Breach of 120 000 IP cameras in South Korea: security tips | Kaspersky official blog
Source Kaspersky Security Blog
Description
The hack of 120 000 IP cameras across South Korea led to the production and sale of sexually explicit footage. We break down how IP cameras work — and how to secure them.
Impact
For European organizations, this threat poses significant privacy and reputational risks. Compromised IP cameras can lead to unauthorized surveillance, data breaches involving sensitive video footage, and potential legal liabilities under GDPR due to inadequate protection of personal data. Small businesses and home users deploying IP cameras for security or monitoring purposes may inadvertently expose themselves to voyeuristic attacks, resulting in loss of trust and potential financial damages. The breach could also facilitate further attacks if compromised devices are used as entry points into corporate networks or as part of botnets. The illicit distribution of explicit footage can cause severe harm to individuals’ privacy and safety, with potential psychological and social consequences. Additionally, organizations in sectors such as healthcare, hospitality, and retail, which commonly use IP cameras, may face operational disruptions and regulatory scrutiny. The incident underscores the need for stringent IoT security policies and awareness campaigns within European enterprises and consumers. Given the widespread adoption of IP cameras and the ease of exploitation, the threat could scale rapidly if similar security lapses exist across European deployments. The potential for cross-border criminal activity involving stolen footage also complicates law enforcement efforts and necessitates international cooperation.
Defensive guidance
European organizations should implement a multi-layered security approach for IP cameras and other IoT devices. First, enforce mandatory password changes from default credentials to strong, unique passwords using password managers to prevent reuse and weak passwords. Second, establish regular firmware update policies, including automated update mechanisms where possible, to patch known vulnerabilities promptly. Third, segment IP cameras on isolated network segments or VLANs to limit lateral movement and exposure to critical business systems. Fourth, deploy network monitoring and intrusion detection systems to identify unusual access patterns or brute-force attempts targeting IoT devices. Fifth, disable unnecessary remote access features or restrict access via VPNs and IP whitelisting to reduce attack surface. Sixth, conduct regular security audits and penetration testing focused on IoT infrastructure. Seventh, educate employees and end-users on IoT security best practices and the risks of default credentials. Finally, collaborate with vendors to ensure ongoing support and security updates for deployed devices. For organizations handling sensitive environments like healthcare or hospitality, consider investing in IP cameras with built-in security features such as two-factor authentication and encrypted video streams. Incident response plans should include procedures for quickly isolating compromised devices and notifying affected individuals in compliance with GDPR requirements.
Summary
This threat involves a large-scale compromise of approximately 120,000 IP cameras in South Korea, primarily used in private homes and commercial establishments such as karaoke rooms, clinics, and fitness studios. The attackers exploited common security weaknesses inherent to IP cameras: default or weak passwords and outdated software lacking security patches. IP cameras are designed for remote access via the internet, streaming video directly to connected devices. However, many users fail to change default credentials or apply firmware updates, leaving devices vulnerable to brute-force attacks or credential stuffing. The attackers accessed these cameras, recorded sexually explicit footage, and sold the content on foreign adult websites, generating significant illicit revenue. Law enforcement arrested four suspects, with two responsible for the majority of the illegal content distribution. The investigation revealed overlapping compromises, suggesting multiple attackers targeted the same devices. While no specific software vulnerabilities or exploits were identified, the attack leveraged poor security hygiene and the inherent risks of internet-connected surveillance devices. The incident illustrates the broader threat landscape for IoT devices, where weak authentication and lack of vendor support create exploitable attack surfaces. The breach also demonstrates the potential for privacy violations and criminal exploitation of compromised devices. The absence of automated update mechanisms and reliance on manual patching exacerbate the risk. This case serves as a cautionary tale for organizations and individuals relying on IP cameras, emphasizing the need for robust security controls, including unique strong passwords, regular firmware updates, network segmentation, and monitoring for unauthorized access attempts. The threat is relevant globally, including Europe, where IP cameras are widely deployed in homes and businesses. The attackers’ ability to monetize stolen footage also highlights the intersection of cybersecurity and criminal exploitation in the IoT domain.