Netcam: Basics and Vulnerabilities

by John Thibault

An Internet Protocol (IP) camera or "netcam" is a digital video camera used for surveillance to send and receive data via a computer network.

Unlike analog Closed-Circuit Television (CCTV), IP cameras can send information via the Internet.  Most cameras that do this are commonly known as webcams.  The term netcam is typically applied only to those used for surveillance.  Netcams are available at resolutions ranging from 0.3 to 29 megapixels, while newer systems operate and capture video in high definition (e.g., 720p or 1080i and 16:9 widescreen format).  There are two different types of netcams.

1.)  Centralized IP Cameras:  Requires a central Network Video Recorder (NVR) to handle the recording, video, and alarm system.

2.)  Decentralized IP Cameras:  Does not require a central NVR, since the cameras typically have a built-in recording function and can record digitally to local storage media, such as flash drives and HD drives or even to standard Network Attached Storage (NAS).

Netcams are commonly used for security, due to their ease of accessibility from any computer, as well as from many smartphones and other devices such as an iPad or tablet.  Some cameras can be moved anywhere on an IP network (including wireless).  They can also be equipped with "distributed intelligence" allowing scalability in analytic solutions to ensure coherency of agents of a surrounding area such as motion detection, as well as two-way audio which allows users to communicate with what they are seeing.  They can be programmed to determine when an object or individual moves to a specific zone or area.  Commands for Pan, Tilt, and Zoom (PTZ) are accessible via a single network cable or connection and can also be operated via any computer or accessible device.

Most netcams are assigned a temporary IP address (four numbers ranging from 0 to 255 that are separated by periods) by the router.  This is how you find the camera(s) you wish to access.  Turning the router or camera(s) off changes the IP address.  For users who are less "computer savvy," the cameras can be set with a fixed address, which means the IP address of the camera does not change and the user can always locate it with ease.

The cameras are accessible using a Local Area Network (LAN) which can only start with 192.168.x.x or 10.x.x.x but to access the camera(s) remotely, you will need to know the Wide Area Network (WAN) address provided by the Internet service provider (ISP).

Most netcams are powered via PoE protocol.  "Power over Ethernet" simply means the cameras receive their power via the Ethernet cable they are connected to.

When installing multiple network cameras, it is wise to use a centralized network camera, which requires a Network Video Recorder (NVR).  An NVR is a program that can store video from network cameras and allow for viewing of multiple cameras at once.  It is similar to a Digital Video Recorder (DVR), but while a traditional DVR is responsible for encoding and processing video from component cameras, NVR depends on the cameras to encode their video, simply storing it and allowing for centralized remote viewing.  Netcams offer secure data transmission through encryption and authentication methods such as WEP, WPA, WPA2, TKIP, and AES.  But we all know a network is only as secure as the individual creating it.  If you plan to record and store footage, you will also need a dedicated NVR or a PC to install NVR software on, as discussed earlier.

In 2012, research showed that 21.57 percent of users utilizing netcams used the default passwords, either out of laziness or simply a lack of knowledge of the importance of having a strong, unique, and secure password.  The most common default combination is admin/admin with more than 30 percent of all manufacturers using it.  As we can see, nearly a quarter of all netcams used are set to their default passwords and are never changed or altered.  It is even common for a business to alter the password so slightly that it is still pretty easy to figure out.

Here is a list of common netcam default passwords:

none indicates there is no password or login required.  Just hit Enter.

  • ACTi:   admin/123456 or Admin/123456
  • Arecont Vision:   none
  • Avigilon:   admin/admin
  • Axis:   root/pass, new Axis cameras require password creation during first login.
  • Basler:   admin/admin
  • Bosch Dinion:   none
  • Brickcom:   admin/admin
  • Cisco:   No default password, requires creation during first login.
  • Dahua:   admin/admin
  • Edimax:   admin/1234
  • Grandstream:    admin/admin
  • Hikvision:    admin/12345
  • Honeywell:   administrator/1234
  • IQinVision:   root/system
  • IPX-DDK:   root/admin or root/Admin
  • Mobotix:   admin/meinsm
  • Panasonic:   admin/12345
  • Pelco Sarix:   admin/admin
  • Pixord:   admin/admin
  • Samsung Electronics:   root/root or admin/4321
  • Samsung Techwin (old):   admin/1111111
  • Samsung Techwin (new):   admin/4321
  • Sanyo:   admin/admin
  • Scallop:   admin/password
  • Sony   :admin/admin
  • Stardot:   admin/admin
  • Starvedia:   admin/none
  • Trendnet:   admin/admin
  • Toshiba:    root/ikwd
  • VideoIQ:   supervisor/supervisor
  • Vivotek:   root/none
  • Ubiquiti:   ubnt/ubnt

For example: Sony's netcam default password is: admin/admin

Other than using default passwords, some would be shocked at how many businesses set their access information to something as simple as the name of the business, or street number of the address wherethe secured location can be found.  I recently worked for a company who set up a surveillance system and used admin/2600 for the login information - "2600" being the street address where the business was located (of course, I changed this for the purpose of confidentiality).  Almost anyone with basic hacking skills could, eventually, figure it out.

Let's say, for instance, there is a company called "Bob's Shack."  I wouldn't put it past them to set up their netcam to be admin/bobsshack.  It's easy to remember, right?  But it's also pretty easy to figure out with a little bit of trial and error.

I would advise anyone with only basic knowledge to consult a professional security technician when installing and setting up security surveillance.  It is critical that proper precautions are taken to secure all networks, IP addresses, and VPNs.  If your passwords and protocol are weak, it is easy for almost anyone willing to put in the time to figure out how to penetrate your IP cameras and use them to their advantage.  Safety and security should not be taken lightly and should be of the utmost highest priority.  You never know who will try to exploit a security loophole, especially when it comes to something accessible via an Internet connection.  If you know someone who is thinking about installing a netcam security system, tell them to read this first.  Hopefully, this article will bring the vulnerabilities and importance of proper use and setup of high-tech security systems to light.  It doesn't matter how much (or how little) you spend on a security system if the passwords canbe figured out with only the smallest effort.  If you install a camera system to feel "safe," you must first be sure that the system and its data are also safe from possible intruders.
Return to $2600 Index