Your cameras are supposed to protect the business — but an exposed, unpatched camera can become a soldier in someone else’s botnet. Here’s how it happens and how to stop it.
Security cameras are among the most common internet-connected devices in any business, and among the least maintained. They are installed once, pointed at a door and forgotten. That combination of always-on connectivity, default settings and rarely updated firmware is exactly what botnet operators look for.
What is an IoT camera botnet?
A botnet is a network of compromised devices controlled remotely by an attacker. The most famous early example, Mirai, surfaced in 2016 and spread by scanning the internet for cameras, DVRs and routers that still used factory usernames and passwords. The resulting army of hijacked devices launched some of the largest distributed denial-of-service (DDoS) attacks recorded at the time. Mirai’s source code was published, and countless variants still circulate today.
Modern variants no longer rely only on default passwords. They also exploit known firmware vulnerabilities in camera and recorder web interfaces, often within days of a vulnerability being disclosed.
How cameras get hijacked
- Port forwarding. Installers often open ports on the firewall so owners can view cameras remotely. That also lets anyone on the internet reach the camera’s login page.
- Default or reused credentials. “admin/admin” and “admin/12345” are still found in the wild. Automated scanners try them within minutes of a device appearing online.
- Unpatched firmware. Many recorders and cameras never receive an update after installation, leaving well-documented vulnerabilities open for years.
- UPnP. Universal Plug and Play can silently open firewall ports without anyone noticing.
- Flat networks. Cameras on the same network as point-of-sale systems and office PCs give an attacker a foothold to move laterally.
Why it matters for your business
A hijacked camera is not just someone else’s problem. The same access that recruits a camera into a botnet can be used to view your live feeds, delete recordings, or pivot to more valuable systems on your network. Compromised devices also consume bandwidth, degrade performance, and can get your IP address blocklisted.
Unexplained spikes in upload bandwidth, cameras that reboot on their own, or unfamiliar user accounts on your recorder are all worth an immediate look.
How to protect your cameras
- Close inbound ports. Remove port-forwarding rules to cameras and recorders, and disable UPnP on your router.
- Use unique, strong passwords on every camera and recorder, stored in a password manager.
- Update firmware on a schedule, and replace devices whose manufacturers no longer issue security updates.
- Segment cameras onto their own VLAN so they cannot talk to your business systems. See our step-by-step VLAN guide.
- Use an outbound-only cloud connection. Cloud video platforms like VoxCloudCam have cameras connect out to encrypted cloud services, so there is nothing for scanners to find on your public IP.
- Monitor camera health. Alerts for offline or rebooting cameras surface tampering and compromise early.
The bottom line
Botnets thrive on neglected devices. Treat cameras like any other computer on your network: patch them, lock them down, isolate them, and stop exposing them to the internet. If you are not sure how your cameras are configured today, our team can run a quick assessment and show you exactly where the gaps are.
Certified IT and video-surveillance specialists supporting Southern California organizations for over two decades.
