That porch cam watching your front door. The smart security camera that tracks motion through your living room at night. The cameras that watch your kids. Are you really sure they’re secure with their feeds locked down and off the internet? If you haven’t recently checked the settings on your internet-connected cameras, now is the time to do so.
Researchers at Bitsight’s TRACE have published a new report this month that highlights their latest discovery: 40,000 security cameras were exposed online and showing images from both homes and businesses. From offices and retail stores to factories as well as private residences, these cameras were showing images online without requiring any password or authentication.
Obviously, this is a huge privacy issue as these cameras are placed all over our houses, including in bedrooms and kids rooms. Hackers can not only spy on the owners of these cameras, but also set them up for extortion or use the information gleaned from their feeds to plan a break in.
Additionally, according to Malwarebytes, threat actors with SSH access (allowing them to log into the device via a terminal and control it like one would with a regular computer), could get into the hardware and software of an exposed camera to exploit any unpatched manufacturer vulnerabilities. The camera could then compromise other devices on a victim's home network or even be used as a botnet.
How does this happen? Home security cameras generally require an internet or Wi-FI connection, and these cameras also often have their own web servers which users access over either an app or a web browser in order to view live video feeds. However, because of the way in which these feeds are exposed over the internet, anyone can access them by simply typing in their IP address.
Finding unsecured feeds is quite easy too since many vendors don’t establish any kind of basic cybersecurity hygiene or firmware update process. Likewise, while some regulation has been established, enforcement has been inconsistent. Meanwhile, users tend to think of them as appliances and simply plug them in and connect them without considering the security measures that should be taken first.
How big is this problem? According to the report, the number of exposed cameras in the U.S. was around 14,000 with California and Texas having the highest number of them. Other countries affected include (in order) Japan, Austria, Czechia, and South Korea.
It’s a problem that has also occurred before: Bitsight found a similar issue back in 2023 when Insecam was streaming images from over 40,000 unsecured cameras online too.
How to protect and secure your cameras
First, like you always should, you want to make sure you’re using strong and unique passwords for your cameras. However, you also want to take the time to configure them in the administrator or settings interface so that you can change their default passwords. At the same time, you want to patch and update your devices regularly (if possible) and set them to update automatically if you can.
Secondly, if you have an internet-connected camera make sure that you research the brand you're considering first to see if it’s had any reported security issues in the past or any vulnerabilities that you may need to be aware of. Try to access it in an insecure manner, that is without using log in credentials and know that if you can, so too can everyone else.
Additionally, be aware of where you position your cameras. Think carefully before putting a camera in a sensitive location like a bedroom or bathroom. Also, if your camera has a privacy shutter feature, use it!
With more people adding the best home security cameras to their homes to protect them and ensure their packages aren't stolen, this issue likely isn't going to go away anytime soon. That's why it's up to you to research potential security cameras carefully first and to make sure that you fully lock them down once they're set up in your house.
More from Tom's Guide
You must confirm your public display name before commenting
Please logout and then login again, you will then be prompted to enter your display name.
