FLASH
Shkruar nga Pamfleti
As Russia's full-scale invasion of Ukraine approaches its second anniversary, hundreds of thousands of security cameras from Chinese companies Hikvision and Dahua, used by government-run security systems and private companies across Ukraine, are increasing the risk of attacks of the Russian army, warned Ukrainian digital security experts and Government officials.
When Russian rockets struck Kiev on January 2, killing at least three people, two ordinary CCTV security cameras – one located in a building, the other in a parking lot – helped the State Service of Ukraine (SBU) back up their claims. .
After hacking the cameras, the Russian intelligence service used them to "spy on the Defense Forces in the capital" and recorded images "of critical infrastructure buildings", the SBU said.
One of the cameras was a Chinese-made Hikvision device from 2016, a law enforcement official told RFE/RL's investigative unit Skema. This official asked to remain anonymous due to the sensitivity of the case.
"Such cameras usually only connect to the Internet and are already of an old model - that is, with software that has not been updated for a long time and has many vulnerabilities," said Serhiy Denysenko, executive director of the Ukrainian security company. information, Digital Forensics Laboratory.
The camera manufacturers' "basic" software means that "hackers — or in this case, Russian special services — snooping around the Internet can find this camera and gain access to it," Denysenko said.
To test the SBU's claims, a Digital Forensics Laboratory specialist managed to hack a 2015 Hikvision CCTV camera for 15 minutes.
From 2014 to 2022, three Ukrainian companies imported over 875,000 CCTV cameras and other equipment related to video surveillance manufactured by Hikvision. One company alone imported about 1.1 million cameras and other surveillance equipment made by Dahua, according to import-export database ImportGenius.
Other companies also imported smaller numbers of equipment manufactured by Hikvision and Dahua, companies that dominate the world market for video surveillance and are ranked as the most imported CCTV cameras in Ukraine.
They also rank among the most controversial cameras in the world. In 2022, the United States Federal Communications Commission banned new authorizations for the import or sale of Hikvision and Dahua "communication equipment". The reasoning of this commission was that they presented "an unacceptable risk to national security". Australia, Taiwan, the United Kingdom and other States have also imposed bans or restrictions on the use of these cameras.
However, there are no such rules in Ukraine, even though in 2023 the state described the Hikvision and Dahua Technology companies as "international war sponsors" because they "pay taxes in Moscow and sell equipment that has military uses".
A spokesman for the Chinese Foreign Ministry told Reuters on February 1 that China "firmly opposes" the inclusion of 14 Chinese companies on Ukraine's list and "demands that Ukraine immediately correct its mistakes and eliminate negative impacts."
However, this spokesperson did not address the issue of possible consequences from the hacking of Chinese-made CCTV cameras.
Hikvision and Dahua cameras and software make up 74 percent of CCTV systems used in Ukraine's national system for video surveillance of streets, parks, residential buildings and other public spaces, according to the Interior Ministry.
Another 24,000 cameras from Hikvision and Dahua companies are used in similar public surveillance systems, the Ukrainian Interior Ministry said in a response to REL.
Russia's TRASSIR video surveillance system – which REL reported in December was used at the shuttered Chernobyl nuclear power plant, but also at several other Ukrainian sites and sensitive buildings, such as the Ukrainian Sea Ports Administration in Odesa – in many cases it uses Hikvision cameras, although TASSIR has its own software.
A Russian video surveillance system deployed at various locations in Ukraine may be transmitting data to servers in Moscow owned by major Russian corporations, an investigation by Radio Free Europe's Ukrainian Service found.
REL has asked the office of President Volodymyr Zelensky, the Cabinet of Ministers, the National Security and Defense Council and the SBU whether they believe these cameras pose a security risk and whether Kiev plans to remove these devices from Ukraine. None of these institutions responded.
Experiments conducted by the Digital Forensics Laboratory and Digital Security Laboratory, a non-governmental organization in Kiev, showed that cameras from Hikvision and Dahua companies are vulnerable to hackers and that they send encrypted data to servers controlled by Chinese companies, which are partly or under full state control.
Një kamerë e Hikvisionit e vitit 2015 pranoi me lehtësi fjalëkalimin që hakohet shumë lehtë “1234567890” për t’u kyçur. Një model i vitit 2023 i kësaj kompanie kërkonte një fjalëkalim më të ndërlikuar me simbole, por dërgoi disa të dhëna të koduara të përdoruesit dhe të dhëna të regjistrimit në një server në Kinë në pronësi të ChinaNet, që është një ofrues i shërbimeve të internetit në pronësi të shtetit kinez.
Një kamerë e vitit 2019 e kompanisë Dahua, edhe kur lidhja e saj me serverin ishte e fikur, përsëri dërgonte informacione të koduara, duke përfshirë fjalëkalimin dhe emrin e përdoruesit, te serverët në Gjermani, që drejtohen nga uCloud e Kinës, një kompani shtetërore, dhe te kompania private amerikane, Zenlayer.
Siguria e transfereve të informacioneve nga CCTV varet nga prodhuesi, lidhja me serverin dhe “kush mund të përdorë këto informacione dhe si”, tha eksperti nga Digital Security Laboratory, Ivan Antonyuk. “Pyetja është: A u besoni zhvilluesve kinezë apo jo?”.
Megjithëse informacioni është i koduar, “deshifrimi i një informacioni të tillë nuk do të përbëjë problem për prodhuesin dhe zhvilluesin e këtyre kamerave”, tha Denysenko.
“Ekspertët tanë janë të bindur se kur përdoret një shërbim i tillë, nëse është e nevojshme, përfaqësuesit e prodhuesve mund të kenë lehtësisht qasje në kamera”, tha ai. “Gjithashtu, duke marrë parasysh raportet aktuale midis Kinës dhe Rusisë, kjo mund të bartë disa rreziqe të sigurisë”.
Radio Evropa e Lirë nuk gjeti dëshmi të drejtpërdrejta se Kina ka transferuar imazhe nga kamerat kineze CCTV në Ukrainë tek ushtria ruse, por ekziston korniza ligjore për transferime të tilla.
Kina, lidhjet e së cilës me Rusinë nga të dyja shtetet përshkruhen se janë të një partneriteti strategjik “pa kufij”, publikisht nuk e mbështet luftën e Rusisë kundër Ukrainës.
Ligji për inteligjencë kombëtare të Kinës parashikon që kompanitë t’i dorëzojnë të dhënat Qeverisë nëse kjo është e nevojshme për shkak të arsyeve të sigurisë. Pekini ka qasje, “në thelb të papenguar”, në serverët e internetit në Kinë, raportoi CPO Magazine, që është një faqe interneti në Singapor që gjurmon privatësinë e të dhënave.
“Kompanitë kineze nuk kanë fuqi të mbrojnë përdoruesit nga shkeljet e të drejtave digjitale nga një prej qeverive më të fuqishme – dhe të papërgjegjshme – në botë”, shkroi më 2020, Ranking Digital Rights, një projekt ndërkombëtar i institutit New America me seli në Uashington.
Hisedari më i madh i Hikvisionit, me 36.35 për qind të aksioneve sipas ueb-faqes së kompanisë, është Electronics Technology HIK Group, që është një degë e China Electronic Technology Corporation Group, në pronësi shtetërore. Kjo firmë, e njohur si CETC, në ueb-faqen e saj ka listuar kontributet në industrinë e mbrojtjes së Kinës, duke përfshirë “luftën elektronike” dhe dronët.
Dahua Technology also has a significant government shareholder: China Mobile, a telecommunications firm that has a 9.5 percent stake in the company. China Mobile is state-owned and Dahua has said the company does not have "operational control" or "undue influence over decision-making" of the camera company.
In 2022, the US Department of Defense designated the companies Dahua and Hikvision, but also the Chinese state-owned companies China Mobile and CETS, as "Chinese military companies" - corporations whose technical capabilities are used by the Chinese military.
A report published in July 2023 by the US Office of the Director of National Intelligence found that, despite international sanctions and export restrictions, China "is providing some dual-use technology that Moscow's military is using to continue the war in Ukraine".
Intelligence sharing is also part of China and Russia's 2021-2025 Roadmap for Military Cooperation, the Congressional Research Service noted.
REL contacted Hikvision and Dahua to ask about the security of their cameras in Ukraine and whether they cooperate with Russia, but these companies did not respond to questions sent.
The US arm of Dahua Technology, however, claimed in July 2023 that the tech giant only ships "peripheral products and accessories" to Russia and that "none of our global products are currently designed for military use".
The SBU said on January 2 that it had jammed more than 10,000 CCTV cameras in Ukraine since Russia launched its full-scale invasion of the country on February 24, 2022.
Responding to a question sent by REL in January, Ukraine's Interior Ministry said that it "does not recommend or approve" the purchase of Hikvision and Dahua CCTV cameras, and that the institution is seeking to ensure that such cameras that used by Government-controlled video surveillance systems, be replaced.
According to Ukraine's public procurement database Prozorro, some government bodies, such as the Zolochiv village council in the Kyiv region, have begun scrapping contracts for cameras, citing security concerns after Hikvision and Dahua were labeled as “ international sponsors of the war".
Existing surveillance systems using Hikvision and Dahua cameras were deliberately placed "on a closed local network" without access to the "public Internet" in order to "prevent the risks of information leakage" in China, the Ministry of the Interior said. Ukraine.
This ministry has proposed a bill for a "unified" CCTV system that would work with software produced by Ukraine and Israel. However, such legislation has not yet been sent for a vote./REL
Lini një Përgjigje