The Record reported that Ukraine's cyber emergency team, CERT-UA, warned late last week of break-ins at Dahua cameras and video recorders. CERT-UA said hackers changed settings and made unauthorized accounts. It said they appear to use Easy4IP, a feature that lets owners reach cameras through Dahua's cloud. The cloud finds each camera by serial number, even behind a firewall. CERT-UA said the numbers follow patterns, so hackers can guess many. They can then try weak or default passwords, or flaws in old firmware such as CVE-2021-33044 and CVE-2021-33045.
CERT-UA did not say how many devices were hit, when, or by whom. Whether any belong to Ukrainian government or military bodies is unclear. Hunt.io reported in August that hackers took over more than 14,500 Dahua devices earlier in the summer. It says its findings closely match these methods, but it has no evidence linking them to these attacks. It also said a rogue account can outlast a password change and, on most firmware versions, a factory reset. Deleting accounts is not enough without a firmware update.
A vendor's cloud shortcut can sidestep a firewall, and a serial number works like a guessable address. Buyers can ask: is Easy4IP on across our cameras, who owns firmware updates, and what does our contract say about vendor cloud relays?