Mirai Botnet Update: Dahua Role Diminished In August Attack

In August, a Distributed Denial of Service (DDoS) attack occurred due to a massive botnet created by malware named Mirai. This attack was caused by vulnerabilities in a large number of IoT devices, such as security cameras and DVRs using default credentials. Dahua’s products were initially named as the victims of the hacking and the source of these DDOS attacks in reports by research firm Level 3 Communications, the Wall Street Journal, and industry trade publications.

A subsequent report by cybersecurity research firm Flashpoint was issued on October 7, confirming that the Mirai DDoS attacks originated primarily from devices manufactured by another video surveillance vendor, and not Dahua. The Flashpoint report prompted a series of headlines that downgraded Dahua devices’ involvement in causing the attacks, by Forbes.com, Network Security News, and SecurityWeek.  

Acknowledging Vulnerabilities

Here is a statement issued by Dahua: “We acknowledge the vulnerabilities that some of our pre-2015 cameras and DVRs have used default usernames and passwords. This may have caused exposure to risks when the devices are exposed to the Internet without firewall protection. Dahua has taken steps to resolve this vulnerability and offer solutions. Keeping our customers informed of any threats or potential risks is a priority."

To address any potential issues, Dahua has firmware updates available on the Dahua Wiki, and a dedicated channel for customers to ask questions about cybersecurity or report suspected vulnerabilities (cybersecurity@global.dahuatech.com).

Cybersecurity Best Practices

The company’s statement continues: “We continue to remind our customers that it is crucial to select strong passwords, keep firmware updated, and only forward ports their devices actually need. We strongly recommend that our customers and partners review our list of cybersecurity best practices on our website”

Specific to this issue, Dahua is offering replacement discounts as a gesture of goodwill to customers who wish to replace pre-January 2015 models. End users can bring such products to an authorized Dahua dealer, where a technical evaluation will be performed to determine eligibility, according to the company.

“Above all, securing our customers' assets and protecting their Dahua products is of the utmost importance to us,” the company states. “We continue our commitment to work with our customers and partners to make our products and solutions as secure as possible.”