{"id":5569,"date":"2016-01-28T14:30:09","date_gmt":"2016-01-28T22:30:09","guid":{"rendered":"http:\/\/g-liu.com\/blog\/?p=5569"},"modified":"2016-03-26T12:15:36","modified_gmt":"2016-03-26T20:15:36","slug":"how-you-can-snoop-on-thousands-of-unsecured-webcams","status":"publish","type":"post","link":"https:\/\/g-liu.com\/blog\/2016\/01\/how-you-can-snoop-on-thousands-of-unsecured-webcams\/","title":{"rendered":"How you can snoop on thousands of unsecured webcams"},"content":{"rendered":"<p>If you&#8217;ve been on the Internet long enough, you&#8217;ve probably heard buzz about <a href=\"http:\/\/us.norton.com\/yoursecurityresource\/detail.jsp?aid=webcam_hacking\" target=\"_blank\">how hackers can spy on you using your webcam<\/a>. This is not just some scare story. The truth is that hacking into webcams has been <a href=\"https:\/\/iapp.org\/news\/a\/iot-vulnerabilities-galore-a-black-hat-defcon-roundup\/\" target=\"_blank\">demonstrated over and over<\/a>. Even so, I&#8217;ve always thought\u00a0that such\u00a0webcams were accessible only by elite government-employed computer geeks. It turns out that any civilian with an Internet connection can eavesdrop on these unsecured webcams.<\/p>\n<p>The dark horse in this story is Shodan.io, a search engine allowing users to search for devices such as webcams, refrigerators, and even power plants. Don&#8217;t get me wrong; this isn&#8217;t like searching for products\u00a0to buy online. Shodan indexes actual, physical devices that you can access simply by typing an IP address into your browser. It turns out that Shodan has discovered a myriad of Internet-connected web cameras, among other <a href=\"https:\/\/en.wikipedia.org\/wiki\/Internet_of_Things\">IoT devices<\/a>. All that is separating you from someone else&#8217;s web camera is a search and a click.<\/p>\n<p><!--more--><strong>Disclaimer:<\/strong>\u00a0The content below contains knowledge. Knowledge is power. Use that power wisely.<\/p>\n<figure id=\"attachment_5576\" aria-describedby=\"caption-attachment-5576\" style=\"width: 300px\" class=\"wp-caption alignright\"><a href=\"http:\/\/g-liu.com\/blog\/wp-content\/uploads\/2016\/01\/music-room-webcam.jpg\" rel=\"attachment wp-att-5576\"><img loading=\"lazy\" decoding=\"async\" data-attachment-id=\"5576\" data-permalink=\"https:\/\/g-liu.com\/blog\/2016\/01\/how-you-can-snoop-on-thousands-of-unsecured-webcams\/music-room-webcam\/\" data-orig-file=\"https:\/\/g-liu.com\/blog\/wp-content\/uploads\/2016\/01\/music-room-webcam.jpg\" data-orig-size=\"640,480\" data-comments-opened=\"1\" data-image-meta=\"{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;}\" data-image-title=\"music-room-webcam\" data-image-description=\"&lt;p&gt;A still image from an unsecured web camera.&lt;\/p&gt;\n\" data-image-caption=\"&lt;p&gt;A still image from an unsecured web camera.&lt;\/p&gt;\n\" data-medium-file=\"https:\/\/g-liu.com\/blog\/wp-content\/uploads\/2016\/01\/music-room-webcam-300x225.jpg\" data-large-file=\"https:\/\/g-liu.com\/blog\/wp-content\/uploads\/2016\/01\/music-room-webcam.jpg\" class=\"wp-image-5576 size-medium\" src=\"http:\/\/g-liu.com\/blog\/wp-content\/uploads\/2016\/01\/music-room-webcam-300x225.jpg\" alt=\"A still image from an unsecured web camera.\" width=\"300\" height=\"225\" srcset=\"https:\/\/g-liu.com\/blog\/wp-content\/uploads\/2016\/01\/music-room-webcam-300x225.jpg 300w, https:\/\/g-liu.com\/blog\/wp-content\/uploads\/2016\/01\/music-room-webcam.jpg 640w\" sizes=\"(max-width: 300px) 100vw, 300px\" \/><\/a><figcaption id=\"caption-attachment-5576\" class=\"wp-caption-text\">A still image from an unsecured web camera.<\/figcaption><\/figure>\n<p>Here&#8217;s how you can search for unsecured webcam feeds:<\/p>\n<ul>\n<li>Point your web browser to <a href=\"http:\/\/shodan.io\/explore\">http:\/\/shodan.io\/explore<\/a>. For best results, I recommend Google Chrome.<\/li>\n<li>(You may be asked to log in at some point. Feel free to use your Google login &#8212; just be sure to follow all the instructions for best results)<\/li>\n<li>Under popular searches you will see a list of links (e.g.\u00a0&#8220;<a href=\"https:\/\/www.shodan.io\/search?query=Server%3A+SQ-WEBCAM\" target=\"_blank\">Webcam<\/a>&#8220;). Click one of those links.<\/li>\n<li>Shodan will show you a results page. Click on one of the results.<\/li>\n<li>Some of those links may be &#8220;protected&#8221; by a login screen. You can often succeed just by entering the default username and password. Try some of the following user\/pass combinations (not guaranteed to work):\n<ul>\n<li>admin\/pass<\/li>\n<li>admin\/password<\/li>\n<li>admin\/1234<\/li>\n<li>admin\/ <em>[no password]<\/em><\/li>\n<li>root\/password<\/li>\n<li>root\/pass<\/li>\n<li>root\/ <em>[no password]<\/em><\/li>\n<\/ul>\n<\/li>\n<li>Enjoy your webcam feed<\/li>\n<\/ul>\n<p>So far, I have found these gems. Some of them even allow you to control the camera itself!<\/p>\n<figure id=\"attachment_5582\" aria-describedby=\"caption-attachment-5582\" style=\"width: 300px\" class=\"wp-caption alignleft\"><a href=\"http:\/\/g-liu.com\/blog\/wp-content\/uploads\/2016\/01\/man-oblivious.png\" rel=\"attachment wp-att-5582\"><img loading=\"lazy\" decoding=\"async\" data-attachment-id=\"5582\" data-permalink=\"https:\/\/g-liu.com\/blog\/2016\/01\/how-you-can-snoop-on-thousands-of-unsecured-webcams\/man-oblivious\/\" data-orig-file=\"https:\/\/g-liu.com\/blog\/wp-content\/uploads\/2016\/01\/man-oblivious.png\" data-orig-size=\"640,480\" data-comments-opened=\"1\" data-image-meta=\"{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;}\" data-image-title=\"man-oblivious\" data-image-description=\"&lt;p&gt;A man standing right under a controllable surveillance camera&lt;\/p&gt;\n\" data-image-caption=\"&lt;p&gt;A man standing right under a controllable surveillance camera.&lt;\/p&gt;\n\" data-medium-file=\"https:\/\/g-liu.com\/blog\/wp-content\/uploads\/2016\/01\/man-oblivious-300x225.png\" data-large-file=\"https:\/\/g-liu.com\/blog\/wp-content\/uploads\/2016\/01\/man-oblivious.png\" class=\"size-medium wp-image-5582\" src=\"http:\/\/g-liu.com\/blog\/wp-content\/uploads\/2016\/01\/man-oblivious-300x225.png\" alt=\"A man standing right under a controllable surveillance camera\" width=\"300\" height=\"225\" srcset=\"https:\/\/g-liu.com\/blog\/wp-content\/uploads\/2016\/01\/man-oblivious-300x225.png 300w, https:\/\/g-liu.com\/blog\/wp-content\/uploads\/2016\/01\/man-oblivious.png 640w\" sizes=\"(max-width: 300px) 100vw, 300px\" \/><\/a><figcaption id=\"caption-attachment-5582\" class=\"wp-caption-text\">A man standing right under a controllable surveillance camera.<\/figcaption><\/figure>\n<ul>\n<li><a href=\"http:\/\/68.190.187.178:84\/ViewerFrame?Mode=Motion\" target=\"_blank\" class=\"broken_link\" rel=\"nofollow\">A copy\u00a0room and work space (controllable)<\/a><\/li>\n<li><a href=\"http:\/\/114.152.33.79\/\" class=\"broken_link\" rel=\"nofollow\">A large room in Japan<\/a><\/li>\n<li><a href=\"http:\/\/148.231.102.50\/ViewerFrame?Mode=Motion&amp;Language=0\" target=\"_blank\" class=\"broken_link\" rel=\"nofollow\">Computer lab at the Universidad Autonoma del Estado de Baja California (controllable)<\/a><\/li>\n<li><a href=\"http:\/\/61.194.97.88:81\/ViewerFrame?Mode=Motion&amp;Resolution=640x480&amp;Quality=Standard&amp;Interval=30&amp;Size=STD&amp;PresetOperation=Move&amp;Language=1\" target=\"_blank\" class=\"broken_link\" rel=\"nofollow\">Office space in Japan. One person&#8217;s monitor can be seen quite clearly.<\/a><\/li>\n<li><a href=\"https:\/\/202.120.143.196\/pages\/index.html\" target=\"_blank\" class=\"broken_link\" rel=\"nofollow\">Data center in China<\/a>. Contains many other goodies.<\/li>\n<li><a href=\"http:\/\/came3.nkansai.ne.jp:81\/CgiStart?page=Single\" target=\"_blank\" class=\"broken_link\" rel=\"nofollow\">A railway yard\u00a0in Japan (controllable)<\/a><\/li>\n<li><a href=\"http:\/\/78.36.13.162\" target=\"_blank\" class=\"broken_link\" rel=\"nofollow\">Some waiting area? in Russia<\/a>. Username <tt>admin<\/tt>, Password <tt>admin<\/tt>. Works best on Firefox with VLC plugin installed.<\/li>\n<\/ul>\n<p>Update 2\/24\/2016 &#8211; It seems that some of these webcams have gone offline. You can give these a try, but they were down the last time I checked.<\/p>\n<ul>\n<li><strong>99.158.140.17:8888<\/strong> Front porch of 166 Wendy Ln, Athens GA<\/li>\n<li><strong>68.177.73.106:81<\/strong> A warehouse of some sorts<\/li>\n<li><strong>75.68.130.86:8000<\/strong> A room in Amesbury, Mass.<\/li>\n<li><strong>99.55.142.102:8888<\/strong> A couch. Entities seen include woman with cellphone, and dog.<\/li>\n<li><strong>153.165.146.14:81<\/strong>\u00a0A temple in Japan. Very cool view!<\/li>\n<li><strong>50.176.93.42:8888<\/strong> Messy room in Hudson, WI<\/li>\n<li><strong>75.141.190.126:8888<\/strong> Music room<\/li>\n<li><strong>162.195.124.70:8080<\/strong> An office in Los Angeles, CA<\/li>\n<\/ul>\n<p>Find something interesting? Surprising? Share it in the comments!<\/p>\n<!-- AddThis Advanced Settings generic via filter on the_content --><!-- AddThis Share Buttons generic via filter on the_content --><!-- AddThis Related Posts generic via filter on the_content -->","protected":false},"excerpt":{"rendered":"<p>If you&#8217;ve been on the Internet long enough, you&#8217;ve probably heard buzz about how hackers can spy on you using your webcam. This is not just some scare story. The truth is that hacking into webcams has been demonstrated over and over. Even so, I&#8217;ve always thought\u00a0that such\u00a0webcams were accessible only by elite government-employed computer geeks. It turns out that &#8230;<!-- AddThis Advanced Settings generic via filter on wp_trim_excerpt --><!-- AddThis Share Buttons generic via filter on wp_trim_excerpt --><!-- AddThis Related Posts generic via filter on wp_trim_excerpt --><\/p>\n","protected":false},"author":2,"featured_media":5575,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"footnotes":"","jetpack_publicize_message":"How you can snoop on thousands of unsecured webcams #iot #security","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","enabled":false}}},"categories":[16,36],"tags":[],"jetpack_publicize_connections":[],"aioseo_notices":[],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"https:\/\/g-liu.com\/blog\/wp-content\/uploads\/2016\/01\/surveillance-camera-crop.jpg","jetpack_shortlink":"https:\/\/wp.me\/p2Zt3y-1rP","_links":{"self":[{"href":"https:\/\/g-liu.com\/blog\/wp-json\/wp\/v2\/posts\/5569"}],"collection":[{"href":"https:\/\/g-liu.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/g-liu.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/g-liu.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/g-liu.com\/blog\/wp-json\/wp\/v2\/comments?post=5569"}],"version-history":[{"count":16,"href":"https:\/\/g-liu.com\/blog\/wp-json\/wp\/v2\/posts\/5569\/revisions"}],"predecessor-version":[{"id":5648,"href":"https:\/\/g-liu.com\/blog\/wp-json\/wp\/v2\/posts\/5569\/revisions\/5648"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/g-liu.com\/blog\/wp-json\/wp\/v2\/media\/5575"}],"wp:attachment":[{"href":"https:\/\/g-liu.com\/blog\/wp-json\/wp\/v2\/media?parent=5569"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/g-liu.com\/blog\/wp-json\/wp\/v2\/categories?post=5569"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/g-liu.com\/blog\/wp-json\/wp\/v2\/tags?post=5569"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}