Change the factory password on every camera, video recorder and router, update their software, and close the router settings that expose them to the internet. Replace devices the maker no longer updates, or keep them offline.

Cameras that joined an attack

On October 21, a flood of junk traffic swamped a large DNS provider, and for hours some of the best-known sites on the web would not load across parts of North America.

The traffic came from ordinary equipment: security cameras and the video recorders that store their footage, taken over in large numbers. Many were still using the passwords they left the factory with.

Their owners mostly had no idea. The cameras kept recording, the recorders kept showing pictures on the office screen, and nothing looked wrong.

The same kind of equipment watches the till, the door and the stockroom in a great many small businesses.

How a camera is taken over

The second is the whole weakness. Nobody has to be clever to take over a device on its factory login, because the login is printed in manuals and collected in lists that anyone can find.

Why it matters to a small business

A hacked camera is not usually after your business. It is used against others, and the traffic it sends goes out over your internet connection.

A connection busy with attack traffic is slow for everything else, including card terminals and phones that depend on it. An internet provider may also suspend a connection that keeps sending it.

The same open door can let strangers watch the feeds, which show customers and staff, or change the recorder's settings and delete footage you may need.

And the router that let the device be reached often has weaknesses of its own.

List what is plugged in

Start with an inventory: cameras, the recorder, the router, Wi-Fi access points, printers, the alarm panel, a smart thermostat, the television in the waiting room, the phone system.

For each, note who installed it, whether it can be reached from outside the building and where its login details are, if anyone knows.

Include equipment that belongs to someone else but shares your connection, such as the landlord's door entry system or the alarm company's panel.

Many offices find two or three devices nobody remembered, and at least one whose login is still on a sticker underneath.

Change every factory password

Give each device its own long password and keep them somewhere safe, such as a password manager the business controls.

Check for more than one login. Many recorders have several accounts, such as one for administration and one for viewing, and the installer may have added another.

Some older models also have a built-in login that the owner cannot change from the settings at all. Ask the installer or the maker. If there is no fix, that device should not be reachable from the internet.

Close the doors in the router

Remote viewing usually works by having the router pass traffic from the internet straight to the recorder, a setting called port forwarding. Installers set it up, and it stays open long after anyone remembers why.

Many routers also let devices open those doors themselves, through a feature called UPnP, short for Universal Plug and Play. Turn it off unless something specific needs it.

If remote viewing is needed, ask the installer to set it up in a way that does not leave the recorder open to the whole internet, and change the router's own admin password while you are in there.

Updates, and equipment nobody updates

Cameras and recorders run software, and makers release updates that fix exactly these weaknesses. Few owners ever install them.

Check the maker's site for each model, or ask the installer to do it once a year.

Equipment the maker no longer updates should be replaced, or at the least kept off the internet entirely. When buying new, ask how long updates will be provided.

A worked example

A convenience store on a corner in a residential neighbourhood, open until eleven, has eight cameras and a video recorder in the back office.

Four years ago the installer set up viewing on the owner's phone by forwarding ports on the router to the recorder, which kept its factory login. The router's admin password was the one printed on its label.

After last month's news, the owner asked the company that looks after the store's website and email to check.

They found the recorder reachable from anywhere. The store's internet had also been slow in the evenings for weeks, with the card terminal sometimes timing out.

The recorder was restarted, given a new password and updated. The port forwarding was removed, UPnP turned off and the router's password changed.

Remote viewing now runs through the maker's current app with its own login, and the store's guest Wi-Fi is separate from the network the till and cameras use. The evening slowdowns have stopped.

Signs a device is already in use

Unexplained slowness, especially when the business is closed, is the most common sign. So is a router showing heavy traffic overnight, or a letter from the internet provider about unusual activity.

Restarting a device often clears this kind of infection, but one still on its factory password can be taken over again within minutes. Change the password straight after the restart.

The counter-case

Cameras that record to a box with no connection to the internet cannot be reached this way, though the router and everything else on the network still deserve the same check.

A system put in by a careful installer may already have strong passwords and closed ports. Asking takes one phone call.

For everyone else, change the factory passwords, update the software and close what the router leaves open.

Device by device

  1. List every connected device in the building.
  2. Change every factory password to a unique one.
  3. Change the router's admin password.
  4. Turn off UPnP on the router.
  5. Remove port forwarding you do not need.
  6. Update the software on each device.
  7. Replace equipment the maker no longer updates.

Step two closes the door the October attack walked through. Every other step helps, but a device still on its factory login can be taken over by anyone with a list.

What that attack did to the websites at the other end is covered in when a DNS provider goes down.

Frequently asked questions

How were cameras used in the October attack?

Cameras and video recorders reachable from the internet, many still on factory passwords, were taken over and used to flood a DNS provider with traffic.

Why are factory passwords so dangerous?

They are printed in manuals and collected in public lists, and automated programs scan the internet constantly, trying them on every device they find.

Does a hacked camera affect my business?

It sends attack traffic over your connection, slowing everything else, and the same weak access can let strangers watch the feeds or delete recordings.

What is UPnP, and should it be off?

Universal Plug and Play lets devices open doors in your router by themselves. Turn it off unless a specific device in the building needs it.

How can I tell if a device is compromised?

Unexplained slowness, especially after hours, heavy router traffic overnight, or a warning from your internet provider about unusual activity are the common signs.

What about cameras the maker no longer updates?

Replace them, or keep them off the internet entirely. Without updates, any weakness found in them stays open for as long as they run.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

Cameras installed and never checked since?

Tell us what is connected at your premises. We will check the passwords, router settings and updates, and close what is open.

Start a Conversation