I checked all 6 cameras in my home one by one. The most dangerous holes were made by the cameras themselves.

My daughter-in-law was browsing short videos two days ago and came across an investigative report about secretly filmed by a camera. After watching it, she handed her phone to me.: Will the six heads of our family be looked at like this? I don't think so, they are all regular brands. Having said that, I still went through the 6 heads one by one that night - I don’t know if I don’t check, and my palms were sweating at the end of the check.: The biggest hole is not the password, but a door that the POE camera in the yard quietly opened on the router.

Let’s explain everything clearly first. The article my daughter-in-law saw was not made up by self-media. In December 2021, CCTV exposed the black industry chain of secretly filming cameras. The scene of someone taking a shower was watched by hundreds of people without the person involved knowing. To put it bluntly, the black production method is stupid but very effective.: Use software to scan the cameras on the public Internet in batches, and then use a dictionary to blast weak passwords, such as admin, 123456, and 888888, in one round. It was later reported that the cracked images were sold in packages for NT$260, which allowed "permanent viewing". So it’s nothing to panic about, but it’s worth spending half an hour checking.

Let’s talk it through first: There are only three ways for others to look at your camera

Putting all the cases together, there are only three entrances to the cameras at home.

The first one is in the cloud. The manufacturer's account and password bound to the camera are too weak. Unscrupulous manufacturers use dictionaries to access the manufacturer's App interface to access the database. If they open it, they will get all your images and share them with you. The second one is the port. In order to watch the surveillance on the external network, someone exposed the camera's 554 port (RTSP streaming port) to the public network through port forwarding or UPnP. An address starting with rtsp://username:password@yourIP:554 can directly pull the screen away. If the username and password are still the same as the ones shipped from the factory, it means the door is not locked. Hikvision's port 8000 had an authentication bypass vulnerability, CVE-2017-7921, which was exploited on a large scale that year. Article 3 is the most unfair: When you buy a second-hand camera, the original owner’s account is not unlinked. If you install it at home, you can still see it in the previous owner’s app.

There are 6 heads in my house. The one using cloud storage at the door occupies the first road. The five POE heads in the yard are connected to video recorders and occupy the door of the second road. The following is the order in which I checked.

first step: Check the cloud account, this is the favorite door for black people

The cloud storage camera at the door was installed in 2022, and the account password was set casually at that time, just like the house number and birthday. This kind of password is no different from 123456 in front of the dictionary. I directly changed it to a 16-digit random string, saved it in the password manager, and turned on all verification methods along with the account bound to the mobile phone number.

Two places that are easy to leak. The first is device sharing or family member list in the App - for convenience, I shared the camera with my wife's account at first, but then I changed my phone, and there is still an old account that has been canceled long ago in the sharing list. All shares that are not needed will be deleted. The fewer people who can see the screen, the better. The second is to log in to device management. Apps from regular manufacturers have this column. You can see which mobile phones have logged into this account. Unfamiliar devices can be directly logged off and the password needs to be changed. The off-site login reminder function has been conveniently turned on. If the account is logged in in a strange place, you can know it as soon as possible.

After checking this step, the door to the cloud is finally closed. By the way, if you can enable two-step verification for your account, it will be useless no matter how big the dictionary is for one-step verification.

Step 2: Check the router, I got cold sweat at this step

Second station router. My home uses optical modem bridging and AX3000T dial-up. Go to the 31.1 background and first look at the port forwarding in the advanced settings - it is empty, which is in line with expectations. I opened one when I was tossing about NAS remote control two years ago, but later deleted it when I changed to another solution. I have done this in Router and VPN to go home remotely I wrote in that article that I have stopped taking the path of port forwarding a long time ago.

The real problem is in the UPnP mapping list. UPnP is a protocol that allows LAN devices to automatically open the door on the router. I clicked on it and saw an item in the list.: The POE head in the yard registered the mapping of port 554 on the router. In other words, the "UPnP automatic port mapping" in the camera firmware is turned on by default. It opened the door on its own the year it was installed. I have not known it for three years since it was used. To determine whether this door is really exposed to the public network, it depends on whether your home broadband There is a public IP ： The WAN port is a shared port that starts with 100.64. If it cannot scan you, it is a blessing in misfortune. ； If you have a real public IP, this hole will be hanging on the Internet waiting for people to scan it.

Three steps to process: Delete this mapping in the router ； The camera firmware turns off UPnP automatic mapping in the background, otherwise it will be registered again if you delete it. ； If you find it troublesome, you can simply turn off the UPnP main switch of the router. I will write down the costs and trade-offs in Should UPnP be turned off? In that article, there are no game consoles or NAS at home that need to automatically drill holes, so turning them off is the most worry-free. As for what port forwarding itself is and why external ports use high bits, The difference between port forwarding and DMZ That article was detailed.

Step 3: Check the camera itself, default password and stop updating firmware

The third stop is to enter the web background of the camera one by one. Enter the camera's IP in the browser. Two of the five POE headers still have factory passwords. The username is admin and the password is 123456. This kind of password, combined with the 554 port above, is the best one in the black product list. All are changed to 16-digit random strings, and each header is different - if it's troublesome, at least don't let two computers share the same password. If one leaks, the whole line will be compromised.

Check the firmware version easily. Four of the six heads can be upgraded online to the latest ； There is an old model, and the manufacturer has not released firmware for three years. This kind of head is either disconnected from the Internet and used for purely local recording, or moved to an insensitive position. A device that stops updating is like an old man who stops taking medication. Vulnerability patches will never come again. In addition, for families that do not need to use third-party software to pull streams, it is enough to turn off the ONVIF and RTSP services in the background of the camera. It is enough for the video recorder to use the manufacturer's private agreement to stream, thus opening up one less service and one less entrance.

By the way, Use an old mobile phone to modify the monitoring system On the contrary, there are no classic entrances such as 554 and 8000. It uses the cloud channel of the App. The path of the scanned port naturally does not exist, which is an unexpected advantage of the native method.

Step 4: Check the location, this step is more important than the password

After checking technology, check physics. I went through the directions of the 6 heads one by one.: Look outside the door, look outside the courtyard, and avoid the diagonal line of the living room from the sofa, all of which are in compliance. Make a rule here: Bedrooms, bathrooms, and any place where the bed and changing clothes can be photographed can be vetoed with one vote. No matter how good the password is, it can't save the wrong location. In the case of cloud leakage, the most hurtful thing is never the picture of the gate.

Two physical fool-proof actions are more reliable than any other encryption. One is to turn the gimbal to the corner when not shooting, and close the physical shielding film. ； The second is to check for signs of operation - the PTZ camera rotates by itself in the middle of the night, a rotation command that you have not done appears in the App's operation record, and a strange device appears in the login record. If any of these three appear, cut off the power first and then change the password. Don't hesitate.

Step 5: Things you must do before buying a second-hand camera and the finishing sequence

If you are planning to buy a second-hand camera, there is one step you need to take before paying.: Ask the seller to unbind the device in his app in person, and then bind it with your own account. If the binding fails, most of the time it will be locked under someone else's account. You should especially ask questions about carrier-customized machines and project-specific machines. Some of them cannot be untied at all, so don’t buy them for free. After buying it, restore it to factory settings first, and then follow the five steps above.

I checked the finishing moves, there are five in order.:

It took about forty minutes to complete the entire search. What is the final conclusion of the 6 heads in my family?: There is no way of knowing whether the scene has been seen, but the entrance is completely blocked. If you have a lot of surveillance at home, you can go one step further and isolate devices such as cameras to a separate network segment. Even if someone is infected, your NAS and computer will not be able to be touched. Here is how to do it VLAN for home network In that article. As for how to plan the points and route the POE before installing the monitoring system, Monitoring network planning That article is old ground ； How many days can the video be stored? How to configure the hard disk? See This article That’s it.