Security companies' transition to the Internet is not easy

Hikvision, the largest domestic security company with market capitalization, released the 2014 annual report on March 12th. The company's performance still continues its rapid growth of more than 50%. According to the situation in previous years, except for the changes in numbers, the remaining contents should be similar to those in the previous year. . Since the country announced the launch of the first batch of smart city pilots, the entire security industry has been fluent and its development is on the fast track. Haikang, which has a 40% SASAC background, is considered to be a typical example.

However, the real situation is that there is a significant difference between the two versions of the annual report, hidden in the beginning of the full text prompts for significant risks. In the early years, Haikang never mentioned only the risks of "renewing technology," "uncertain business model," and "exchange rate," and this year added a "product information security risk." If it was not on January 27th that the product being exposed had systemic loopholes that could easily be attacked and manipulated by hackers, investors may not have the opportunity to see such a message. In fact, the experience of Haikang is a microcosm of frequent problems in the rapid development of China's security industry.

Event playback

The incident occurred at 11 pm on January 27th. Although many people, including Hai Kang, the director and general manager of Hu Yangzhong, have all gone to sleep, one shows that the Public Security Department of Jiangsu Province has risen and disclosed that 2807 public security devices in Haikang encountered the virus. Infected and attacked by hackers outside the country, requiring all levels of units to carry out security investigations of the screenshots still detonated the WeChat circle of friends.

As the “Prism Gate” project of the United States was exposed in June 2013, the problem of network information security quickly rose and even the attention of senior officials from various countries, including China, confirmed that the leaders of Sino-U.S. leaders Xi’an and Manor held later in the meeting. Among them, network information security was first included in the agenda. In addition, Haikang’s products and equipment firmly occupy the market's first share, and are widely used in seven major sub-sectors, including public security, transportation, finance, building, justice, culture, education, and energy. It has been caused by the government’s “namely problem”. A lot of people are nervous.

Perhaps the industry is sensitive. Although it is a state-owned holding company, Haikang is still quickly launching the **** process. On the second day after being exposed, that is, January 28, it sent a letter of apology to users through the company's official website. It first admitted to the Internet. Security issues are not enough attention, but also stated that the key reasons for security risks include the use of weak passwords by users, emphasizing that users themselves should also raise awareness about network security. This kind of statement that each of the 50 boards is obviously not satisfying the public and investors. On the 28th day, 32 institutions flocked to Haikang to find out.

Affecting further fermentation, Haikang announced a temporary suspension of trading on the evening of March 1 and held an investor conference call on the morning of the 2nd to explain the situation. According to the disclosure, Haikang mastered the worm infection of product equipment on Aug. 19, 2014, and was attacked by a hacker. Then he reported the case to the network police brigade of Hangzhou Binjiang District where the company was located, and was investigated on September 2. However, it has not officially announced the progress of the matter. Because of this, Hai Kang was caught by the media and was accused of “not knowing what to do”.

What's the problem?

Haikang shouted repeatedly to this. Hu Yang, a director and chairman of Hai Kang, told reporters recently that after repairs, the attack was reduced in October, and the case was already filed. At that time, it was considered that the announcement was of little significance. "For the National Computer Internet Emergency Response Center, this was the first time that the virus was discovered, so it was named 'Hikvision' worm. After the definition, the data was distributed to the Jiangsu Provincial Branch Center. The latter was accordingly A report, but the report was wrong, whether it was the virus analysis or the data given, part of which was reported to the Jiangsu Provincial Supervision Team, and the Supervision Team of the Network went to the Science and Technology Information Department of Jiangsu Province. “Hu Yangzhong said that the branch office issued a text and sent it in an express manner, using telegrams. It was not stamped with official seals, and as a result, it was captured on the Internet in the middle of the night and caused an uproar.

In fact, Hai Kang is the first company in the industry to file with the regulatory authorities, and the source of the virus can be traced back to earlier. According to reports, well-known anti-virus software Symantec released an announcement on worms in Linux systems in December 2013. However, in March 2014, Haikang set up a security emergency response center and set up a security bulletin board on the official website to release relevant information.

Only this did not cause most people's vigilance, still did not take the initiative to change the password. "We don't know where the channels are, and we can't do more work," said Hu Yangzhong.

Many people in the industry expressed sympathy for the situation of Haikang. A cloud platform service provider said that security is first of all a matter of consciousness and habits, followed by technical issues. Haikang's problems are common in domestic companies. Another manufacturer of network cameras revealed that weak passwords on the system platforms of government, operators, and public security systems are no secret. "What 123456,00000000, four big O four small o password frequent, before the Shanghai Guoan Bureau to see the system password is 123456."

Due to the different stages of development of the industry, the traditional security video surveillance system was only connected to private networks and local area networks. It was equipped with Windows x86 and was not likely to be attacked. After 2009-2010, some small business owners and factory owners wanted to remotely view video, and the system was replaced with Unix, which was theoretically more vulnerable to attacks. Loopholes occurred in the process of switching from the LAN to the Internet.

The Internet is not easy to transform

In fact, this is not a problem for the Haikang family. With the transformation, "Hai Kang" will aim at a larger civilian market.

In the past two to three years, the Internet, especially the mobile Internet and smart terminals represented by mobile phones, have matured and the civilian security market has ushered in the investment boom. After all, there are technological precipitates. A group of traditional security companies represented by Haikang are even earlier than Internet companies such as Xiaomi and Ali, whose reputation has become so loud.

Haikang established the civil security brand "fluorite" in July 2012. The two-year layout has achieved initial results.

According to the 2014 financial statements, as of the end of the report, the number of fluorite APP users has approached 1 million. Expanding the scale and opening up the civilian security market are the two main themes of the security industry in 2013. Dahua also launched the civilian platform "China Vision Micro-Information" this year. But like any other industry, the transition is not easy, and the cost behind it is not small. It sacrifices the short-term profits of the company, but also accompanied by risks.

Taking UOB as an example, its net profit attributable to shareholders of listed companies in 2013 also experienced a high growth rate of 61%. According to performance forecast, the net profit attributable to shareholders of listed companies fell to only 1% in 2014 due to transformation investment.

Similarly, Haikang’s gross profit margin is also falling.

In addition, in the traditional era of security, domestic companies hope that they can “go out” and suffer from the fact that the upstream core technologies of the industry have been monopolized by foreign companies for a long time and have not been smooth. Civil security provides an opportunity. Haikang has set up a fluorite cloud platform in Singapore. Europe is currently under construction and plans to build 6 cloud platforms overseas.

The United States "Prism Door" incident has a far-reaching impact. A security brand wants to enter a country, especially developed markets in Europe and the United States, and its protection of network information security must withstand the most rigorous tests. With IT communication being a sensitive industry, Chinese companies in this field may be treated differently by going out. In other words, any point on the product or system will attract foreign media to use a magnifying glass to pick the wrong one.

Haikang is a ready-made case. A number of foreign media, including Reuters, reported on the matter. According to sources, 31% of Haikang's equipment was attacked, and there were more than 50,000 units in Jiangsu Province alone. Haikang’s official response on the March 2 investor conference call stated that the proportion of access to Internet products is no more than 10%, and the number of attacks is expected to be less. The news that the reporter got from Haikang was that only 2% of the total number of equipment was infected, and these products are not related to the fluorite product line.

Allegedly, Hu Yangzhong rethought two decisions in the board meeting on March 10th. First, he did not eat a stunner. He did not call this virus the Haikang virus. Second, he only sent monitoring data to the Zhejiang Emergency Response Center. No longer sent to other provincial centers. As far as virus infection and hacking itself are concerned, it is not yet over.