Can CCTV Cameras Be Hacked to Attack Websites?

Yes, CCTV cameras can be hacked and used to attack websites, most famously in the 2016 Mirai botnet attack that took down major sites like Twitter and Netflix. The cameras are not the target themselves; they are hijacked as a weapon in a Distributed Denial of Service (DDoS) attack, where thousands of infected devices flood a website with traffic until it collapses. This article explains how that happens, why cameras are such a popular target, and what you can do to prevent your own camera from being recruited.

Why CCTV Cameras Are a Prime Target

CCTV cameras are attractive to attackers for three simple reasons: they are always on, they are connected to the internet, and they are often poorly secured. Unlike a laptop that is turned off at night, a camera runs 24/7, which means it is always available to send attack traffic. Many models, especially budget ones, ship with default usernames and passwords like “admin” and “12345,” and owners never change them. Attackers scan the internet for these devices, log in with the default credentials, and install malware that waits for a command.

The scale is enormous. There are hundreds of millions of IP cameras in homes, offices, and parking lots worldwide. Even a small percentage of vulnerable devices gives an attacker a large army of bots. The Mirai malware, for example, infected over 600,000 devices in 2016, most of them cameras and routers, and used them to launch some of the largest DDoS attacks ever recorded at that time.

How a Camera Becomes a Bot

The process is largely automated and does not require any skill on the attacker’s part. It typically follows these steps:

Scanning: The attacker runs a program that scans the internet for open ports commonly used by cameras, such as port 80 (web interface) or port 554 (RTSP video streaming).
Credential guessing: The program tries a list of default usernames and passwords. It also tries common weak passwords like “password,” “123456,” and “admin.”
Infection: Once logged in, the malware uploads itself to the camera’s firmware. The camera continues to work normally, so the owner notices nothing.
Command and control: The infected camera contacts a remote server to receive instructions. The attacker can now send a command to all infected cameras at once.
Attack: When the attacker wants to take down a website, they instruct all cameras to send requests to that site’s IP address simultaneously. The sheer volume of traffic overwhelms the server.

This is called a DDoS attack, and the cameras are called a botnet. The website owner is the victim, but the camera owner is also a victim because their device is being used without their knowledge.

Real-World Examples of Camera Botnets

The most famous case is the Mirai botnet, which surfaced in September 2016. It infected a huge number of IoT devices, including CCTV cameras, and launched an attack on the DNS provider Dyn. That attack made many popular websites unreachable for hours on the US East Coast. The source code for Mirai was later released publicly, which led to many copycat botnets. Since then, variants like Mirai have been used repeatedly, and cameras remain a major component of these botnets.

Another example is the Persirai malware, discovered in 2017, which targeted over 1,000 different IP camera models by exploiting a vulnerability in their web interfaces. It did not even need a password to infect the camera. These cases show that the problem is not just weak passwords but also unpatched software.

How to Tell If Your Camera Is Infected

Most infected cameras show no obvious signs because the malware is designed to stay hidden. However, there are a few symptoms you can watch for:

Slow network: Your home internet becomes noticeably slower, especially when the camera is sending attack traffic.
High data usage: Your internet bill shows a sudden spike in data usage, even though you have not changed your habits.
Unusual behavior: The camera’s LED lights blink when you are not viewing the feed, or the camera reboots randomly.
Failed firmware updates: The camera refuses to update its software, possibly because the malware has altered the system.

If you notice any of these, disconnect the camera from the internet immediately and perform a factory reset. After resetting, change the password and update the firmware before reconnecting.

How to Protect Your CCTV Camera

Prevention is straightforward, but it requires a few minutes of effort. The most important steps are:

Change the default password immediately. Use a long, unique password that is not used on any other account.
Update the firmware regularly. Manufacturers release patches for known vulnerabilities. Check the manufacturer’s website or app for updates.
Disable remote access if you do not need it. Many cameras allow you to view them from anywhere via the internet. If you only watch them from your home Wi-Fi, turn off the “remote access” or “UPnP” feature in the camera settings.
Put cameras on a separate network. If your router supports a guest network, connect the cameras to that instead of your main network. This way, even if a camera is infected, it cannot reach your computers or phones.
Use a firewall. Some routers allow you to block outgoing connections from specific devices. You can block the camera from communicating with any server except the manufacturer’s update server.

What to Do If Your Camera Has Already Been Hacked

If you suspect your camera is part of a botnet, act quickly:

Unplug the camera from power and the network.
Perform a factory reset using the pinhole button on the device or through the app.
Set a strong new password immediately after resetting.
Update the firmware to the latest version.
Reconnect the camera and monitor its data usage for a few days.

If the problem persists after a reset, the malware may be stored in the firmware in a way that survives a factory reset. In that case, the camera is no longer safe to use and should be replaced.

Common Misconceptions About Camera Hacks

One common misconception is that only cheap, no-name cameras are vulnerable. While budget cameras are more likely to have weak security, even well-known brands have had vulnerabilities discovered. The key is not the price but how the device is configured and maintained.

Another misconception is that a camera cannot be hacked if it is not accessible from the internet. While that is mostly true, some cameras use peer-to-peer (P2P) technology that automatically opens ports in your router to allow remote viewing. This happens without you realizing it, so even a camera you think is local-only may be reachable from the internet. Check your router’s port forwarding settings to see if any ports are open for the camera.

Finally, many people believe that a DDoS attack requires a huge number of devices. While more devices make an attack stronger, even a few hundred cameras can generate enough traffic to take down a small website. The risk is real for any site.

Frequently Asked Questions

Can someone hack my CCTV camera to watch me?

Yes, the same vulnerabilities that allow a hacker to turn your camera into a bot also allow them to view the video feed. If they can log in with the default password, they can watch the camera’s stream. This is why changing the default password is critical for your privacy as well as for preventing DDoS attacks.

How do hackers find CCTV cameras to hack?

They use automated tools that scan the entire internet for IP addresses with open ports commonly used by cameras. These tools can scan millions of IPs in minutes and then try default passwords on each one. The process requires no human interaction.

Can a hacked camera infect my computer or phone?

Usually not directly. The malware on the camera is designed to send attack traffic, not to spread to other devices. However, if your camera is on the same network as your computer, an attacker might be able to use the camera as a foothold to reach other devices. This is why isolating cameras on a separate network is recommended.

Is it legal to hack a CCTV camera?

No. Hacking into any device without permission is illegal in most countries, regardless of whether the device is a camera or a computer. It is a violation of computer fraud laws, and offenders can face criminal charges.

Will a factory reset remove the malware?

In most cases, yes. A factory reset removes the malware and restores the camera to its original state. However, if the malware has modified the firmware in a way that survives a reset, the camera may still be infected. In that case, the only safe option is to replace the device.

Can a DDoS attack from my camera be traced back to me?

Yes, the attack traffic will appear to come from your IP address, so the target website’s logs will show your camera as a source. However, because you are also a victim, you are unlikely to face legal consequences if you can show that your device was compromised. Still, it is your responsibility to secure your devices, so take steps to prevent this.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.

More cards in this drawer

The whole Numbers and Powers drawer →