Is your security camera system exposed to the internet?
A restaurant we worked with kept failing its quarterly PCI scan. The findings were about web server headers, which made no sense to the owners: they did not run a web server. The scan was right, though. Something on their public IP address was answering web requests.
It was the security camera recorder. Years earlier, someone had set up a port forward on the router so the owner could watch the cameras from home. That port forward was still there, publishing the recorder's login page to the entire internet.
Why this matters more than a failed scan
Camera recorders (DVRs and NVRs) are some of the most attacked devices on the internet. They run firmware that is rarely updated, often keep default or weak passwords, and several popular brands have had serious vulnerabilities that let an attacker take over the device without logging in at all. Once inside, an attacker can watch your cameras, use the recorder to attack other devices on your network, or enlist it in a botnet.
And because the recorder sits on the same network as your computers, and sometimes your payment terminals, a compromised camera system is a compromised business network.
How to check yours
- Ask whoever set up your cameras how remote viewing works. If the answer involves "opening a port" or a public IP address, you probably have exposure.
- Log in to your router and look for port forwarding or virtual server rules. Rules pointing to the recorder's address on ports 80, 443, 554, 8000 or 37777 are common.
- From a phone on cellular data (not your Wi Fi), visit your business's public IP address in a browser. If a camera login page appears, so can anyone else.
The fix
Remove the port forward. That single change usually clears the scan findings and closes the hole. If you still need to watch cameras remotely, use one of these instead:
- The manufacturer's cloud app, which connects outward from the recorder and needs no open ports.
- A VPN into your network, so cameras are only reachable after you authenticate.
While you are in there, update the recorder's firmware, change the admin password, and if your network supports it, move cameras onto their own network segment away from computers and payment systems.
If you are not sure what your business exposes to the internet, that is exactly what the external portion of a security assessment answers.