PSA: Your Wi-Fi Camera Could Stream Worldwide

If you’re still using old Wi-Fi security cameras around your home, they may be streaming directly to the internet where anyone can watch you.

Old security cameras are a privacy nightmare

You may have noticed security cameras in the news lately due to various privacy debacles like eufy’s cameras allowing unverified streaming. Then, of course, there was the other debacle with Wyze cameras. Even robot vacuum cleaners with their roving camera eyes have been getting bad press lately.

While the issues with current hardware are worth mentioning, what we’re focusing on today are older security cameras. There are thousands and thousands of old Wi-Fi security cameras from the 2000s and 2010s in use around the world.

Not only are these older Wi-Fi IP security cameras well out of their lifecycle – and therefore not receiving any security updates – but many of them were never set up properly in the first place.

It might seem like an abstract issue that you can easily eliminate, like running an old laptop with Windows 7 or using an old iPad that can’t get the latest iOS updates. But in reality, it is a real-world problem with direct privacy implications.

If your Wi-Fi security cameras are not set up correctly, anyone can connect and watch them. Not highly skilled hackers, not bored high school kids running scripts they found on dodgy websites or forums, anybody. In fact, some websites, like Insecam, scour the internet for open security cameras and catalog them. Anyone can visit the website and watch the cameras – no security expertise required.

While many of the cameras found at these sites are extremely annoying, such as municipal cameras pointed at plow parking lots or dock cameras set up so anglers can see the weather on their public boat ramp favorite, a surprising number of them are clearly cameras. intended for private use.

Although these sites, thanks to bad press over the years, have gotten better at filtering out things like unsecured baby monitors, cameras in living rooms, etc., it’s still a problem. And just because the site filters out the privacy-violating camera doesn’t mean the privacy issue doesn’t persist – they don’t secure the camera for the person. They just stop displaying it on the page.

For example, browsing through the Insecam archives, we came across hundreds of examples of a specific older Linksys Wi-Fi camera, the popular WVC80N. Not only is it problematic that you can watch the feed from someone’s backyard or even inside their house, but you can also directly access the unsecured dashboard of the camera itself. This is the dashboard of a Linksys WVC80N camera located in central Ohio.

Although I know the feed was a live camera feed, I admit I was surprised when I saw the postman walk right past the camera to deliver the mail.

It was equally surprising to see people walking around their kitchens, living rooms and backyards. All because their old IP-based Wi-Fi security cameras weren’t properly secured.

In many cases, you can even access unsecured cameras and control them directly, using pan and tilt controls as if you owned the camera.

Worse still, you’ll often find separate information in the video feeds (or attached metadata) that helps focus on camera location. For example, while looking at the cameras for this article, I came across a security camera named after the location of the road the house was on.

Since I had the approximate geo location based on the IP address and the route had a distinct name that only appears once in whatever state the IP address was in, it took less than a minute to go from looking at the camera to looking at the home on Google Street View. I was also able to locate several cameras in towns I knew better simply by using the map feature on the Insecam website while searching for familiar streets and landmarks.

This highlights one of the worst things about this little experiment and writing this article. There’s no way to tell the camera owner that their camera isn’t secure, except for rare moments like the one I just highlighted. And even then, my only option to alert them would be to send a very scary letter to their physical address. “Dear Sir or Madam, I found an internet camera pointed at your living room, and I tracked you down to anonymously alert you to the situation…”

Here’s what to do with your old Wi-Fi IP cameras

So what should you do if you have old, outdated security cameras? You need to do one or more of the following things to ensure that you don’t accidentally broadcast your life to the entire internet over an unsecured IP camera connection.

Get rid of your old Wi-Fi cameras

Remove your old cameras. There’s no reason to keep using a Wi-Fi security camera that’s over 10 years old that no longer receives updates.

It’s not worth putting up with poor video quality (almost every security camera we could access had a sparse 640×480 pixel stream). And it’s not worth bearing the security risks and vulnerabilities.

Camera technology has advanced so much over the years that there’s no reason to use a security camera with a worse image than your old laptop’s built-in camera. So reset your old Wi-Fi IP cameras and send them in for recycling.

Isolate your new Wi-Fi IP cameras

If you are replacing your older Wi-Fi IP cameras with newer updates, you should do everything possible to isolate them to your home network.

This means looking for settings in the firmware of the camera itself to restrict access to only local connections (if such a setting is available), then further isolating the camera by configuring rules at the router level to prevent traffic from this IP camera to leave your local network. .

If you’re lucky, your router’s firmware has a user interface that lets you easily assign a static IP address to your Wi-Fi IP cameras and then restrict outbound traffic for that IP address. If you’re not, you’ll probably have to get your hands dirty (and possibly upgrade your router to access the more advanced features you need).

Completely bypass Wi-Fi IP cameras

If the idea of ​​setting up custom route tables seems daunting and beyond your pay grade, you might consider skipping Wi-Fi IP cameras altogether and opting for an option that requires less self-management. Options like Nest or Ring cameras come with automatic updates and a secure link between your home cameras and the outside world (for those times when you want to check cameras away from home).

Although there is a compelling argument for sticking with outdoor cameras only to monitor your property and ignoring indoor cameras for privacy reasons. Every system has a point of failure: if it fails, it’s better that the world can see your trash cans and your unmowed lawn, not your room or your baby.