Scans for Hikvision Intelligent Security API, (Sun, Jul 19th)

Hikvision cameras have a long history of vulnerability and are frequently targeted by internet-wide scans. This weekend, researchers at the SANS Internet Storm Center observed a new type of reconnaissance scans targeting the OPEN Intelligent Security API (ISAPI), a REST-based API introduced by Hikvision. The ISAPI provides access to a wide range of camera features beyond AI/facial recognition, enabling remote control of camera settings and integration with third-party products. The API has been available since at least 2018 and is well-documented by Hikvision. Researchers noticed scans for the endpoint /ISAPI/System/status, which returns XML (or JSON) formatted system information, likely used to determine ISAPI device support and potentially for password brute-forcing. ISAPI requests are authenticated using Basic or Digest authentication, and the cameras support HTTPS, though encryption is weak if Basic authentication is used and the password is sent in the clear. Messages can be encrypted with AES 128 or 256 in CBC mode, but the encryption key is derived from the password, and the initialization vector (IV) is exposed in the URL. Currently, honeypots have not captured full requests, but researchers will update this diary if complete requests with authentication data are found. The SANS Internet Storm Center recommends not exposing these cameras to the internet and avoiding their placement in sensitive areas.