Ukrainian CERT Flags Remote Hijacking of Dahua Surveillance Cameras via P2P Flaws

The Computer Emergency Response Team of Ukraine (CERT‑UA) has released a public warning after confirming that multiple Dahua‑brand IP cameras and digital video recorders (DVRs) are being accessed remotely without authorization. The intrusion leverages the devices' built‑in peer‑to‑peer (P2P) connectivity and known weaknesses in default authentication mechanisms, allowing attackers to tap live video feeds and reconfigure the hardware.

Peer‑to‑peer functionality, marketed as a convenient way for users to view camera streams from smartphones or browsers without complex network setup, relies on cloud‑based relay services and often ships with preset credentials. Security researchers have long noted that when manufacturers do not enforce strong password policies or provide easy ways to disable the feature, the service can become an open backdoor for malicious actors.

According to the CERT‑UA bulletin, compromised units have been observed streaming video to unauthenticated endpoints and accepting configuration changes such as firmware roll‑backs, resolution adjustments, and even the insertion of malicious code. In practice, this means a hostile party can surveil sensitive locations, disrupt monitoring operations, or repurpose the cameras as footholds within larger corporate or municipal networks.

Dahua equipment is widely deployed across Ukraine in both public infrastructure—such as transport hubs, government buildings, and utilities—and private enterprises ranging from retail stores to residential complexes. The scale of the exposure raises concerns about privacy breaches and the potential for coordinated surveillance campaigns during a period of heightened geopolitical tension.

In response, CERT‑UA advises operators to immediately change all default passwords, disable the P2P service where it is not essential, and apply the latest firmware updates released by the vendor. The agency also recommends network segmentation to isolate video surveillance traffic from critical systems and to monitor outbound connections for unusual data flows.

Experts say the episode underscores a broader trend of cyber‑crime groups targeting Internet of Things (IoT) devices that lack robust security controls. While Dahua has not yet issued a formal statement, industry analysts expect the manufacturer to roll out patches and possibly redesign its authentication workflow. Continued vigilance by system administrators and coordinated information‑sharing among national CERTs will be crucial to mitigate further exploitation.