40k? Impressive resolution.
this post was submitted on 10 Jun 2025
146 points (96.8% liked)
Technology
71269 readers
4561 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related news or articles.
- Be excellent to each other!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
- Check for duplicates before posting, duplicates may be removed
- Accounts 7 days and younger will have their posts automatically removed.
Approved Bots
founded 2 years ago
MODERATORS
For the Emperor!
Those cameras are there since 90s I remember watching them in ActiveX in real media player plugin in IE. Nothing changed.
Shodan.io is the searchable index of open IoT devices.
Change the default password, people!
Hard-coded default passwords have been illegal in California since 2020, so it shouldn't be as much of an issue with newer devices. Companies aren't going to make California-specific versions of their devices, so they'll often just follow the California standards everywhere.
To be legal in California, the device either needs to have a randomly-generated password unique to that device (can be listed on a sticker on the bottom of the device, or in the manual), or it needs to prompt to set a password the first time you use it.
I still wouldn't ever expose a camera directly to the internet. Keep it just on your LAN (eg using a VLAN) and VPN in (eg using Tailscale) to connect to it remotely.
Yes, but no one checks the legality of cheap Chinese devices from Amazon.
Also cheap cameras also tend to ship with a number of x-day vulnerabilities.
It's usually fine if you stick to a good well-known brand, but there's some cheaper cameras that are bootleg clones of other brands, that can't run the latest upstream firmware so they're stuck on a hacked/modified version of older firmware.
The good Chinese brands, if they do have a hard-coded password, usually make you change it on first login. I'm pretty sure newer Hikvision and Dahua models do this (plus their resellers/rebrands like Amcrest, Lorex, Annke, etc). You need to pay more than the garbage brands, but they're worth it.
Of course, there's all sorts of junk on Amazon that don't follow any sort of standards.
Can't remember when it came into effect, but randomized device specific passwords are also mandatory in the EU now. This was relatively recently though. It means every single device (item, not model type or class) has to have an individual password (also usually it's on a sticker or something).
And yes, connecting any ip camera to the Internet is just dumb.
40K?
Praise the Omnissaiah!
It would be nice to know what brands or models are most vulnerable.
What this is talking about is not really about the brand or model, its just about them being misconfigured. These cameras were exposed to the internet with either default credentials or no authentication.
Theres very few good reasons to expose a camera to the internet at all, just access it over a VPN. If for some reason someone really needs to access it over the internet (I genuinely cannot think of any), then they should put some proper authentication in front of it.
An IP camera may stay in use for a decade or more without any firmware updates. You shouldn't trust any sort of authentication that's built into the camera to be secure. Keep them on an isolated LAN and only allow access from the server that's running the DVR software.
Any camera you expose to the internet with no protection is vulnerable. The issue is just that they're accessible over the internet without a password.
Follow best practices by keeping your cameras on a separate VLAN that's isolated from the internet, and you'll be fine. Use a VPN like Tailscale to view your cameras while away.
Even when they are protected, when did they receive the last update? There are probably so much more vulnerable IoT devices.