Your Security Cameras Are Watching the Door. Who’s Watching the Cameras?

Last spring you installed eight cameras and a recorder in the back closet. The installer plugged everything in, tested the picture, and left. Nobody ever changed the password on the recorder, because nobody ever thought of it as a computer. It is one.

Modern security cameras and the recorders that store their video (NVRs) are small networked computers running old software. They sit on the same network as your front desk PCs, they often reach the internet, and they are among the least-maintained devices in the building. For Philadelphia funeral homes, medical offices, and real estate firms, where cameras cover reception areas and sometimes records rooms, that’s a real exposure.

How cameras get compromised

Attackers don’t target your office specifically. They scan the internet for exposed camera systems and try the factory-default logins, because plenty of devices still ship with them. CISA, the federal cybersecurity agency, has repeatedly flagged camera and recorder flaws that were being actively exploited, and compromised cameras are a staple of botnets that attack other people’s websites.

Default or shared passwords left from installation day.
Remote viewing set up the lazy way, by forwarding a port on the router so the owner can check the cameras from a phone. That puts the recorder directly on the internet.
Firmware that never gets updated. Many cameras haven’t had a patch since they left the box.
Cameras on the main network. A compromised camera becomes a foothold next to your file server.

Why this matters beyond the video

The footage itself can be sensitive. Cameras covering a medical reception desk or a funeral home arrangement room record people on some of the worst days of their lives. Beyond privacy, a hijacked camera is a pivot point. Once an attacker is on the device, they can look around your internal network, and nothing on a camera will ever raise an alarm because nobody runs antivirus on a camera.

It’s the same pattern as other forgotten devices, like the office copier (https://www.abuzztech.com/copier-security-for-philadelphia-medical-practices/) or the guest Wi-Fi sharing a network with your business systems (https://www.abuzztech.com/why-guest-wi-fi-should-be-separate-from-your-business-network/): everyone assumes someone else handles it.

There’s also an insurance angle. Cyber insurance applications increasingly ask about unmanaged and internet-facing devices, and a recorder with a default password is an awkward thing to discover during a claim. A cheap fix today is far easier to explain than a denied claim later. And if your cameras were installed by a low-voltage contractor rather than an IT company, assume nobody has looked at the network side since the day they left.

The lockdown checklist

Change every default password on the cameras and the recorder. Use unique, long passwords, stored in your password manager.
Kill port forwarding. If you need remote viewing, use the manufacturer’s secure cloud service with MFA or a VPN. Never expose the recorder directly.
Put cameras on their own network segment (VLAN) so they can’t talk to your computers or servers.
Patch on a schedule. Check recorder and camera firmware at least twice a year. Retire hardware the manufacturer no longer supports.
Know who has access. Remove the former installer’s and former employees’ accounts, and turn on login alerts if the system supports them.
Put the recorder on your IT inventory. If it isn’t tracked, it isn’t maintained.

A two-minute self-test

Ask your installer or IT provider three questions: Is the recorder reachable from the internet? When was the firmware last updated? Is it separate from our business network? If nobody can answer, the answer is probably “no” on all three. That’s a fixable problem, and usually a short one. The expensive version is finding out after somebody else has been watching your cameras for you.