Know that whenever you’re in public, it’s likely that you are on camera. Whether you’re caught on the coffee shop’s camera, a neighbor’s security camera, or a red light camera, it’s not guaranteed that these IPs are secured. With so much monitoring taking place, and with surveillance systems gaining more online functionality every year, it’s natural that securing these systems would become more than complicated.
So many cameras and surveillance systems are completely open so it’s possible for anyone with Internet access to watch literally thousands of cameras online using only Google and a 6-year-old’s understanding of the ‘Net.
With a little time and patience, almost any given system, from a set of residential cameras to those used by your local police, can be accessed, viewed, and even reset if not properly secured.
Using the same basic technology that your computer uses, IP cameras take their own IP addresses and stream video directly onto a network without connecting to a DVR or control platform. Once an IP camera is installed and online, users can access it using its own individual internal or external IP address, or by connecting to its network video recorder (or both). In either case, users need only load a simple browser-based applet (typically Flash, Java, or ActiveX) to view live or recorded video, control cameras, or check their settings. As with anything else on the Internet, an immediate side effect is that online security becomes an issue the moment the connection goes active.
Though most NVRs require usernames and passwords for access, many individual cameras do not. An NVR can have the most advanced password imaginable, but if its remote cameras are online and unprotected, anyone with a web browser can completely bypass the system’s security, no hacking required.
Regardless of where a system is installed, if it has any online presence whatsoever, it’s vulnerable. All it takes is patience and some skillful Googling to gain access.
The secret is in the search itself. Though a standard Google search typically won’t find anything out of the ordinary, pairing advanced search tags (“intitle,” “inurl,” “intext,” and so on) with names of commonly-used cameras or fragments of URLs will provide direct links to watch live video from thousands of IP cameras.
For example, a standard Google search for “Axis 206M” (a 1.3 megapixel IP camera by Axis) yields pages of spec sheets, manuals, and sites where the camera can be purchased. Change the search to “intitle: ‘Live View / – AXIS 206M,’” though, and Google returns 3 pages of links to 206Ms that are online and viewable. The trick is that instead of searching for anything related to the 206M, the modified search tells Google to look specifically for the name of the camera’s remote viewing page.
Read More @ arstechnica.com
