or [internets]. But we're in a very small minority of people who understand that kind of stuff. And the simple facts are: 1) these devices DO have security holes - intentional or not 2) The companies producing them are beholden to the CCP 3) They CAN be used for malicious monitoring. Wether they *are* or not is immaterial. They CAN. It's not a long stretch then, to skip forward some years and discover that they *are*. Especially when you consider the state of the country which produces them and their treatment of their own citizens and their disposition to the West. Classic example: The drone use by 'amateurs' in Ukraine. In the recent war, it was discovered that a) UKraine drones were being disabled ( they have geolocation yo!) by the Chinese firm who produced them b) Ukraine drone info was then being sent to RU to pinpoint users who were using them for missile targetting. Here's an article from 2016 highlighting that 'China made drones [can] send stuff back to China": www.nytimes.com/2016/04/21/world/asia/dji-drones-china.html Now. this article 5 years ago complaining that drones send info to China, elicited responses like : 'So what? I mean, it's not like they're... [doing anything with it]. You're just being paranoid". But it's EVIDENT that.. when the situation demands, these things CAN be used for nefarious uses, not the least of which ( no source, I cannot be bothered) for cameras is facial recognition of chinese dissidents who reside in western countries for - social targetting. The fact that you're blissfully ignoring the political ( yes, I get that you said "I'm not very political these are the *technical facts*") is naïve. And you would be better served to recommend alternatives that AREN'T Chinese corps.

[@TheHookUp]

I'm interested in your answers to these two questions: 1) Do you think that cameras from other countries are significantly safer and more secure than cameras manufactured by Hikvision/Dahua to the point where you could attach them to your network and expose them to the internet? 2) Do you think that other non-banned Chinese companies are safer and more secure than Dahua/Hikvision (Reolink, Uniview, Raysharp, etc).

[@ep82GTT]

+1 I’d like to see more EU and US alternatives.

[@wibblywotsits]

@@TheHookUp So - that's definitely a consideration. I mean, 'other cameras' - they're not exactly far and wide. I purchased one of those LaView systems a decade ago, and another '360 pan/tilt/nightvision' camera as a 'wildlife' cam. There *are* no alternatives. Not really. That's possibly because they've cornered the market and there isn't a demand for 'Made in USA'. But - there was an example of 'known backdoor in China camera', and there was example of 'known exploit in non-china camera' . I'm certain that happens in ALL things - heck, you can hack someone's 'display fridge' to.. display [stuff] if you're really motivated. The non-china got a firmware update, the china didn't. I think my point is : Your argument is 'Exploits exist in all things' and mine is : Yes, but they're not as likely to be militarised if they're 'agreeable guv'ments'. China will and HAS used these exploits to round up / kill people. Russia can and HAS used them to disable infastructure / kill people. I'm also aware that... y'know? The USA has done same ( Stuxnet and all that). So, 'ignoring politics' and focusing on the tech - when we *know* that the tech companies who're producing the exploits are *also* handing the results of that off to their guv'ment - means you're actually *encouraging* folks to 'ignore that...' - And I don't think that's a worthy encouragement. I'd *much* rather people be aware, and ideally - in the same way we're now looking at 'energy independance' to bring this stuff 'back home' and produce secure, non-exploitable devices. The problem is : Ordinary folks don't have the wherewithall to *know* this. They literally just goto Amazon and buy [thing]. And [Y]OUR guv'ment is attempting to protect you and your country from the malicious use of that thing. If THAT protection is a blanket ban on 'China Cams' then.. I'm not averse to that. *Especially* as it's been demonstrated that they WILL misuse it.

[@Zeric1]

@@wibblywotsits You said "Ordinary folks don't have the wherewithall to know this. They literally just goto Amazon and buy", that is completely true, but they are not the target audience for many of the videos from this channel. That is an issue, many people who are basic consumers and not the target audience watch these videos and don't understand the nuances and details. They gloss over/ignore statements like (5:25) "security cameras can and should be blocked from any outside communication." and (6:45) "no ip camera should have access to the internet. Period." They just plug it in and move on. Perhaps each video needs to clarify who is the target audience for that particular content.

[@petenelson8136]

Explained very well. After 16 years in the military as a Director of Information Management (DOIM) and Chief Information Officer (CIO), our expiation of DAA and how it applies only to government organizations is spot on.

[@danroot84]

So what exactly is your position on this video Pete? Curious to know where you stand. Also, AO has replaced DAA.

[@petenelson8136]

@@danroot84 I disagree with his assumption (1:20) that the back doors didn't appear to be put there on purpose. The relevancy of who put them in and why doesn't negate the security risk they pose. I like what DISA set up with their Authorized Product List (APL). Is is perfect, no, nothing is but at least those products on the APL are vetted for potential security risks. Security cameras are important, but having ones that the government uses vetted are equally important in helping to protect our sensitive assets.

[@Alphasig336]

Extremely bad security is more than common than the vulnerabilities

[@AECFXI]

I think you underestimate the extent of your technical knowledge and overestimate policymaker corruption. You made repeated suggestions policy makers were acting based on economic, not security interest, and yet you didn't offer the slightest thread of evidence about this. Corrupt political action does happen, and we know about it from investigative political reporting that actually ends up being fairly similar to how you knowledgeably described security considerations during this video, by using a strong general knowledge of the subject matter, explaining facts and describing best practices. Meanwhile your suggestions about policymakers acting on economic self-interest ended up just as poorly informed as the policy makers were on security matters. You have a useful, beneficial, even important role to play in this discussion as a security expert, yet this video ended up tainted by you drawing suggestions of corruption out of thin air in an utterly speculative fashion. If you really do think policy makers were acting on self-interest, then give us some of that investigative political reporting. Show us the conflict of interest. Show us they were told by their top cyber security experts that this wasn't an issue, but they made it one anyway. As it is now, the way policy makers attributed firmware errors by these tech companies to malice, you attributed these perceived policy errors by policy makers to malice in a way that is surprisingly similar and almost ironic.

[@TheHookUp]

I actually think policymakers were influenced more by fear and misunderstanding of secure networking concepts than by economic gain, but I think it's possible that the groups responsible for instilling that fear had much to gain. For instance, and I'm not taking sides on this issue, just putting it out there for your research: Hikvision has an active complaint against the website IPVM that alleges a series of unregistered lobbying instances by IPVM employees, and IPVM which focuses on system integrators and professionally installed camera systems arguably has much to gain from the disappearance of more affordably priced cameras. As I said, with Hik and Dahua being #1 and #2 in global market share it's naïve to think that banning them in a country as large and rich as the US will not cause significant shifts in the rankings of other manufacturers.

[@elesjuan]

Come on man. I'd bet you maybe 1% of the politicians who debated, spoke for, and voted this trash into law even know what TCP is. They don't need to, when they've got lobbyists from special interest groups whispering in their ear. 😐

[@DB-fv4yn]

Agree with everything you said, well done; however, I simply do not understand the Internet connectivity issue specifically with cameras. They are no less or more hackable than any other Internet capable device on your network and in fact because they are single use devices the attack surface is even easier to deal with than other types of network devices. With the logic of not allowing IP cameras to access the Internet you should extend that to include your streaming TC devices, Home Assistants, PC, Phones, Laptops ... etc... What am I missing that is unique and specific to cameras

[@computeranalytics5721]

The result of these disputed photos from a restaurant.

[@Gamex996]

I still dont understand just make vlan for ip camera and isolate them from the whole network. and even the nvr should could be accessed through vpn not internet

[@greggould4275]

Fascinating Video!! I guess its a bit like TikTok, in a way - since the move was made that government workers should not have it on government issued phones ect... I have no problem if the camera itself is Chinese made (especially since they are OEM, and if they ARE good), and am more concerned about the company that makes the surveillance NVR - perhaps they work in ways of safeguarding how the NVR handles any potential 'issues' with the cameras themselves by virtue f what's built into the NVR's Operating System? I have really been looking a 'Amcrest' as a solution - do you happen to know if they are an American Company? Just was curious! tThey seem international, and my searches kinda got lost in a blizzard of info so I wasn't quite sure.

[@martyb3783]

Very interesting. As you said, do not allow security cameras access to the internet.

[@leahlambert5737]

I've got hikvision I find them amazing not getting rid of them if the government paid me then I would.

[@darkpagemx]

oh gosh USA GOv paranoia, keep going forward that way!

[@Chrom35kull]

Would remote/Push notifications work if your not connected to the VPN? A lot of people push the security or keeping the cameras segregated from your main LAN (wise) however blocking it from the internet does reduce its features massively. If someone breaks into the property you would want to get a live notification instead of just watching what happened after finding a smashed window.

[@iammorg647]

Generally speaking, push notifications are outbound traffic and firewall rules can be created to allow this.

[@uarenothelping3128]

So basically this is lame government employees CYA? They didn't do do diligence so have to blame others.. Not surprising government behavior

[@charlieodom9107]

I use, almost exclusively, Dahua and Hikvision cameras. I will continue to use them, due to their high quality and price point. The fact that most people don't know the hundred or so brands that are OEM Dahua or Hikvision cameras is mind numbing as well.

[@donniemccrorie19]

I've had camera company reps tell me that although our cameras are oem'd by dahua and hikvision, they use US based servers, so there's no vulnerability...😂

[@charlieodom9107]

@@donniemccrorie19 your comment makes zero sense. Cameras don't use servers. If yours uses some internet server, then it was setup by whatever company controls the camera. It literally has nothing to do with the brand.

[@RtistiqSkubie]

@@charlieodom9107 I think that's what the laughing emoji implied... that whoever told him that didn't know what they were talking about.

[@Gregory-oj7bh]

Very interesting considering I’ve installed nothing but hikvision into government buildings and contractors for the militaries buildings. Rumors have been heard throughout the company I work for about the Chinese having a back door to such cameras, yet we still put them in? Never made sense to me

[@katherinea.8425]

Cause the rumors are complete bullshit.

[@rodneylw10]

Great video and content. I appreciate the words of advice. I also have a VPN but I have never set up anything on it. That would be an interesting video. I am looking at Lorex cameras and Reolink. I want to get an NVR 8 cam system for outside but paused after reading about the ban concerned that their product Lorex might also get banned. What system would you recommend of that type? Thanks.

[@MikeHarris1984]

Ubiquiti one was fake and from the previous employee and NO customer data and access hit, just some source code was taken and UI is now sueing that previous employee for the extortion and damage to brand (cost them billions in stock sell off's)

[@jkkarkar]

This is why I have my cameras on its own VLAN and blackholed from the internet. And just for giggles monitor and log any and all traffic on it. Guess what... they don't reach out to the internet and only speak to the controller, lol. Maybe these politicians should spend their time and our money training on how to use Wireshark. Great information.

[@straight-up-shots]

What router do you use?

[@Zeric1]

Exactly, people, including many of the commenters on here, have no clue what they are talking about or how to implement security measures.

[@dougphillips5686]

Wansview cameras have back doors. They can and do disable your camera after 30 days if you do not signup for the cloud app. I have their cameras at two differenct locations and they disabled cameras in both locations - remotely.

[@TheHookUp]

I'm not sure I'd call that a back door. That is a company offering cloud only access and requiring you to pay a monthly plan, still bad practice but not a back door.

[@eskieguy9355]

On the question of national security, I think it's important to remember, that in a "secure facility" Edward Snowden & others were able burn CDs & copy thumb drives.Something which shouldn't be possible if you want to keep secret records, secret.

[@Narnald_Ewman]

This explains why all the brands internals all look similar.

[@TheHookUp]

Web interfaces are also a dead give away.

[@BAMBOOM2021]

What about the possibility of using satelite once the systems disconnected from the internet?