Hik-Connect Hik-Connect Visitor Mode - How can I disable it?

[Peekay]

Can anyone tell me if I can disable visitor mode for my Hik-Connect account?

I had a Hikvision CCTV system installed because a stalker had repeatedly broken into my house. As a matter of course I took a note of the DVR details on my mobile phone but then discovered that the person had hacked my phone too, so he knows the serial number of my DVR.

As a precaution I re-registered the device with a new Hik-Connect account and changed the password, however I have just spotted the new 'Visitor Mode' login option on my Hik-Connect mobile phone app.

Now if I understand this correctly, this new feature means that he (or anyone) that has got hold of my DVR serial number and knows my mobile phone number can download Hik-Connect, create a visitor account using my telephone/account number and hack into my security cameras without any need for a password?

I may have got this completely wrong and I apologise in advance if I have, but if there are any Hik-Connect gurus here who can explain more about this I would be extremely grateful. I have searched but there doesn't seem to be any way to disable the feature like the normal sharing setup.

Thx. Peekay

 

[RBW]

He would need the verification code to view the images.

 

[Peekay]

@RBW

Thanks for responding. Sorry for the late reply.

Unfortunately, I am pretty certain that the verification code was also in the notes he will have stolen. It appears next to the QR code in the admin screen and I took a photo of that screen. I haven't worried about it until now because even though I know he has that info, the Hik-Connect password protected me. Now I am worried that 'visitor mode' is a major security issue, for me at least.

Can I change the verification code?

 

[RBW]

Yes you can change the verification code.

Also he would need the admin or other users passwords. If you change the passwords no access!

 

[Phil]

Follow this link to see where to set the code:
HikVision NVR "Invalid encryption key" error message

 

[Peekay]

@Phil

Thx for the info. I had planned to change the verification code and re-add my DVR in the Hik-Connect web app, but in my DVR admin control panel it appears twice. Once in 'System Management/Device Info' (here the code does not seem to be editable) and again in 'Configuration/Network/Platform Access' where the code does appear to be editable.

I am guessing that the code needs to be the same in both places, but the device info one cannot be changed?

Am I missing something.

 

[StewartM]

Hope I didn't double post. The platform access tab is the only place you set a verification code for the DVR to connect to Hik-Connect. When you log into your new Hik-Connect account on the website does it list your DVR and report it as 'Online'?

 

[Peekay]

Hi StewartM. Yes, everything works fine on Hik-connect at present. I just want to change the code because someone who broke into my house knows what the code is and I want to prevent them from accessing my cameras. If I change it on the platform access tab will it change on the device info tab too?

BTW I think the verification code that I have has been set by the CCTV installers, I don't think it's the one that is printed on the DVR box.

 

[Phil]

Please see this update Post, hopefully it clarifies the entering and use of the verification code / encryption key:
HikVision NVR "Invalid encryption key" error message

 

[Peekay]

I posted a specific question about changing the verification code here and I have now done this, so many thanks to everyone who helped.

I still have no idea what 'Visitor Mode' is for.

Maybe Donald Trump knows?

 

[StewartM]

This may (or may not) be helpful:
https://www.hikvision.com/mtsc/uplo...ow_to_use_visitor_mode_in_Hik-Connect_APP.pdf
From what I gather the devices you add in Visitor mode are not bound the same way as they are to registered accounts. I'll dig around some more and get back to you.

 

[Peekay]

@StewartM

Many thanks for that link.

Now if I understand that PDF correctly, this new feature allows anyone to download the Hik-Connect app, create a 'visitor account' on Hik-Connect.com and then add a device (e.g. YOUR DVR) as long as they know the serial number and verification code.

Adding a device does require the visitor to scan a QR code from the device admin screen, but that's not hard to spoof. The QR code in 'System Management/Device Info' appears to be encoded, but the QR code that they ask you to scan in 'Platform Access' is not. If you use a QR code reader on your phone you'll see it just contains the the serial number and the verification code in plain text.

This serial number and the verification code is printed on the packaging of every Hik-vision DVR. Not everyone changes the verification code. There are several websites where I can make a QR code simply by typing in that text.

So... this is not very secure. Or is it?