Ukraine’s computer emergency response team published an advisory on October 23 describing remote takeovers of Dahua recorders and IP cameras. Operators found live video being watched, settings altered and accounts created by people who had never been on site.
The route in was Easy4IP, the vendor’s peer-to-peer cloud function. With it enabled, a device opens an outbound connection to Dahua’s infrastructure and registers itself under its serial number. Anyone who can guess that number can then reach the device through the cloud, stepping around NAT and firewall rules without a forwarded port or a fixed public address.
Serial numbers are not secrets
CERT-UA points out that Dahua serial numbers follow predictable patterns, so they can be enumerated at scale to find which units are registered. Keeping the number private is not a control. A camera that answers to nobody from the internet is still reachable in practice.
Getting past the login screen is the second step, and weak or default passwords are only part of it. The advisory flags two 2021 authentication bypasses, CVE-2021-33044 and CVE-2021-33045, which let an attacker in without a password at all on unpatched firmware.
What to check on a device
Three signals are worth hunting for: accounts nobody recognises, altered on-screen overlays on the video, and audit-log entries showing DVRIP protocol logins from 127.0.0.1, the loopback address a cloud session would use. The absence of overlays proves nothing.
The response CERT-UA recommends is short. Turn off P2P and cloud access where it is not required. Keep cameras off the internet and reach them through a VPN restricted to approved addresses. Disconnect unfamiliar linked cloud accounts. Patch firmware by hand on a schedule, and count forgotten devices on the network as part of the estate.
