Ukrainian CERT Flags Mass Hijacking of Dahua Surveillance Cameras via P2P Flaws

Ukrainian Computer Emergency Response Team (CERT‑UA) has issued a warning about a wave of unauthorized intrusions into video‑surveillance equipment produced by Dahua, a Chinese vendor widely used across the country. The breach exploits the devices’ peer‑to‑peer (P2P) remote‑access capability and weak authentication, allowing attackers to seize live video streams and alter system settings.

The alert, released earlier this week, cites multiple municipal and private installations that reported loss of control over IP cameras and digital video recorders (DVRs). In the affected sites, video feeds were redirected to unknown endpoints, and configuration menus were accessed without permission, indicating that the attackers leveraged default credentials and unprotected P2P services that bypass traditional network firewalls.

Dahua’s hardware, popular in Eastern Europe for its ease of deployment, includes built‑in P2P modules that simplify remote management but also create a vulnerable attack surface when passwords are unchanged or firmware is outdated. Security analysts have previously highlighted that these modules can be abused to gain shell‑level access if the device’s authentication is not hardened.

According to the CERT‑UA bulletin, compromised devices have been used to modify recording schedules, disable motion‑detection alerts, and in some cases load altered firmware. Although investigators have not yet confirmed large‑scale data theft, the capability to view real‑time video presents a serious privacy and operational risk for public services, businesses, and ordinary citizens.

Officials advise immediate remedial actions: replace default passwords, disable unnecessary P2P functionality, install the latest firmware updates provided by Dahua, and isolate surveillance networks from critical infrastructure. Continuous monitoring of outbound traffic for connections to known P2P servers is also recommended.

The episode highlights the growing challenge of securing Internet‑of‑Things devices in conflict zones, where adversaries can exploit readily available technology for intelligence‑gathering or disruption. Experts warn that without coordinated hardening measures, similar attacks could spread to neighboring countries that rely on the same camera platforms.