Several of the most popular Internet-connected baby monitors lack security features, making them vulnerable to even the most basic hacking attempts, according to a new report from a cybersecurity firm.
The possibility of an unknown person watching their baby’s every move is a frightening thought for many parents who have come to rely on the devices to keep an eye on their little ones. In addition, a hacked camera could provide access to other Wi-Fi-enabled devices in a person’s home, such as a personal computer or security system.
The research released last week by Boston-based Rapid7 Inc. looks at nine baby monitors made by eight different companies. They range in price from $55 to $260.
The cameras are often mounted over a baby’s crib or another place where they spend a large amount of time. They work by filming the child, then sending that video stream to a personal website or an app on a smartphone or tablet. Some of the cameras also feature noise or motion detectors and alert parents when the baby makes a sound or moves.
The Rapid7 researchers found serious security problems and design flaws in all of the cameras they tested, said Mark Stanislav, a senior security consultant at Rapid7 and one of the report’s authors.
Some cameras had hidden, unchangeable passwords, often listed in their manuals or online, that could be used to gain access. In addition, some of the devices didn’t encrypt their data streams or some of their web or mobile features, Stanislav said.
The problems with the cameras highlight the security risks associated with what’s become known as the “Internet of Things.” Homes are becoming increasingly connected, with everything from TVs to slow cookers now featuring Wi-Fi connections. But many consumer devices often don’t undergo rigorous security testing and could be easy targets for hackers.
And if a hacker has access to one connected device, he or she could potentially access everything tethered to that home’s Wi-Fi network, whether it’s a home computer storing personal financial information or a company’s computer system that’s being accessed by an employee working from home.
In the Rapid7 study, researchers rated the devices’ security on a 250-point scale. The scores then received a grade between “A” and “F.” Of those tested, eight received an “F,” while one received a “D.” All of the camera manufacturers were notified of the problems earlier this summer, and some have taken steps to fix the problems.
For example, researchers noted that the Phillips In.Sight B120 baby monitor, which retails for about $78, had a direct, unencrypted connection to the Internet. That could allow a hacker to watch the device’s video stream online, as well as remotely access the camera itself and change its settings, the report said.
Phillips NV released a statement noting that the model in question has been discontinued. It added that its brand of video baby monitors is now licensed to Gibson Innovations, which is aware of the problems, and that the company is working on a software update designed to fix it.
The researchers also tested the iBaby and iBaby M3S, Summer Baby Zoom WiFi Monitor & Internet Viewing System, Lens Peek-a-View, Gynoii, TRENDnet WiFi Baby Cam TV-IP743SIC, WiFiBaby WFB2015 and Withing WBP01.
Higher camera prices didn’t translate to higher levels of security. In fact, the pricier models usually came with more features, which if left unsecured could give hackers more ways to potentially access a camera or its video stream, Stanislav said.
In order to protect themselves, consumers should keep an eye out for any camera or mobile application updates. In addition, if parents still want to use a camera that’s known to be susceptible to hackers, they should use it sparingly and unplug it when it’s not in use, Stanislav said.