Segment building systems before the camera becomes the pivot point

Somewhere in your estate there is a camera watching a car park, a loading bay or a lobby. It was bought by a facilities manager, installed by a contractor, and it has sat on the corporate network since before anyone asked what it runs. The warning CERT-UA published late last week, reported by The Record on 26 October, is about Dahua cameras and video recorders, but the mechanism is the one your own estate has been carrying for years.

CERT-UA described attackers reaching internet-connected Dahua devices through a cloud feature called Easy4IP, which ties devices to the manufacturer's cloud by serial number even when a firewall would otherwise block inbound access. Because the serial numbers follow predictable patterns, cameras can be located without their identifiers ever having been disclosed. Attackers then try weak or default passwords, or exploit two authentication bypass vulnerabilities from 2021. Hunt.io reported in August that more than 14,500 Dahua devices were compromised earlier in the summer, concentrated in Ukraine and Russia, and said malicious accounts and recovery codes can survive password changes and, on most firmware versions, factory resets.

The mechanism travels further than the vendor

Most readers will take this as a procurement warning: check whether you own Dahua cameras, ban the brand, move on. That is the narrow read. The wider read is that a camera is not a fixture; it is an embedded computer with storage, a network interface, a cloud client and credentials. It gets a floor port, a default VLAN, no patching cadence and no owner in the asset register. That combination is exactly what an attacker uses as a pivot point. The fact that a device was cheap enough to install and forget leaves it unmanaged, and unmanaged is what the warning is really about.

The same shape repeats across the building systems around it. The device sits outside IT's patch cycle, outside the identity directory, and outside the change management process. It is the last object anyone expects to answer a login prompt to the rest of the network. What makes the current warning dangerous is how trivial these devices are to reach and how persistent the access is once established. A brand change or a purchase moratorium does not touch a device that is already on the floor and connected.

Read the network like production infrastructure

The first check is simple: can you name every camera, NVR, door controller, building management gateway and smart meter on the network? If the answer lives in a spreadsheet that facilities owns, it is probably different from what the switches see. There is one team covering the whole estate, no 24/7 rota, and a supplier who will not take the call about firmware. The inventory has to be produced as a project, starting with discovery across the network. Our implementation and assessment services are built for exactly this: someone has to run the discovery, reassign the VLANs, and harden the devices that cannot be isolated.

A camera using Easy4IP should be able to reach the manufacturer's cloud and the NTP server it actually uses, and nothing else. Segmentation is the control that turns a compromised camera from an estate-wide problem into a single VLAN incident. That means putting building systems on a dedicated VLAN with default-deny rules toward the rest of the network, and writing the outbound firewall rules from what the device genuinely requires instead of leaving it open. It is a small amount of network engineering that pays off the first time someone guesses a default password.

Questions that reveal the estate

When a facilities supplier or installer is next on the phone, ask three things before the conversation moves on:

• Which firmware build is running on each device?
• Who holds the administrative credentials?
• What outbound connections the cloud features require

If the supplier cannot answer the first two, that is your answer about whether the devices are being managed. The third answer is what you need before you write the segmentation rule.

It is also worth asking whether the devices have been reset since the last firmware update. The Hunt.io finding that malicious accounts survive most factory resets matters because it changes the recovery procedure. On a compromised device, a reset alone leaves the accounts in place; the firmware has to be updated and the cloud accounts checked. If the facilities team treats a camera as furniture, that conversation is where it becomes visible.

The test that outlives the warning

This story will fade and the next camera warning will name a different vendor. The underlying test stays the same. When the board or a customer questionnaire asks how you segment the network, can you say with confidence where every building system sits, what it can reach, and who is responsible for patching it? If the answer is no, you have found the gap before an attacker did. If the answer is yes, keep the exception list short.

If answering those questions shows the estate is thinner than expected, a short scored self-assessment can turn the discovery into priorities before the budget conversation starts.