How to protect yourself from webcam spying: five simple steps | Kaspersky official blog

The threat involves unauthorized access to IP cameras and similar devices due to weak security practices, primarily unchanged default credentials and insecure manufacturer implementations. Attackers have exploited these weaknesses to hack large numbers of cameras, enabling them to livestream or sell intimate footage, conduct surveillance, or stalk individuals. Examples include a 2025 incident in South Korea where 120,000 cameras were hacked and footage sold via subscription, as well as cases of stalkers spying on acquaintances through home cameras. The article emphasizes that many devices transmit data insecurely or use predictable URLs and fixed encryption keys. It recommends selecting cameras from reputable manufacturers with regular firmware updates, disabling unnecessary cloud features, and storing footage locally to mitigate risks.

Unauthorized access to IP cameras can lead to privacy violations, extortion, blackmail, stalking, and detailed surveillance of victims' movements and conversations. Compromised devices may expose intimate footage, location data, and metadata such as GPS coordinates and timestamps. This can result in significant personal harm, including emotional distress and forced relocation, as well as potential physical security risks like car theft. The scale of impact can be large, as demonstrated by the mass compromise of 120,000 cameras in South Korea.

The vendor advisory does not specify a patch but provides actionable recommendations to reduce risk: 1) Choose IP cameras from manufacturers with a strong security track record and regular firmware updates. 2) Change default passwords immediately and use strong, unique credentials. 3) Disable unnecessary features, especially third-party cloud storage, and prefer local storage options such as microSD cards or NAS devices. 4) Regularly update device firmware to address vulnerabilities. 5) Be vigilant for hidden spy cameras in rented accommodations. These steps significantly reduce the likelihood of unauthorized access and surveillance.