How Secure Are Wifi Cameras?

Can a camera be used as a "jump point" to other devices on the network?

aside from the common fears that wifi cameras around the home can potentially be hacked so that someone unauthorized can view the feed, or that they can collect information, do the cameras themselves make it any easier for someone to access other devices or transmissions on the home network? for example, if someone gains access to my camera, can they do anything to my laptop or phone?

the simple answer is: yes (maybe).

can a camera be used as a "jump point" to other devices on the network? yes, like any other device it can. if it publicly exposed, the risk is higher.

yes, renegade devices on your network are a real risk. they are not much different than a renegade pc on your network.

well known brand name devices have been compromised en masse. little known brand devices may be even more risky.

there are a few entry points in via cameras--general advice is to stick with known manufacturers that have "skin in the game" i.e., enough revenue to care about getting sued or looking bad during litigation.

• if the camera has multiple ways to configure/connect (i.e., bluetooth in addition to wifi)
• keep the camera firmware up to date.
• stay vigilant of advisories such as eol notices.
• if it is cloud connected, make sure you trust the company handling/processing/storing your data.
• know where your data is stored: i.e., united states, europe, china.

in general, you get what you pay for. typically if you pay a monthly fee, you'll have better management of security.

Keep cameras on their own network segment

to be secure from such attacks put all your cameras on their own vlan (network) and allow no access from that network to anything, not even the internet.

cameras on their own vlan, and if wifi: with client isolation

in the firewall whitelist the clients (or subnets) that are allowed to connect

if you want to allow only specific client devices (authorized phones, laptops), consider zerotier or tailscale on the vlan segment

if possible, only host over ipv6 to minimize random drive-by attacks

i can only suggest you put your security cameras on theor own vlan as well as all your iot stuff.

yes. this is why it’s a good idea to isolate your cameras behind a separate router so they don’t have a direct connection to the internet and don’t live on the same network as the rest of your stuff.

also keeps all that traffic off your main network.

• keep cameras on their own network segment--i.e., guest wifi or other isolated network segment that cannot communicate with other unrelated devices. this helps resist pivoting into your network.
• as some other say, it can be an advantage to have the camera separated from the rest of the network.
• for some cameras, some services will require access to the camera on the home network.
• if the camera only operate through a cloud solution, you don't necessarily need network setup with vlan - putting the camera on a guest network will also separate it.

yes, so block their internet usage or remove the gateway ip usually works

Don't expose devices to the public internet

the most common scenario for someone view the feed, is that you have exposed the camera to the public internet. some cameras do this through upnp if you enables some features.

if the camera has a cloud service which the video is feed through, the direct exposure to the public internet is not needed. the disadvantage could be that if the manufacturer shuts down the cloud service in a few years, the camera can stop working.

in general: don't expose devices to the public internet through port forwarding (manually or with upnp).

and be sure what the camera does - i think it was some tp-link-cameras for an example, that used upnp to expose them self if you configured the camera to be used with other services (like vlc or a third party video surveillance solution) -- even if you plan was to only do this in the home network.

• make sure you enable mfa
• if mfa is not available, request it or change platforms.
• keep appliances and infrastructure up to date.
• check for leaks on shodan.io, or ask for someone to do this for you.
• be extremely careful with selection of dynamic dns solutions for remote access.
• any mobile apps used to view feed should be regularly updated, and published by your manufacturer.
• the company should have a plan to deal with update notifications and breaches.
• enable automatic updates to keep the app up to date.

security systems can be hacked if not secured. ensure strong passwords, enable two-factor authentication, and chose systems with encryption.

fyi: there are websites that show live video feeds from hacked security cameras all over the world. we will not mention the names of those sites for the safety and privacy of those affected by the hacking, but it seems that a common theme for those hacked security cameras is that their owners didn’t change the default password.

Secure your home network

cameras that stream live video — like doorbell smart cameras, baby monitors, and security cameras — are a popular way to keep an eye on your property, family, and pets.

these cameras may be called smart cameras, connected cameras, or ip cameras.

using an app on your phone or computer, you’re able to watch or listen to live video and audio feeds, also known as livestreams.

but these cameras can be hacked, so read on for ways to help you secure them.

1. research before you buy
2. secure your home network
3. update your software
4. use strong passwords that you’ve never used before
5. turn on your camera’s security features
6. safely watching your camera feed remotely
7. securely sharing your livestream with others

are home security systems hackable? not all home security systems are hackable. local alarm systems, for instance, aren’t connected to the internet and thus aren’t hackable. smart home security systems, on the other hand, are connected to the internet, so there is a possibility of hacking, like any other internet-connected product.

it’s impossible to say if wireless alarm systems are secure or not without knowing more information.

for example, wireless alarm systems with end-to-end encryption, required passwords and advanced authentication, and wpa protocols are more secure than systems with no encryption, no mandated passwords or authentication, and wep protocols. in short, it depends on the system itself.

Wifi cameras stopped working

not very secure, and easily jammed if needed to be.

when wifi is down or not behaving well, it will be really issue.

not really good if you intended to run multiple camera on wifi since wifi’s theoretical speed and practical speed in real life is pretty different. even the most recent standard 802.11ac tend to have lot slower actual speed, and when your whole camera system is riding on wifi, it will cause major issue.

you definitely need to invest on router if you are running older system or one from isp which tend to have pretty lousy performance.

this is something i could think of quickly, generally speaking, it will likely pay to do poe based camera than doing wifi camera… and limit number of wifi camera if you have like need to install it in remote barn or garage type of situations.

• you might save few bucks because you will not need to do major wiring as much as one that is running cable all over property.
• there are many consumer models available, and upfront cost are often attractive, and they also came with dedicated app for smart phone, perhaps cloud storage subscription and other amenity.
• you still need to do some electrical work to power camera (unless it is battery or solar powered which may or may not work depend on area you are located)
• very limited option to trouble shoot if camera decided to go crazy software.

the police office suggested that the criminals have a thing called a jammer. its sole purpose is to swamp the local area with static so that wifi pretty much craps out. once they leave the area, the wifi cameras can now resume doing what they are supposed to do.

when the police finally got onto the cloud store of the footage from the cameras, they were unsurprised that moments before the break-in, all the cameras stopped working. all of them at the same time. give or take a second or two. about 20 minutes later, they all suddenly leapt back into action.

Two network adapters

so to avoid all these issues is quite simple, my pc running the cameras has two network adapters- the one one the motherboard and a second one i added.

one card

one card connects to the poe switch running the cameras

the other

the other the main router for the house.

blueiris

blueiris manages the cameras and all remote access is through it or virtual desktop to the pc.

you can do the same with wireless cameras.

since my pc is hardwire to the router i have its wi-fi card set to host a private wifi signal for one wireless camera.

range may be an issue if you do it this way but for me it's simply a baby cam so isn't a problem.

cost to add a second network card was $30. a used dell optiplex sff is less than $200. well worth it.

• to go a step further, you should really lock the switch port a camera is attached to to that camera’s mac address.
• prevents someone from unplugging your camera and plugging their laptop into your network.
• sadly that does not prevent anything.
• anyone can simply change the mac of the device they attach to the mac of the camera.