Hikvision and Dahua Surveillance Cameras: Global Locations Report

We identified 6.3 million IP surveillance camera networks outside China that use hardware from controversial Chinese firms Hikvision and Dahua, with significantly more in Vietnam and the U.S. than anywhere else.
Photo of Hikvision IP camera in China to illustrate report around cybersecurity and privacy risks of this surveillance technology

First published Dec 3, 2020 Last updated with the latest, most comprehensive data available to date for Hikvision and Dahua surveillance IP camera networks.

  • 6.3 million Hikvision and Dahua surveillance IP camera networks detected outside China worldwide
    • Hikvision: 4.8 million networks
    • Dahua: 1.5 million networks
  • 191 countries outside China where Hikvision or Dahua IP camera networks are present
  • 148 countries have more than 100 such IP camera networks
  • Vietnam and the U.S. account for 25% of all such Hikvision and Dahua IP camera networks detected outside China. Each has more than double the number found in Mexico, the UK and Brazil, the countries with the next highest total networks.
  • Ho Chi Minh City – city with most Hikvision and Dahua networks detected, followed by Hanoi, Bangkok, London and Montevideo.

Pervasive Chinese Surveillance Tech

Chinese firms Hikvision and Dahua have enjoyed stratospheric growth to become the biggest video surveillance technology firms in the world.[1]

Yet there are serious questions around the companies’ cybersecurity track records, as well as the data privacy risks arising from their ownership by the Chinese government. Hikvision and Dahua have also received international condemnation for the central role their IP camera networks play in the repression of the Uyghur people.

The goal of this research was to map out exactly where this Chinese surveillance technology was most used outside of its native country. We hope that our findings will raise public awareness of both the pervasiveness of these IP camera networks and the privacy and cybersecurity risks associated with this technology.

What is an IP camera network?

Each IP camera in the network functions as an independent device with its own unique Internet Protocol (IP) address, enabling it to transmit and receive data over a network, typically a Local Area Network (LAN) or the Internet.

The networked nature of IP cameras allows them to be accessed remotely from various devices such as computers, smartphones, or tablets.

The system may include a Network Video Recorder (NVR) or use cloud-based storage for archiving video footage.

This investigation is the first to comprehensively map Hikvision and Dahua camera networks active outside China.

In doing so, we identified the countries and cities most surveilled by these controversial firms’ technology.

Despite facing a variety of trade restrictions in the U.S.,[2] this investigation shows that efforts to decouple the American and Chinese tech sectors have had limited success. In fact, more than one in ten camera networks identified in this report are in the U.S.

Note that this report identifies networks of cameras, each on a single IP address, rather than individual cameras. As networks tend to comprise multiple devices, the total number of individual Hikvision and Dahua surveillance cameras covered by this report will likely be many times higher than six million.

Top Countries

The following table shows the 20 countries outside of China where we detected the most Dahua and Hikvision surveillance camera networks in 2021.

The values in each column are derived from the number of unique IP addresses associated with hardware manufactured by each company, as each IP address is able to host a network of one or more surveillance cameras and related equipment.

For the full findings by country see the Hikvision and Dahua Surveillance Camera Networks Data Sheet.

Top Cities

The following table shows the 20 cities globally outside of China where we detected the most Dahua and Hikvision surveillance camera networks in 2021.

The values in each column are derived from the number of unique IP addresses associated with hardware manufactured by each company, as each IP address is able to host a network of one or more surveillance cameras and related equipment.

To see data for the top 1,000 cities, refer to the Hikvision and Dahua Surveillance Camera Networks Data Sheet.

Highlights

By Country

  • The U.S. has more than 11% of all Hikvision and Dahua camera networks outside China, second only to Vietnam (13%). It has more than double the networks of Mexico, the country with the most networks after the U.S.
  • Exports of this technology are highly concentrated. Over half of all the networks detected were in just 9 countries.
  • In Europe the UK is home to 15% of all Dahua and Hikvision networks in the region. Romania has the next highest number of networks despite only being the 9th most populous country in the region.
  • In South America, Brazil has over twice as many (108%) as networks as Argentina, the country from the region with the next highest total networks.

By City

  • Ho Chi Minh City, has more than two-and-a-half times as many (154%) Hikvision and Dahua networks as Bangkok, Thailand, the city with the next highest number of networks in the world outside of Vietnam.
  • NYC has well over twice as many (142%) camera networks than Los Angeles and almost three times as many (185%) as Houston, TX, the US cities with the next highest number of such networks.
  • In Europe, London has the most networks using the two companies’ hardware, with 42% more networks than Bucharest, Romania and 54% more than Paris, France, the two cities next most surveilled by Hikvision and Dahua devices.
  • Montevideo in Uruguay accounts for a greatly outsized proportion of such networks in South America. It is the city with the sixth-highest number of camera networks, despite Uruguay having fewer networks overall than Brazil and Argentina. It has two-thirds the number of networks as found in Brazil’s São Paulo.
  • Mumbai has only the 17th biggest city network of Hikvision and Dahua cameras outside of China despite India having the seventh biggest network globally.

By Brand

  • Spain has the third highest number of Dahua networks, while Taiwan has the sixth highest number.
  • Madrid, Spain and Paris, in France, have almost as many Dahua networks as Ho Chi Minh City, home to the greatest concentration of Dahua camera networks in the world outside China.
  • Santiago has more than twice as many Dahua camera networks than it does Hikvision, bucking the global trend for preferring Hikvision.

IP Camera Privacy Risks & Cyber Attack Vectors

IP cameras, integral to modern surveillance systems, operate by transmitting and receiving data over internet and network protocols. While offering advanced features and remote accessibility, they also introduce potential vulnerabilities and privacy concerns.

IP Camera Protocols and Standards

IP cameras utilize standard network protocols such as TCP/IP, UDP, and HTTP/HTTPS for data transmission. They support IPv4/IPv6 and can be integrated into local area networks (LAN) and wide area networks (WAN). Video streaming employs protocols like Real Time Streaming Protocol (RTSP) and Real Time Messaging Protocol (RTMP). IP cameras use H.264 or H.265 compression to reduce bandwidth and storage requirements.

Data Privacy and Integrity

Data Encryption: To safeguard data privacy, IP cameras offer features like SSL/TLS encryption for data in transit. Video data transmitted over the network is vulnerable to interception if not properly secured. Cyber attackers may intercept video streams to eavesdrop on private conversations, gather sensitive information, or even launch further attacks on the network.

Access Control One of the most significant cyber attack vectors associated with IP camera systems is unauthorized access. Weak or default login credentials, unpatched firmware, or misconfigured access control settings can allow cybercriminals to gain access to cameras. Once inside, they can view, record, or manipulate video feeds, compromising security and privacy.

Privacy Laws Compliance: Organizations using IP camera networks must navigate privacy regulations, such as GDPR in Europe, which impose strict requirements for data protection and consent.

Cyber Attack Vectors

Firmware Vulnerabilities: IP cameras are susceptible to malware infections and exploits if not kept up-to-date with security patches. Malicious software can compromise camera functionality, disrupt operations, or provide an entry point for attackers into the broader network.

Network Sniffing and Interception: Unencrypted data can be intercepted. Ensuring end-to-end encryption is vital to prevent data exposure.

Denial of Service (DoS) Attacks: Attackers can launch DoS attacks against IP cameras or the entire surveillance system, overwhelming the network or devices with excessive traffic and rendering them inoperable. This can be used as a diversion tactic for physical intrusions or other malicious activities.

Third-party Vulnerabilities: Integration with third-party systems or cloud services can introduce additional cyber risks. Weaknesses in third-party software or services may provide an entry point for attackers to compromise the IP camera network.

IoT Botnets: IP cameras can be hijacked to become part of IoT botnets, used for large-scale network attacks. This highlights the need for robust network security practices.

Backdoor Exploits Potential backdoors in firmware or software pose significant risks. This is of particular concern with Hikvision and Dahua IP camera networks due to the companies’ ties with the Chinese government.

Poor Cybersecurity Track Record

Hikvision and Dahua have faced accusations that their technology poses a risk to citizens’ cybersecurity and digital privacy.

Dahua has been described as “terrible at cybersecurity”,[3] and Hikvision has been subject to similar criticism.[4]

A critical vulnerability affecting Hikvision cameras was discovered by a security researcher in September 2021, who found dozens of models of Hikvision devices could be hijacked remotely without requiring log-in credentials.[5]

While this vulnerability was patched by Hikvision, tens of thousands of networks across 100 countries had still not applied the update more than a year later.[6]

As a result, a Mirai-based botnet called Moobot spread aggressively by exploiting this vulnerability in the webserver of many Hikvision products.[7]

A month later, two similar authentication bypass vulnerabilities were disclosed that affected an extensive list of Dahua products. A further vulnerability was discovered in 2022 that allowed attackers to hijack Dahua cameras and take full control over the devices.[8][9]

Another critical vulnerability, disclosed in September 2022, allowed hackers to remotely access Hikvision devices and steal admin credentials. This affected over 400,000 Hikvision cameras, many of which were older devices with no fix made available.[10]

These cybersecurity concerns have been exacerbated by the companies’ links to the Chinese state.

Hikvision, or Hangzhou Hikvision Digital Technology Co., Ltd. as it is formally known, is 42% owned by Chinese state investors, while Dahua Technology Company is 2.4% owned by such investors.

More broadly, the degree of autonomy provided private companies in China has repeatedly been called into question.

In 2018, a US-China Economic and Security Review Commission report warned:

“Through IoT products and services, Chinese firms may be transferring data from their U.S. consumers to China, where the government retains expansive powers to collect and exploit data with little regard for privacy or ownership concerns.”[11]

Role in Mass Surveillance

Hikvision and Dahua have faced a series of trade restrictions in the U.S. due to their alleged role in the repression of the Uyghurs and other minority groups in Xinjiang, north western China.

In October 2019, both companies were added to the Department of Commerce’s ‘Entity List.’[12] The Bureau of Industry and Security states that “transactions of any nature with listed entities carry a ‘red flag'” and U.S. companies must now receive a special license to sell to either Hikvision or Dahua.[13]

The decision followed the 2019 National Defense Authorization Act which prevented either company from selling their equipment to U.S. federal agencies.[14]

Despite Hikvision and Dahua both facing restrictions in the U.S., we found that both companies are being technically supported by U.S. companies, including web hosting providers Amazon, Digicert and Entrust.

More recently, Norway’s Council on Ethics recommended excluding Hikvision from the country’s wealth fund investment portfolio because of the company’s “role in the mass surveillance of the population in the Xinjiang region of China.”[15]

In its 2021 report, the UK Foreign Affairs Committee called for a ban on Hikvision operating in the UK among measures intended to “pressure the Chinese government to end its persecution of Uyghurs”.[16]

According to a report by IPVM, Hikvision “is financing around $145m worth of Xinjiang police video surveillance projects” and both companies have faced accusations that their technology can be used to automatically detect Uyghurs.[17][18][19]

Hikvision has stated that it “takes global human rights very seriously”. A spokesman told Reuters that “all our business is required to align with the company’s compliance policy” but declined to say what its compliance policy was beyond that it was in line with local laws.[20]

Dahua has similarly claimed that the company “adheres to the business code of conduct, and follows market rules as well as international rules.”[21]

Methodology

In the Oct 2021 update, Dahua and Hikvision surveillance camera networks were identified via Shodan scans and compiled from all relevant searches over the course of Sep 2021, generating almost 11 million results. Camera networks were inferred from unique IP address and port combinations. Additional geolocation data was sourced via MaxMind and combined with the dataset using in-house tools, following extensive data cleansing.

This data replaces the original findings that were derived from data collected in Oct-Nov 2020. Due to changes in the way Shodan scans operated in the intervening period, it was not possible to perform a fair comparison between the two datasets.

Findings for all countries and the top 1,000 cities are available via this Google Sheet.


About Us

Since 2016 we’ve focused on testing and reviewing VPN services, and over the years we’ve helped our readers find secure VPNs to stay safe and private on the web.

We also inform our readers about digital rights, privacy and security matters through our expert research and investigations.

The authors of all our investigations abide by the journalists’ code of conduct.

References

[1] https://www.technologyreview.com/2022/06/22/1054586/hikvision-worlds-biggest-surveillance-company/

[2] https://www.reuters.com/article/us-china-usa-restrictions/factbox-trump-administration-measures-against-chinese-companies-idUKKBN29C17E?edition-redirect=uk

[3] https://ipvm.com/reports/dahua-psa-sia

[4] https://www.csis.org/blogs/technology-policy-blog/hikvision-corporate-governance-and-risks-chinese-technology

[5] https://www.forbes.com/sites/leemathews/2021/09/22/widely-used-hikvision-security-cameras-vulnerable-to-remote-hijacking/

[6] https://www.malwarebytes.com/blog/news/2022/08/thousands-of-hikvision-video-cameras-remain-unpatched-and-vulnerable-to-takeover

[7] https://www.bleepingcomputer.com/news/security/moobot-botnet-spreading-via-hikvision-camera-vulnerability/

[8] https://www.bleepingcomputer.com/news/security/unpatched-dahua-cams-vulnerable-to-unauthenticated-remote-access/

[9] https://thehackernews.com/2022/07/dahua-ip-camera-vulnerability-could-let.html

[10] https://ipvm.com/reports/hik-2472

[11]

[15] https://www.uscc.gov/annual-report/2018-annual-report-congress

[12] https://www.federalregister.gov/documents/2019/10/09/2019-22210/addition-of-certain-entities-to-the-entity-list

[13] https://www.bis.doc.gov/index.php/cbc-faqs/faq/281-1-what-is-the-entity-list#faq_285

[14] https://www.congress.gov/115/bills/hr5515/BILLS-115hr5515enr.pdf

[15] https://etikkradet.no/hangzhou-hikvision-digital-technology-co-ltd-2/

[16] https://committees.parliament.uk/committee/78/foreign-affairs-committee/news/156425/foreign-affairs-committee-publish-report-never-again-the-uks-responsibility-to-act-on-atrocities-in-xinjiang-and-beyond/

[17] https://ipvm.com/reports/xinjiang-dahua-hikvision

[18] https://ipvm.com/reports/dahua-uyghur

[19] https://ipvm.com/reports/hikvision-uyghur

[20] https://uk.reuters.com/article/us-hikvision-china-insight/hikvision-a-surveillance-powerhouse-walks-u-s-china-tightrope-idUKKCN1VJ05C

[21] https://www.dahuasecurity.com/my/newsEvents/DahuaNotice/647