Millions of IP cameras around the world are unprotected
Over 3.5 million active Chinese-manufactured IP cameras are only protected by a vendor’s default password, or lacking protection altogether, putting users at risk of snooping, experts have warned..
New research from CyberNews (opens in new tab) found over 458,000 devices protected only by default credentials operational in the US alone, alongside almost 250,000 in the United Kingdom, with countries such as Mexico, China, the Korean Republic, India, Brazil and Russia also appearing on the list.
At least 21,000 cameras worldwide lack any authentication whatsoever, raising questions about invasions of privacy, and the impact IP cameras are having on the global uptick in cyberwarfare.
Security camera passwords
All devices connected to the internet are in danger of being accessed by unknown and potentially malicious third parties. In the case of security cameras, threat actors can access the live feed, record sensitive personal data, and use the camera as a vulnerable endpoint on a network.
Researchers for CyberNews are concerned that all brands of camera it came across in its analysis have products in circulation that are permitted to function without changing the default password, or without one at all. These include Hikvision, HIPCam, Cisco, Toshiba, and Linksys.
It’s not all bad news, though. The most popular camera manufacturers’ latest products are programmed, either by model or firmware version, to force users to set a password, or generate a unique one at random.
96.4% of the cameras CyberNews examined belonged to these brands, but it’s worth highlighting that this doesn’t mean that 96% of connected cameras are benefitting from an uptick in protection.
Hardware devices often age, are depreciated by the manufacturer, and become ineligible for firmware updates, which can also push security patches. The vast majority of connected IP cameras aren’t going to be the newest models mandating, or at least recommending, healthy password security practices.
Where we are now is certainly an improvement from the results of CyberNews’ research on this same topic last year, which found that only 5.3% of cameras mandated setting a password.
The world is gravitating towards cyberwarfare in the wake of the Russia-Ukraine conflict and China’s growing reputation as a surveillance supplier, with ransomware and DDoS attacks becoming especially common.
With that, there are growing fears surrounding how devices from popular IP camera brands, such as China’s Hikvision, could be used by state-sponsored threat actors.
CyberNews reported that, until at least December 2022, Hikvision advertised “demographic profiling facial analysis algorithms” as part of its products on the company’s website, but that following an investigation (opens in new tab) by The Guardian, the ads were removed.
Some western democracies have resisted the growing influence of foreign surveillance technology better than others in recent years.
In July 2019, the UK’s then-Prime Minister Theresa May backed down (opens in new tab) from her plan to allow Chinese company Huawei to assist in developing the country’s 5G infrastructure following US pressure. And in September 2020, The Guardian reported (opens in new tab)that Hikvision cameras, blacklisted in the US, were installed in UK leisure centres and, alarmingly, school toilets.
Things are, however, moving in the right direction.
In November 2022, the UK banned (opens in new tab) Chinese surveillance equipment from “sensitive” government sites, while the US’ Federal Communications Commission (FCC) adopted rules (opens in new tab) preventing “communications equipment deemed to pose an unacceptable risk to national security” from being imported or sold in the country.
Audio player loading… Over 3.5 million active Chinese-manufactured IP cameras are only protected by a vendor’s default password, or lacking protection altogether, putting users at risk of snooping, experts have warned.. New research from CyberNews (opens in new tab) found over 458,000 devices protected only by default credentials operational in…
