Ganz Lost Passwords / Security Hole Warning

[Dougsmiley 0]

So I recently got a ganz dvr from a customer site, they were upgrading to IP cams and said, take it we dont want it. So naturally I figured, I'll throw it on ebay. After seeing some previous struggles on this site of people trying and failing to reset their unit, thought I would post my advice and maybe it will help someone in the future.

 

Problem. Didn't know the password. And after much searching came to the fact, it has to be shipped to Ganz for password reset. Well thats no good, I didn't buy this unit myself even though I came apon it completely legally this sounds like a hassle. An idea struck me, this has a web server. Wonder if I could crack the password that way. And it turns out, yes, and pretty damn easily. This could also be seen as a security flaw so it serves as a warning to anyone deploying them to use a UNIQUE and COMPLEX password.

 

The web server on the unit, default port 8080, uses the same logins as the dvr. It doesn't boot you after ANY number of bad logins. So all I had to do was fire up a password cracker of choice, I picked THC-Hydra, but any that support http will do. The syntax is pretty easy to figure out. You just set one login, and these are visible on the dvr. Then for the password I used a file of numbers 1000 to 99999. Why this you ask? Well the unit has no keyboard and people are lazy. So chances are its gonna be a numerical password.

 

Less than 2 minutes later, the program pops out the passcode.

 

So for those of you locked out of Ganz units, heres a solution, provided the unit is dhcp or has a known static. Those of you using these, USE GOOD PASSWORDS, at least for the accounts that have power. Because I could of easily done the same thing from the outside had I known the public IP.

[gb5102 0]

Great warning/advice!

Speaking of lazy, I can't tell you how many dvr's I've come across(DIY and 'pro' installs...) that someone put on the web without even changing the DEFAULT login info...way too common