Hikvision Canada ordered to cease operations over security risks

Stembolt

Hikvision Canada Inc. is the Canadian subsidiary of Hangzhou Hikvision Digital Technology Co., Ltd., the world’s largest manufacturer of video surveillance equipment.

“Following a National Security Review under the Investment Canada Act, the Government of Canada has ordered Hikvision Canada Inc. to cease all operations in Canada and close its Canadian business,” reads the announcement.

“The government has determined that Hikvision Canada Inc.’s continued operations in Canada would be injurious to Canada’s national security.”

While Canadian authorities did not share the findings leading to the decision, they say that the ruling is based on a multi-step review of information and evidence provided by the country’s security and intelligence community.

Donoreo

Never heard of them.

ElQuintron

Donoreo Never heard of them.

They’re mostly in businesses, but their gear is everywhere I have some at my home. I’ll take a pic when I get a chance. I’d bet you’ve seen their cameras.

Hydraglass

ElQuintron They’re mostly in businesses, but their gear is everywhere I have some at my home. I’ll take a pic when I get a chance. I’d bet you’ve seen their cameras.

They are pretty popular in the PoE dome camera segment - I’ve never bought any - I’ve always stuck with TrendNET for all of the security cameras, NV bullet cams, etc for all the installs I’ve done, prices are pretty comparable between the two for the most part, they are just one of many players in a crowded field.

This “slap” to this manufacturer follows the same playbook as the one to Huawei - the US has already sanctioned them for their operations and connection to Xinjiang, intelligence community says “they pose a security threat” and the government does what it always does - pulls the rug out without letting proper technical experts get involved, take a look at the “supposed intel” and see if there really are any hazards, dangers, backdoors, etc.

I mean, at the end of the day, anything that has firmware in it is always a risk, as even if today the firmware is 100% benign and does nothing iffy or questionable, you’re putting your faith in them never pushing out another firmware update that does do something nefarious that might not be caught for days or weeks or even longer – and might even end up being unknown and transparent to the Canadian subsidy of the parent company.

This is something I’ve recently had to deal with in my day job - as we buy and use some third party imaging equipment from overseas companies (for example Pegatron in Taiwan) to embed in certain products and their imaging sensor arrays and camera systems have built in Stratix FPGAs that load firmware provided by the manufacturer. It has been my “pleasure” to sit with the team through a full code review of the firmware and compile it myself locally to verify the hash and byte count of what I get from the build and memory image dump from the fpga matches exactly what the vendor provided. We wouldn’t have used their products if we couldn’t do that - but a “subsidiary” of a “parent” wouldn’t question what they are sent and would happily push it out onto their hardware if told to - likely with relatively blind faith and trust.

urbanriot

Donoreo Never heard of them.

Probably the most common manufacturer of NVR / IP cameras in Canada and fairly common in the US as well, until the US banned them a few years back. The funny thing is knockoff OEMs using Hikvision firmware are just as popular in the SMB space as Hikvision is.

Pulsar

Donoreo

You may never hard heard of them, but you are 100% in their database if you ever go outside in a city!

Their camera systems are very smart in terms of facial recognition and even pattern recognition, even on the cheap cameras you can buy for your home. Dahua can run reports on how often your wife was in the view of a camera, for example, or how many children came by, how many delivery trucks, pizza deliveries, dogs, cats, birds, etc., you can train the AI in any way you want and create huge databases (not that you would find a purpose for this at your house, but governments and businesses would). I believe Hikvision is even more advanced than Dahua on that front.
Officially they were originally banned in the USA because those companies support the Chinese government’s efforts against the minorities like the Uyghurs.

GrumpyCanadian

Hydraglass They are pretty popular in the PoE dome camera segment

Indeed; I’ve seen them at various places of business, and I think even the STM has some installed in municipal buses and metro stations, among other brands. If they pose any real threat, how does expelling the Canadian subsidiary help, given the many units already installed and in service, unless you also mandate that everyone get rid of them, and replace them with something else? In some cases, good luck with residential users with them installed, like @ElQuintron.

Also, if they are not given any access outside of the local network, unless they have some very advanced ways of exfiltrating data, what is the harm? I don’t usually use alerts at all, but when I do, it is via e-mail, sent through my own local server that then forwards off-network appropriately, with restrictions. Recipients are controlled, too; me@my-domain.example: yes, some.baddie@evil-domain.cn: no.

Somewhat-Reticent

Pulsar Officially they were originally banned in the USA because those companies support …

… remote surveillance❗️
( And likely went Classic Cheap on documentation and user support …
many Chinese vendors have no idea what’s in the firmware, or what options … )

GreenEnvy22

I have one of their cameras at home and a couple at work. I’m transitioning both to unifi cameras already for unrelated reasons.

If they want to spy on my veggie garden they are welcome. This is it’s view. Maybe they can save me the time it takes me each fall when in make a timelapse and send me one automatically
😄

GrumpyCanadian

GreenEnvy22 According to the watermark, yours is a Reolink. I didn’t think they were related, other than both being Chinese companies.

I have to say it: yes, still envious of that garden!

GreenEnvy22

Oops, I can’t even keep my cameras straight 🙂
Hikvision was at the front door, guess that one is gone already.

taraf

GreenEnvy22 I have one of their cameras at home and a couple at work. I’m transitioning both to unifi cameras already for unrelated reasons.

Unifi has also had a lot of the same problems – the issue isn’t that the cameras can’t be secure or even that they phone home, it’s that they have zero consideration for security or authenticating the stream if a user tries to view it - if it’s got a public IP address, it can be viewed by everybody. Unifi has had similar issues in the past. I would not suggest you allow it to be viewable on the cloud, if I were you: if you really want to be able to see your cameras remotely, then set up a VPN and phone in using your phone & a local server rather than the cloud app.

ElQuintron

taraf if I were you: if you really want to be able to see your cameras remotely, then set up a VPN and phone in using your phone & a local server rather than the cloud app.

I do this in order to avoid my video traffic going through Hikvision’s servers.

GreenEnvy22

taraf
The unifi cameras set typically setup like I usually setup any other IP camera. They don’t have an IP gateway, so they can only talk to devices on their own subnet. For the Unifi cameras, this means they can talk to the unifi protect server, which in turn can talk to the internet so we can view cameras. That one theoretically could be uploading streams somewhere else but we’d see the traffic on our firewalls. No way to get unauthenticated access to the unifi server though (short of some zero day being discovered).

The hikvision and other generic ONVIF/RTSP cameras also don’t have a gateway, they just talk to the surveillance station server (we’re phasing this out), which in turn is accessible on the lan (we never made the surveillance station server reachable on internet).

In all cases the cameras are on their own VLAN, so no users can snoop (which would be simple if they were on a users VLAN, at least for the ONVIF/RTSP cameras).

Thane_Bitter

GreenEnvy22 How long do the raised wood sided gardens last (before the wood rots out, leading to a blowout or failure of any kind). Looks like 2×6 lumber, anything special about it or done to it?

Thane_Bitter

taraf Going to disagree with you there, the camera does have an IP but you still have to log into it with a username and password in order to view it, the quality of the image doing so isn’t that great. It’s perhaps useful to check operation/view but far easier to login as a user via the console. They (cameras) can be subnetted or put into their own VLAN which is a good idea for a number of reasons (more traffic flow and management than security). As for general authentication its account based, which can include password (NR), 2FA and now passkeys. It can be run as a standalone if you want but still requires some sort of login for it to work.

IMHO its a solid system and secure if the user bothers to do more than just plug it in but it ain’t cheap and because their model of profit is to keep rolling out new things I do wonder about the longevity of their products (support, operation, and lifespan). Their new NAS thing looks good, while its not doing ZFS (raid 5,5,10) it seems more cost effective that the big NAS makers products, however SMR drives are not recommended.

Having said that the company does give and take back on their software/firmware. Features advertized seem to take a long time to come about, other changes are added and then removed or updates (within the EA and RC track) can have bugs which might be significant though those are fixed rapidly, other minor ones can linger for many updates) Adoption, removal and such of devices has improved but often, if you really mess something up you have to go find the device and give it a hard reset which might be an issue if its 30-40 feet off the ground. If sound recording has been turned off, this is the only way that feature can be turned back on and I do understand why they did such (legal reasons) but sometimes a error in settings or some other glitch can screw up a device requiring a total reset.

The company did have a data breach but it was one of their own employees trying to exploit them and no data was released or leaked.

taraf

Thane_Bitter Going to disagree with you there, the camera does have an IP but you still have to log into it with a username and password in order to view it,

https://securityvulnerability.io/vulnerability/CVE-2025-23115

GreenEnvy22

taraf

So a zero day, but one that only works if the attacker is on the same network as the cameras. In both my house, and my work, that isn’t possible (well anything is possible, but like I said, separate VLAN and no gateways mean they can’t talk to any other devices).

That’s something every vendor suffers from. At least with Unifi they are actively supporting cameras with new firmware/features and not abandoning them immediately after sale.

Thane_Bitter

taraf Interesting, I’ll look into more tonight.

taraf

GreenEnvy22 So a zero day, but one that only works if the attacker is on the same network as the cameras. In both my house, and my work, that isn’t possible (well anything is possible, but like I said, separate VLAN and no gateways mean they can’t talk to any other devices).

This one, yes. But the point was that putting a camera on the Internet in any form is a bad idea. There’ve been other vulnerabilities associated with it. Hikvision is bad, but Ubiquiti isn’t without fault either. If you have the skills, put your IoT devices on a separate VLAN and don’t let it access the Internet.