How to secure security cameras from hackers

01Can security cameras be hacked?

Yes. An IP camera is a small computer: it runs firmware, has a login, listens on the network and, in many systems, talks to the internet. The recorder is another one, and so is the router between them and the street. Anything with a login and a network connection can be taken over when the login is weak or the software has a flaw nobody fixed. Older analog cameras on coax have no login of their own, but the DVR that records them does.

The public record shows how it happens:

• 2016, default passwords. CISA's alert on the Mirai botnet (TA16-288A) found it had infected "primarily home routers, network-enabled cameras, and digital video recorders" using a short list of 62 common default usernames and passwords. The devices were then used in denial-of-service attacks that flooded websites with traffic.
• 2013, faulty software. The FTC settled with a maker of internet-connected home security cameras whose faulty software left the cameras open to online viewing. Links to live feeds from nearly 700 cameras were posted online, and the company had sent login credentials over the internet in clear, readable text.
• 2023, makers told to stop. CISA's Secure by Design alert on default passwords says that "relying upon thousands of customers to change their passwords is insufficient" and asks makers to ship a unique password with each product. Until every product does, changing them is the owner's job.

For a building, a takeover can mean someone watching your entrances or staff live, recordings downloaded or deleted, or a foothold for reaching the office PCs. Figure 1 marks the six places it starts in the example building.

02Change every default password, and make it long

Every device with a login gets its own password: the recorder, each camera and the router. Cameras keep their own login even when you only ever see them through the recorder, and a camera left at its factory password can be reached by anything on its network. Some recorders set a password on each camera as they add it; check that none are left at the factory value. Then turn off the guest, operator and demo accounts that come enabled and that nobody uses.

NIST's digital identity guidance, revised in 2025 as SP 800-63B-4, sets these rules for systems that check passwords:

• At least 15 characters for a password used on its own. Eight is the floor when the password is one of two factors, such as a password plus a code on your phone.
• No forced symbol rules. Systems should not require a mix of character types; length and randomness count for more.
• No scheduled changes, but change it at once when there is any sign it has been exposed.
• Refuse known passwords: anything on lists of common, expected or breached passwords.

CISA's Cybersecurity Performance Goals ask for the same 15-character minimum. Eighteen long passwords for 16 cameras, a recorder and a router are a job for a password manager, with the owner of the system holding the vault.

If a camera or recorder will not accept a 15-character password, use the longest it takes, keep that device off the internet entirely, and put it on the list to replace.

03Give each person a login, and remove people on their last day

A common setup is one admin login that the owner, the manager, the porter and the last installer all know. It never changes, because changing it locks everyone out at once. So the person who left last year can still sign in from home.

CISA's performance goals put it in three lines: unique credentials for each person (2.C), credentials revoked by the day an employee departs (2.D), and no everyday account that always has administrator rights (2.E). On a camera system that means:

• One owner account, held by you, with two-step sign-in, used only to manage users and settings.
• A login for each person, with only the rights the job needs: a store manager gets live view and playback for their own cameras, a bookkeeper may only need playback of the register camera, and few people need to export clips or change settings.
• An installer service login that you can switch off, never the owner password. At handoff, the owner account and every admin password belong to you.
• A removal step in your offboarding list, next to the door credential and the email account. Our office security checklist lays out the whole offboarding day.

Read the user list on the recorder and in the app on a set schedule and remove any login you cannot put a name to. For several locations, our guide to remote video surveillance across multiple sites shows how rights by site and by role are set up.

04Put security cameras on their own network (VLAN)

On a flat network every device can reach every other one. The guest phone in the shop, the office PC that opened the wrong attachment and the register can all reach every camera's login page, and a camera with a flaw can reach them back. Segmentation keeps each group on its own network so that traffic between them passes through firewall rules you wrote.

A VLAN is a separate network carried on the same switches and cables, kept apart by the switch and the firewall. A separate camera switch with its own cables does the same job with more hardware. Either way the rules for the camera network are short, and CISA's goal 2.F states the principle: every connection is denied unless it is explicitly allowed.

• Cameras talk to the recorder, and to nothing else.
• The recorder talks out to the maker's update servers and, if you use one, the relay for remote viewing. Nothing else on the internet.
• One admin PC, or the recorder's own monitor, can reach the camera network for setup.
• Office PCs, registers and guest Wi-Fi cannot reach the camera network at all.

In a mixed-use building the shop, the offices and the building's own systems often share one telecom closet and sometimes one internet line. They can still be kept apart: separate VLANs on a managed switch, or separate switches, with the firewall between them. Segmentation also covers the cable at each exterior camera: whatever is plugged into that cable lands on the camera VLAN, not the office network. Our networking work covers the switches, VLANs and firewall rules, and our structured cabling work covers the labeled cable and patch panels that make the network drawing match the building.

Figure 3 shows the example building both ways, with the three ways to view the cameras remotely from section 05.

05View cameras remotely without opening a port

The quickest way to see cameras from a phone is a port forward: a rule on the router that sends traffic arriving from the internet straight to the recorder. It works, and it puts the recorder's own login page and every flaw in its firmware in front of everyone online, at every hour. UPnP, a router feature that lets devices open ports for themselves, can create the same opening without anyone choosing it. CISA's Mirai alert says to disable UPnP on routers unless it is absolutely necessary, and its performance goals say internet-facing assets should expose no exploitable services (2.W).

Two safer ways do the same job:

A cloud relay from the camera maker

The recorder keeps an outbound connection to the maker's service, and your phone meets it there. Nothing on the internet can start a connection to the building. You are now relying on the maker's cloud and on the app account, so turn on two-step sign-in for every person on it and use a password used nowhere else, as the FTC advises for camera accounts. If the system also records to the cloud, our comparison of cloud storage and a local NVR or DVR covers where the video lives and what it needs from your internet.

A VPN into the building

Your phone first joins the building network through a VPN on the router, with its own login for each person, and only then reaches the recorder. The recorder stays invisible to the internet. The VPN becomes the one door, so it gets the same care as the recorder: current firmware and strong logins.

Whichever you use, the FTC's guidance for camera owners adds three checks: the camera feed should be encrypted, a browser login page should start with https, and a camera that lets you turn remote viewing off entirely is worth having where nobody needs it. The FTC also advises turning off remote management on the router itself.

To check your own system, read the router's port forwarding and UPnP pages, or ask whoever manages it. A forward pointing at the recorder or a camera comes off once a relay or VPN works.

06Keep firmware updated, and know when support ends

CISA's advice in the Mirai alert is plain: "Update IoT devices with security patches as soon as patches become available." That covers the recorder, each camera, the router, the camera app and the phones it runs on. CISA's goal 1.E adds that known exploited flaws in anything facing the internet are patched or otherwise mitigated, most critical first.

• Get firmware only from the maker, through its own website or the recorder's built-in update tool, and sign up for its security notices. The FTC suggests registering with the maker so updates reach you.
• Plan the restart. Devices reboot to update. Afterward, check that the clock is right and every camera is recording again.
• Write down the schedule, for example a check each quarter and an extra one whenever the maker issues a security notice, with the version each device runs.
• Ask how long updates last. A maker should state how long it will publish security updates for a model. Since April 29, 2024, UK rules have required makers of consumer connected products to publish that period; it is a fair question to ask of any camera you buy. (General information, not legal advice.)

A camera the maker no longer updates keeps every flaw found after its last release. Keep it behind the camera VLAN with no internet access at all, and plan its replacement. Our guide to how long security systems last covers when replacement makes more sense than repair.

07Lock the hardware and keep the records

Software settings assume nobody can walk up to the equipment. The recorder holds every recording and has a reset button; the PoE switch powers every camera. Both belong in a locked room or cabinet, with unused switch ports turned off and the recorder's monitor set to sign out when nobody is using it. Exterior cameras go high enough, and with their cable protected, that nobody can unplug them without a ladder.

Keep the records that let you check all of this later:

• A device list: each camera, recorder and switch with its model, location, IP address and firmware version. CISA's first goal (1.A) is an inventory of every device with an IP address.
• The network drawing and the firewall rules for the camera network.
• The user list, and where the admin passwords are held.
• The recorder's own log of sign-ins and setting changes, kept long enough to look back on. CISA's goal 2.T asks for access logs to be collected and stored.

Our guide to evaluating a security installer before hiring lists what the full handoff folder should contain.

08How to tell if your security cameras have been hacked

A camera used by someone else often looks normal on screen. The signs show up in the logs and the settings:

• Sign-ins in the recorder's log or the app's device list that nobody can explain, at odd hours or from unfamiliar places.
• User accounts nobody created, or passwords that suddenly stop working.
• Settings changed: recording schedules, motion zones, the time, or a new port forward on the router.
• Recordings missing or deleted, or a camera that moves or zooms with nobody at the controls.
• A sign-in alert from the maker for a phone you do not know, or a recorder suddenly sending far more data out than your own remote viewing explains.

What to do

1. Cut the internet path. Remove the port forward, or disconnect the camera network from the router. The recorder keeps recording; only remote viewing stops.
2. Save what you need first. Export any clips you must keep and write down what you saw and when, before you change settings.
3. Change every password, starting with the owner account, the app account and the router, and remove every user you cannot name.
4. Update the firmware, and reset any device you no longer trust. A factory reset can bring the factory password back, so set a new one before the device goes back on the network. CISA's alert gives the same order for an infected device: disconnect it, reboot it, change the password, then reconnect.
5. Bring remote viewing back through a relay with two-step sign-in or a VPN, never the old port forward.
6. Ask about obligations. If video of people or business records may have been exposed, talk to your attorney and your insurer. This is general information, not legal advice.

09How to secure security cameras from hackers: the checklist

Figure 4 turns this guide into twelve questions about your own system. Each answer is weighted by how directly the gap is reached from outside: the high-weight items are the ones in the public incidents above. It starts with the example building as found; clear it and answer for yours. Nothing you click leaves this page.

10Questions to ask your installer about camera security

Bring these to any proposal for a new security camera system, including ours, or to whoever maintains the one you have.

1. Will the recorder and every camera have their own password, and who holds them at handoff?
2. Will any port be forwarded on our router? The answer should be no.
3. How will we view the cameras remotely: a relay, a VPN or something else? Does two-step sign-in work for every user?
4. Will the cameras be on their own VLAN or switch, and what firewall rules will you set?
5. What firmware will each device run at handoff, and how will updates happen after you leave?
6. How long does the maker publish security updates for these models?
7. Will each person get their own login, with only the rights they need?
8. Will we get a device list with models, IP addresses and firmware versions, and a network drawing?
9. If you keep a service login, what can it do, and how do we switch it off?

For a building where tenants and the owner share cameras, our guide to commercial video surveillance for NYC office buildings covers who owns and views each camera. To review an existing system or plan a new one with these settings from the start, contact Seneca Security.

11Security camera hacking questions

Sources

• CISA alert TA16-288A"Heightened DDoS Threat Posed by Mirai and Other Botnets," October 14, 2016, revised 2017. Devices infected, the list of 62 default username and password pairs, and the mitigations: change default passwords, update, disable UPnP, and disconnect and change the password on an infected device.
• CISA Secure by Design Alert"How Manufacturers Can Protect Customers by Eliminating Default Passwords," December 15, 2023.
• CISA Cross-Sector Cybersecurity Performance GoalsGoals 1.A asset inventory, 1.E known exploited vulnerabilities, 2.A changing default passwords, 2.B minimum password strength of 15 characters, 2.C unique credentials, 2.D revoking credentials of departing employees, 2.E separating user and privileged accounts, 2.F network segmentation, 2.H multifactor authentication, 2.T log collection, 2.W no exploitable services on the internet.
• NIST SP 800-63B-4Digital Identity Guidelines: Authentication and Authenticator Management, 2025. Password length of at least 15 characters used alone and 8 with a second factor, no composition rules, no periodic changes, blocklists of known passwords.
• NIST IR 8259AIoT Device Cybersecurity Capability Core Baseline, May 2020. The device capabilities a buyer can look for: identification, configuration, data protection, logical access to interfaces, software update and cybersecurity state awareness.
• FTC consumer advice"Using IP Cameras Safely" and "How To Secure Your Home Wi-Fi Network": default passwords, two-factor authentication, updates, encryption, disabling remote viewing and router remote management.
• FTC press release, September 4, 2013Settlement with a marketer of internet-connected home security video cameras over faulty software that left cameras open to online viewing.
• UK Product Security and Telecommunications Infrastructure regimeIn effect April 29, 2024: unique or user-set passwords, a way to report security issues, and a published minimum security update period for consumer connectable products.
• Figure 2 mathPossible passwords = characters available raised to the length. 95 printable keyboard characters, 26 lowercase letters, 62 letters and digits, 10 digits; 7,776 words for the word list example.