3,000 Public Surveillance Cameras - 1 Website

Author: Carlton Purvis, Published on Mar 04, 2014

A new website accesses more than 3,000 surveillance cameras over the Internet. The feeds available on the site include, private homes, school classrooms, hotel lobbies and hospitals. We take a look at the site and discuss potential issues.

The Site

The site is called Live Security Cams. On the top right of the screen it displays how many feeds are available to watch.

The domain was registered last year. The site operator recently announced the site on reddit.

* *** ******* ******** **** **** *,*** ************ ******* **** the ********. *** ***** ********* ** *** **** *******, ******* homes, ****** **********, ***** ******* *** *********. ** **** * look ** *** **** *** ******* ********* ******.

The ****

*** **** ** ********** ******** ****. ** *** *** ***** ** *** ****** ** ******** how **** ***** *** ********* ** *****.

*** ****** *** ********** **** ****. *** **** ******** ***************** *** **** ** ******.

[***************]

Feeds *********

** ***** **** ** **** **** ******** *** ******** ******* -- **** **** *** **** ********* ** ********* ** *** feeds. **** **** * ******. ******** *** ****. ********* ** * ******. ***** *** **** ***** **** ****** ********, *********, *******, airports, ******** *** ******* *****.

**** ** *** **** *********** **** *** **** **** *** actively ***** ********** ** *********, ********* * **** ** **** catches ** ********* ***.**** ****** ***** ********** ** ******* ** **** * ******* ******** in *** *** ******* ***:

**** ****** ** *** ** ** ********* ****, ******* ** *** ******* ** ******* ** ***:



Breaking ****

******** ***** **** ****** *****, ******* ** ******** *** ** socially *****, *** ***’* *********** ***** *** ****. *******, *** the ***** ****** *****.*. ********* ** ******'* *******, ****** ***** ******* ********* ****** ** * ******** ********* of *****, *** *** ********** ******* ***********.

Future ***** *** *** *******

*** ****** **** *** ******* *** **** **** ** ***** to *** * ******* ** ****** ** ******** *** **** remove ******* **** ****** *********** ** ***’* ****. *********, *** camera ********* *** ********* ******* **** ******* *** **** ** coming ****, *** ***** ** ** *** ****** **** ******* to ***. **** ***** ********* *** *****, *******, *** **** of ***** *****, **** *** **** *********** ******* ** *********, once *** ******** **** ** *********, ** *******’* ** **** to **** *** *** *** *** **** **.

Privacy *** ****** ********

****** *** *********** ***** ******* ** ***** **** ******* ******* from ******** **, ********** *********** **** **** ***** ********. **’* *** ***** *** *** ***** *** ***** ********, but ** ***** **** *** ******* *** *** ******** ********* over *** ********, *** ** ******* *** ********.

**** ** **** **** ** *********** ****** ******** ******, *** the **** * **** ****** **** ********** ***** “*****” ** by ******* *** *********** *****. *** ***** ****** **** **** they *********** ********* ***** ******* *** *** **.

Comments (22)

It's amazing how of this stuff is out there. I did a Shodan search for the word "Exacq" and it listed about 30 public IP's - you can use the Exacq Client to log in with the default admin / admin256 creds and have full Admin status with Live Viewing and everything else.

The Black Hat 2013 video you guys posted last week was pretty much the best example of how insecure some of this stuff is though.

The Lorex camera I used as a nannycam forces you to choose a username and password during setup, and won't proceed until you do. Shame on every camera manufacturer that doesn't do the same.

Lorex is a consumer brand, especially with a nannycam product. For that market, it's probably good that the manufacturer forces some security protocol onto the user.

For professional brands, forcing you to change/set passwords on first logins would not be the right thing to do, IMO. It should be safe to assume the installer handles that task as part of a professional install.

As an example, the customer might want to set passwords and not give knowledge to the installer, or the installer might be checking some units beforehand (maybe they are installing 20 cameras, 15 they are familiar with and 5 are new models, so they bench test those to get familiar with them). Forcing password changes arbitrarily shouldn't be neccessary when dealing with a "professional". So, I would not blame Exacq or others for now following that process, I would blame the installer OR the customer, that is THEIR job, not the manufacturers.

While what you say should be true, the fact that we are commenting on a story about a website that automatically finds open cameras which Carlton was able to get into using the default credentials shows that something is still very wrong. It is the installer's job to change the passwords, just like it's my job to change the oil in my car on a regular basis, but my little Nissan still flashes a light at me when I forget to.

Recall our poll on the default password directory report. 21% of IPVM readers say they always use default passwords in production.

Right. Making fun of people who should know better for doing dumb things feels good but doesn't contribute towards solving the problem.

Who's making fun of anyone?

A flashing light is good. The car suddenly going into auto-pilot mode and FORCING you to get an oil change would be bad.

I have to unlock my car and disable the alarm before I can open the door and drive away. It's something of an imposition but I put up with it because it helps prevent auto theft.

You can leave your car unlocked. Locking a car is one's choice. Right? No?

I mean we all don't live in Brooklyn :)

Your analogy is breaking down. Your car is more like the consumer Lorex example.

Look at heavy equipment, things used by professionals. Many of these devices have very weak locks and ignition control devices by default. The user/owner of the equipment knows and understands this and implements a more secure system on their own.

I do not believe manufacturers of pro-grade security equipment should at this time implement FORCED password management schemes.

Well, I see lots of upside and practically no downside to implementing a forced password scheme, but of course reasonable people can disagree.

In the meantime, we'll just see open camera search engines like this every six months or so.

As an example, the customer might want to set passwords and not give knowledge to the installer, or the installer might be checking some units beforehand (maybe they are installing 20 cameras, 15 they are familiar with and 5 are new models, so they bench test those to get familiar with them).

Undisclosed A, how does forcing the choice (not the change) of the admin password on first boot make it harder for the customer to set the passwords? The installer could just set the password to the name of his customer (not recommended of course but 1000x better than the global default) and tell the customer.

Ditto on internal testing, set the password to some global default fo your company. Sure its not the most secure way but if even this were implemented we Carlton's article would be '30 Public...' instead of 3000.

Finally, your opinion of what 'shouldn't be necessary when dealing with a "professional"' indicates you may feel slighted by the arguably ever-eroding stature of the security professional. Yes/No?

I have no opinion on the erosion of the stature of any position, it's not something that deeply affects me one way or the other.

In regards to first-init password management, my concern is with devices that force you to supply unique credentials before you can effectively use them. There are many cases (IMHO) where you might be bringing a device online, but not at the point where you want to go making ANY changes to the default config.

My opinion is that manufacturers should concentrate on building reliable devices with the neccessary set of features and configuration options for their target market, but should leave the customization or personalization of those features and options to the customer's ultimate decision. Especially in the case of security devices, where the customer is presumably purchasing the device FOR enhanced security, its not the manufacturers duty to inflict their opinions on the installation of the product. How far should we take this argument? Should they also enforce strong passwords? Should they enforce regular password changes?

In my experience, this can backfire on the pro side vs. the consumer side. When a consumer installs a camera, they are probably very likely to use a semi-strong password that is unique to them. It might be the name of their dog or child, or a word+number combo they use elsewhere, or something else that is at least mildly unique. Most corporations on the other hand when forced to choose corporate default passwords use fairly weak and guessable passwords, and use them across multiple things. In this case, if you're forcing a tech to change the password, the chance is very high (IMO) that their choice becomes something like Password or Passw0rd, they are going to be inclined to make it a very simple and memorable string because there is a good chance multiple techs are going to be involved with the system, and they'd generally all want to agree on an easy to remember string.

Also, there is much less reason to worry about unique password security during the install/setup of the system. It's when it is turned over to the customer that it makes the most sense to lock things down, but this forced password change at init causes you to make the password decision at the wrong time.

Most corporations on the other hand when forced to choose corporate default passwords use fairly weak and guessable passwords, and use them across multiple things.

This is true, but why argue such a point when even weak passwords, i.e. 'cam2' or 'tommy' are least a magnitude harder than the public defaults, which when port scanning for devices, are the ones always tried and if unsucessful they usually move to the next port.

One can only assume that you would actually prefer that 'pro' devices ship with empty credentials, i.e. blank id, blank password. If not, why not? Your techs wouldn't have to remember the 10 or so pairs of creds.

Maybe next time a mfr. starts prompting to set a password on init, just have everyone set it to the old mfr default password anyway. What do you care if other installers might change it to something more secure?

Could the issue be that having to set the root password on every camera requires one to go to the web page of each camera one by one? Instead of just auto-discovery by the VMS? That's a reason that I could understand...

Leaving password as default isn't that critical if they aren't exposed to the public internet. But anyone who has the knowledge / takes the time to open ports on a firewall should also be competent enough to change the default password.

It would be an interesting business to start a "mini-pen-test" aimed at security systems. IE - you pay XXX $$ to a pen-tester and supply them your public IP and let them go to town. IPVM, do you know if something like this exists?

Scott that does exist. There are a number of cybersecurity companies who do this (Google: white hat security companies), but there are probably even more independent hackers who would do this for you for a fraction of the cost -- you would just have to hope they didn't leave anything behind after the test.

should also be competent enough to change the default password...

Of course they should, but with millions(?) of ip cameras out there, there are bound to be honest mistakes, new employees, non-arecont owners resetting cameras etc. that slip thru the cracks...

And no doubt they 'deserve it' but don't you think its still better for everyone concerned than to allow this flourishing community of vouyers to expand unchecked?

I think their is another answer here. It Is critical because not all poor behavior comes from the internet. There are plenty of large corporate, city, county and state workers on networks who are not and better behaved than the "internet" people. Internal thefts and workplace violence can easily be hidden if these network users can get on to the camera and kill feeds or change presets. No internet required.

Have you come across one that has a website and actually does this specifically targetting IP camera systems?

Solely cameras? But usually cameras are on a long list of devices that when connected to the Internet can target. At Black Hat, Def Con and Shmoocon and a lot of these guys presenting have their own companies, but also work pen-testing for major companies too. Here is a presentation from last month that is worth watching.

Login to read this IPVM report.
Why do I need to log in?
IPVM conducts unique testing and research funded by member's payments enabling us to offer the most independent, accurate and in-depth information.

Related Reports on Privacy

Belgium Bans Private Facial Surveillance on Jul 06, 2018
Belgium has effectively banned the use of facial recognition and other biometrics-based video analytics in surveillance cameras for private,...
GDPR For Access Control Guide on Jul 03, 2018
Electronic access control is common in businesses plus organizations are increasingly considering biometrics for access control. With GDPR coming...
GDPR / ICO Complaint Filed Against IFSEC Show Facial Recognition on Jun 20, 2018
IPVM has filed a complaint against IFSEC’s parent company UBM based on our concern that the conference violates core GDPR principles on...
China Public Video Surveillance Guide: From Skynet to Sharp Eyes on Jun 14, 2018
China is expanding its video surveillance network to achieve “100%” nationwide coverage by 2020, including facial recognition capabilities and a...
Dahua Products Are Not GDPR Compliant, No Products Can Be on May 29, 2018
Dahua products are neither GDPR-compliant nor certified, contrary to their marketing. The reason is that no products can be, as the EU does not...
Amazon's "Dangerous New Face Recognition Technology" Says ACLU on May 23, 2018
The ACLU has caused a stir, with a new report Amazon Teams Up With Law Enforcement to Deploy Dangerous New Face Recognition Technology,...
Genetec Clearance Face Detection / Redaction Test on May 14, 2018
Privacy regulations such as GDPR (EU Public Privacy), HIPAA (US Medical Privacy), and FERPA (US Student Privacy) are driving video surveillance...
Global Real-Time Video Surveillance - EarthNow on Apr 20, 2018
A new company, EarthNow, with backing from Bill Gates, Airbus and more, is claiming that: Users will be able to see places on Earth with a delay...
GDPR For Video Surveillance Guide on Apr 12, 2018
The European Union’s General Data Protection Regulation (GDPR) comes into force on May 25, but there is much confusion and no clear guidelines on...
VMS New Developments Spring 2018 (Avigilon, Exacqvision, Genetec, Hikvision, Milestone, Network Optix) on Apr 04, 2018
What's new with VMS software? In this report, we examine new features and releases for Spring 2018 to track different areas of potential...

Most Recent Industry Reports

Alexa Guard Expands Amazon's Security Offerings, Boosts ADT's Stock on Sep 21, 2018
Amazon is expanding their security offerings yet again, this time with Alexa Guard that delivers security audio analytics and a virtual "Fake...
UTC, Owner of Lenel, Acquires S2 on Sep 20, 2018
UTC now owns two of the biggest access control providers, one of integrator's most hated access control platforms, Lenel, and one of their...
BluePoint Aims To Bring Life-Safety Mind-Set To Police Pull Stations on Sep 20, 2018
Fire alarm pull stations are commonplace but police ones are not. A self-funded startup, BluePoint Alert Solutions is aiming to make police pull...
SIA Plays Dumb On OEMs And Hikua Ban on Sep 20, 2018
OEMs widely pretend to be 'manufacturers', deceiving their customers and putting them at risk for cybersecurity attacks and, soon, violation of US...
Axis Vs. Hikvision IR PTZ Shootout on Sep 20, 2018
Hikvision has their high-end dual-sensor DarkfighterX. Axis has their high-end concealed IR Q6125-LE. Which is better? We bought both and tested...
Avigilon Announces AI-Powered H5 Camera Development on Sep 19, 2018
Avigilon will be showcasing "next-generation AI" at next week's ASIS GSX. In an atypical move, the company is not actually releasing these...
Favorite Request-to-Exit (RTE) Manufacturers 2018 on Sep 19, 2018
Request To Exit devices like motion sensors and lock releasing push-buttons are a part of almost every access install, but who makes the equipment...
25% China Tariffs Finalized For 2019, 10% Start Now, Includes Select Video Surveillance on Sep 18, 2018
A surprise move: In July, when the most recent tariff round was first announced, the tariffs were only scheduled for 10%. However, now, the US...
Central Stations Face Off Against NFPA On Fire Monitoring on Sep 18, 2018
Central stations are facing off against the NFPA over what they call anti-competitive language in NFPA 72, the standard that covers fire alarms....
Hikvision USA Starts Layoffs on Sep 18, 2018
Hikvision USA has started layoffs, just weeks after the US government ban was passed into law. Inside this note, we examine: The important...

The world's leading video surveillance information source, IPVM provides the best reporting, testing and training for 10,000+ members globally. Dedicated to independent and objective information, we uniquely refuse any and all advertisements, sponsorship and consulting from manufacturers.

About | FAQ | Contact