Thousands of live cameras stream with no authentication, exposing security risks

As reported by Security Affairs, a significant number of internet-connected cameras are found to be streaming live video without any form of authentication, posing a serious privacy and security risk. The investigation by Mysterium VPN highlights that cheap, budget devices are the primary culprits, often lacking basic security measures.

A recent analysis by Mysterium VPN revealed that over 21,000 live cameras are accessible online without any login credentials or security barriers. While major brands like Hikvision and Dahua have largely addressed this vulnerability by enforcing mandatory password setup, the issue persists predominantly with low-cost devices. These budget cameras, often utilizing protocols like RTSP, act as open conduits, broadcasting feeds to anyone who discovers their IP address. The report indicates that Japan and the United States have the highest number of such exposed feeds, largely due to residential broadband connections. This lack of security is not a result of hacking but rather a failure to implement basic security practices, such as setting unique passwords.

The findings echo the vulnerabilities exploited by the Mirai botnet in 2016, which leveraged default credentials. Despite regulatory efforts to ban default passwords, millions of older devices remain vulnerable, potentially revealing sensitive information about individuals and their routines to strangers.

Source: Security Affairs