Hack in the Box Swiss researcher Gianni Gnesa says the most popular network surveillance cameras currently sold on Amazon contain easy remote exploitable vulnerabilities that allow hackers to gain admin access and quietly peer through lenses.
The consultant for Zurich-based Ptrace Security found holes in pricey IP cameras sold on the shopping site for up to $600.
Each camera vendor made claims about the high security integrity of its hardware, yet all were found to be hackable over the internet.
Some sport hardcoded and therefore unchangeable credentials, others undocumented backdoors, and operate over insecure protocols like telnet.
For one of the models Gnesa tested, some 30,000 machines can be found using the Shodan device search portal.
An unnamed vendor caught up in the research hit Gnesa with a legal threat after he prepared to present his work at the Hack in the Box conference in Singapore next week.
The hacker then canceled his talk.
Gnesa describes his work to Vulture South revealing that it is possible to crash and compromise the cameras.
"I've analysed several IP cameras and they all had some weaknesses that could all you to shut down the camera, freeze the video stream, or get access to the admin panel," Gnesa says.
"The cameras that I selected are all popular mid range cameras that you can find on Amazon [which] I chose because they all had a good rating and claim to be secure.
Gnesa says each camera has more than 1,500 largely positive customer reviews.
At least one is in use in retail stores.
He reckons his exploits could likely be made persistent to survive camera reboots with a little effort since a shell would not be difficult to pop with the afforded admin access.
Users in possession of cameras with hard-coded credentials, everything-as-root policies, and backdoors may need to bin their units or demand updates to lock down their devices.
Others may be able to apply updates and should change default passwords and disable insecure protocols.
Home security kit has been compromised before. Canberra malware destroyer Silvio Cesare developed a $20 gadget in 2013 that popped home alarm units and various fixed-code radio frequency security systems.®