Alert: Avoid These Security Cameras Like the Plague

Two more low-priced security cameras have been found to have serious security flaws, according to a written report from Israeli information-security business firm Checkmarx.

(Image credit: The VStarcam C7837WIP. Credit: VStarcam)

The Loftek CXS-2200 and VStarcam C7837WIP, which look about identical, independent more than a dozen vulnerabilities between them, many of which would let an attacker accept over the camera from the internet.

"The vulnerabilities merely kept on coming," the report notes. "A malicious user can exploit your device to rails your mean solar day-to-day, know when you lot're domicile or out, steal your email information, steal your wireless connectedness, gain control of other connected devices, use your photographic camera as a bot, listen in to your conversations, record video, and more than."

"It is clearly worth spending a flake more than coin on a more than secure camera," the report adds.

We tin't put it meliorate; in our experience, it's non worth ownership a sub-$100 dwelling house security camera as you'll likely exist making your home less secure overall.

If y'all do have one of these models higher up, make sure it's behind a 2-way network firewall, and expect over the documentation to see if there's a way to modify the default username and countersign.

More than: Best Wireless Security Cameras

Final fall, a massive botnet of internet-connected DVRs and security cameras (though probably not home models) disrupted internet connections in parts of North America. The Checkmarx researchers called the two cameras "fertile ground" for a rerun.

"If your camera is continued, you're definitely at take chances," the Checkmarx report said. "It'south as uncomplicated as that."

The VStarcam sells for between $25 and $50 online. The Loftek model is available used on Amazon for $99.99, just other sites indicate that a new model costs between $60 and $70.

Both models seems to run very similar software, which Checkmarx said was called Netwave IP Camera. A global browse using the Shodan search engine turned upwardly one.2 one thousand thousand devices running that software facing the internet. It'due south likely that many times more are being used behind firewalls and on internal networks.

Both cameras apparently had the default username, "admin", and default password, "123456", printed on a sticker on their bases. Many cameras suggest that you alter those credentials after setup, and some force y'all to do so. But with these two, the Checkmarx blog said, "there was no recommendation or enforcement for a countersign change."

The VStarcam enabled remote connections via Telnet, a 1970s-era communications protocol with absolutely no security, but did not mention this fact in the documentation.

You besides could hijack the VStarcam past just creating a Wi-Fi network with a name containing a specific command; as soon as the VStarcam saw the network in its list of possible networks, it would transport the assailant its administrative username and password.

The Loftek let yous send it an HTTP command that would permit y'all remotely create a new administrator account on the device — and make the new account's username a blank space then that information technology wouldn't show upwards in the camera's control interface.

Checkmarx said it sent emails in March to both Loftek and Vstarcam informing the manufacturers of the vulnerabilities. "We are yet to receive replies," the report said.

VStarCam is based in China, but Loftek is based in San Jose, California. A phone call and email to Loftek seeking comment were not immediately returned.

Why Cheap Security Cameras Aren't Secure at All
Best Smart Domicile Gadgets
How to Protect Your Identity, Personal Data and Property

Paul Wagenseil is a senior editor at Tom's Guide focused on security and privacy. He has also been a dishwasher, fry cook, long-haul driver, code monkey and video editor. He's been rooting around in the information-security space for more than fifteen years at FoxNews.com, SecurityNewsDaily, TechNewsDaily and Tom's Guide, has presented talks at the ShmooCon, DerbyCon and BSides Las Vegas hacker conferences, shown up in random Tv set news spots and fifty-fifty moderated a panel give-and-take at the CEDIA home-technology briefing. You tin can follow his rants on Twitter at @snd_wagenseil.