Camera security: passwords, firmware and VLANs

There are websites that list thousands of private cameras anyone can watch: living rooms, shop counters, baby monitors, backyards. None of those owners chose to share. Their cameras were found by automated scanning because they were reachable from the internet with a default password or an unpatched flaw. LiveLocation was built as the opposite: we list only cameras that owners and agencies publish on purpose, and our rules ban scanning, imports from such sites and raw camera addresses.

This page is the checklist we would give a friend. It is written for homes and small businesses, and it applies equally to a beach bar’s public webcam and a farm’s gate camera. It is also short on jargon: you do not need to be an IT expert to do any of it.

How cameras actually get broken into

Real-world camera compromises are rarely sophisticated. The pattern is almost always:

1. The camera is reachable from the internet, usually because someone forwarded a port or UPnP did it automatically.
2. A scanner finds it and tries default or common passwords, or a known flaw in old firmware.
3. The attacker watches the feed, posts it publicly, or quietly adds the camera to a botnet.

The 2016 Mirai botnet is the textbook case. According to CISA, it scanned for devices including network cameras and video recorders, logged in over Telnet with a short list of 62 common default usernames and passwords, and used hundreds of thousands of them in massive attacks. In an earlier case, the FTC found that TRENDnet’s cameras sent login credentials in clear text and had faulty software that let anyone with a camera’s address view the feed; about 700 feeds were posted online. CISA’s later Secure by Design alert put it bluntly: default credentials are a top weakness that attackers exploit.

The camera security checklist

1. Keep the camera off the open internet

• No port forwarding to cameras or recorders, and no “DMZ” setting pointing at them.
• Turn off UPnP on the router and in the camera. CISA’s Mirai alert recommended disabling UPnP unless it is essential.
• For remote viewing, use the maker’s app with two-step login or a VPN. For a public stream, push it out to a platform over RTMPS. See port forwarding vs P2P.

2. Use long, unique passwords, and two-step login

• Change every default account on day one, including hidden “user” or “guest” accounts, on cameras, recorders and routers.
• Make passwords long. NIST’s current digital identity guidelines (SP 800-63B-4) require a minimum of 15 characters when a password is the only factor. A passphrase of four or five random words is easy to remember and hard to guess.
• Never reuse a password from another service. A password manager makes this painless.
• Turn on two-step verification for the camera app or cloud account. A stolen password alone then is not enough.
• Use separate accounts for family members, staff and installers, with only the rights they need. Remove them when they leave.

3. Keep firmware and apps updated

• Turn on automatic updates if the camera supports them; otherwise check monthly.
• Update only from the maker’s official site or app.
• Buy from makers that commit to updates. In the UK, the PSTI law in force since April 2024 requires makers of connected products, including security cameras, to publish how long they will provide security updates and to stop shipping guessable default passwords. That support period is worth checking wherever you live.
• Retire cameras that no longer get updates, or at least keep them strictly off the internet.

4. Put cameras on their own network

If a camera is ever compromised, a separate network stops it from reaching your laptops and phones. CISA recommends segmenting networks to limit how far an intruder can move. Options from easiest to most robust:

• Guest or IoT network on a home router, if it isolates devices from your main network.
• VLAN on a business router and managed PoE switch, with rules that block cameras from starting connections to other devices.
• Separate recorder network: cameras connect only to the recorder, and only the recorder talks to the internet (through the maker’s cloud or a VPN).

5. Turn off what you don’t use

• Old protocols: Telnet, FTP and plain HTTP admin pages; use HTTPS for the camera’s web interface where available.
• P2P / cloud if you only record locally.
• RTSP if nothing uses it, or use a dedicated low-privilege account for it. See RTSP explained.
• Audio, unless you need it and it is lawful where you are; see US filming and audio laws.

6. Secure the router and Wi-Fi

• Change the router’s admin password and keep its firmware updated.
• Use WPA2 or, better, WPA3 with a strong passphrase.
• Turn off remote administration of the router from the internet.

7. Think about physical security and privacy

• Mount cameras out of easy reach, so the SD card and reset button cannot be grabbed.
• Aim only at what is yours or at a wide public view; use privacy masks over neighbors’ windows. See cameras and neighbors and privacy by design.
• Delete recordings you do not need.

Choosing a camera that is secure from the box

Security starts at the checkout. Some cameras make the right thing easy; others fight you. Look for:

• Forced password setup: the camera makes you create your own password before it works, with no shared factory default.
• Published update policy: the maker says how long the model gets security updates, and has a page of firmware releases with dates.
• A way to report security problems: a vulnerability disclosure page shows the maker takes reports seriously.
• Two-step login in the app, and the option to turn cloud features off if you do not want them.
• Encrypted connections: HTTPS for the camera’s web interface and RTMPS for streaming.

CISA has urged manufacturers to take ownership of these outcomes, for example by eliminating default passwords altogether, because relying on thousands of customers to change them has not worked. Buying from makers that do is the easiest security decision you will make. For the rest of the buying decision, see how to choose a live camera.

Shared homes, rentals and staff

Cameras are often shared: family members, roommates, a hotel’s front desk, a ski patrol. Give each person their own login with only the rights they need, so you can remove one person without changing everything. When a staff member or installer leaves, remove their account the same day. If you sell or give away a camera, reset it to factory settings and remove it from your app account first, so the next owner cannot see your history and you cannot see theirs.

Risks and fixes at a glance

How to tell if a camera was compromised

Signs worth checking:

• The camera moves, talks or changes settings when nobody in your household did it.
• Unknown user accounts in the camera or app.
• Unexpected traffic: your router shows the camera uploading a lot when you are not watching.
• The app shows logins from places you have never been.

If you see these: disconnect the camera from the network, update its firmware, reset it to factory settings, then set it up again with new passwords, without any port forwards. Change the passwords of the app account and the router too. CISA’s Mirai guidance followed the same pattern: disconnect, reboot, change credentials before reconnecting.

Public webcams: extra steps

If your camera streams to the public, a few more habits help:

• Push, never pull. The public watches the platform’s copy; the camera stays private. See RTMP explained.
• Protect the stream key and the platform account with two-step login.
• Keep the camera’s admin interface on the local network or behind a VPN only.
• Review the frame regularly: no windows, yards, screens or close-ups of people.
• Do not allow public camera control.

When you are ready, submit your camera to LiveLocation. Our review checks that it is a public view published on purpose.

Do these next

1. Check your router for port forwards and UPnP, and remove them.
2. Change every camera, recorder and app password; turn on two-step login.
3. Update firmware and move cameras to a guest/IoT network.

Last reviewed October 7, 2026 by the LiveLocation team. General information, not legal or electrical advice.