BreachPublished 16 Apr 2026

[Guest Diary] Compromised DVRs and Finding Them in the Wild, (Thu, Apr 16th)

Source SANS ISC Handlers Diary

Description

&&#x23;x26;&#x23;x5b;This is a Guest Diary by Alec Jaffe, an ISC intern as part of the SANS.edu Bachelor&&#x23;x26;&#x23;39;s Degree in Applied Cybersecurity (BACS) program &&#x23;x26;&#x23;x5b;1].

Impact

Attackers can gain root-level access to exposed DVRs within seconds by exploiting default credentials and unpatched firmware, enabling them to access video feeds, execute arbitrary commands, and potentially use the compromised devices as footholds for further network intrusion or malicious activity. The presence of at least 202 actively compromised devices globally indicates a tangible threat to organizations relying on these devices for physical security. The compromised DVRs may also be used in botnets or other malicious campaigns, although such uses are not explicitly detailed in the report.

Defensive guidance

Defenders should implement the following mitigations: restrict Telnet access to DVRs by using local firewalls or VPNs limited to trusted IP addresses; enforce strong password policies and immediately change all default credentials on these devices; disable remote root login over Telnet to prevent unauthorized administrative access. These measures reduce exposure and prevent automated attacks leveraging default credentials. Since the devices are often unmanaged and outdated, organizations should also consider firmware updates if available or replacing legacy devices with supported models.

Summary

Thousands of DVRs, particularly those from Dahua and its OEM Airspace, remain exposed on the internet with default credentials and outdated firmware, making them vulnerable to rapid automated compromise via Telnet. An observed attack from a single IP connected using root/root credentials and executed a scripted sequence of commands to escape restricted shells, discover system information, hide files, and prepare for malware payload delivery. Analysis using Shodan and AbuseIPDB indicates a conservative estimate of over 200 actively compromised devices globally. The attack maps to multiple MITRE ATT&CK techniques including password guessing (T1110.001), use of valid accounts (T1078), Unix shell execution (T1059.004), system discovery (T1082), hidden files (T1564.001), ingress tool transfer (T1105), and file deletion (T1070.004). The root cause is the exposure of DVRs with default credentials and lack of firmware updates since at least 2014. The report emphasizes the risk of unmanaged physical security devices becoming entry points for attackers.

References

isc.sans.edu/diary/rss/32886 (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 16 Apr 2026, 00:02 UTC

References

Community reviews