IoT and CCTV Camera Hacking at Home

A camera in a living room in Indore is streaming to a Telegram group in another country. Nobody broke in. The installer opened a port on the router so the family could watch the feed from their phones, the DVR still had the password it shipped with, and an automated scanner found it within days. CCTV hacking in India mostly looks like this: not a skilled intrusion, but a door that was never locked, found by a machine that tries every door.

This guide explains how cameras, baby monitors and other connected devices get taken over, what is done with the footage, the law that applies, and a fix list that takes about ten minutes per device.

How CCTV hacking actually happens

A camera or a DVR (the box that records several cameras) is a small computer running software that is rarely updated. It gets taken over in one of four ways, and the first two account for most cases.

1. The default password

Devices ship with a username and password printed in the manual, and the same pair on every unit sold. Installers often leave it, or set something like the shop's name. Lists of default credentials for every brand are public. If the device is reachable from the internet, logging in is a matter of trying the list.

2. Port forwarding and UPnP

To let the phone app work from outside the house, installers configure the router to forward a port to the DVR, or the DVR asks the router to do it automatically through UPnP. Either way the device now answers to the whole internet. Scanners sweep every address continuously for the ports cameras use, catalogue what they find, and feed the results to anyone who asks. Your camera is not targeted; it is indexed.

3. Old firmware with known flaws

Camera and DVR software has had serious vulnerabilities published for years, some allowing access without any password. Manufacturers release fixes; most devices never receive them, because nobody checks. A flaw disclosed years ago still opens a large share of Indian installations today.

4. The cloud account

Newer cameras avoid port forwarding by relaying through the vendor's cloud. That moves the risk to the account: an email and password reused from a site that leaked, tried by a script, logs into your camera from anywhere. Credential stuffing of camera accounts is now a routine attack, and the fix is the same as for any account, a unique password and two-factor authentication.

What is done with the footage

Three things, in rough order of frequency. The feed is added to a catalogue of open cameras that people browse for amusement, which is why living rooms and shop floors appear in public streams. Footage from bedrooms, changing rooms, clinics and hostels is cut and sold or posted, sometimes with the location, in channels on messaging platforms; the people recorded almost never know. And the recording is used for extortion: a message arrives with a clip and a demand, following the same script as the sextortion scams, with the difference that the victim never made a video call.

Compromised devices are also conscripted into botnets that attack other targets, which is why CERT-In's botnet cleaning centre exists. An infected camera on your network is a problem for you even if nobody is watching through it.

The ten-minute fix list, per device

The same list applies to baby monitors, smart doorbells, smart plugs, Wi-Fi speakers and the television. The Telecommunication Engineering Centre has published a code of practice for securing consumer IoT that sets out what manufacturers should do; the list above is the household version. For a wider personal checklist, see the personal cyber safety checklist.

For landlords, hostels, clinics and small shops

Institutions have two extra duties. Cameras recording other people create personal data under the DPDP Act 2023, so a clinic or a hostel that leaks footage is a data fiduciary that has suffered a breach, with notification obligations. And installers rarely stay responsible: get the installer to document every device, its password and whether any port is exposed, and have someone on your side verify it. A clinic's cameras should never cover examination or changing areas, and a hostel's should never cover rooms. Tenants are entitled to know where cameras are and who can view them.

If a camera has been compromised

1. Disconnect the device from power and network. Do not factory-reset yet; the logs may show when and from where it was accessed.
2. Photograph the settings pages, export any access logs, and note the device model and firmware. The evidence preservation guide explains how to keep this usable.
3. If footage has been posted or used for extortion, report on the platform and on cybercrime.gov.in, and go to the cyber police station. Section 66E of the IT Act covers capturing or publishing images of a private area without consent; voyeurism under the BNS and the obscenity provisions of the IT Act can apply. The sequence is in how to report cyber crime; women will also find the women's online safety guide useful on takedowns and the NCW route.
4. Only then reset the device, update it, and go through the fix list before reconnecting.

If you are not confident doing this yourself, or you suspect more than one device, a personal device and privacy audit checks the router, every camera and the cloud accounts in a single visit. People who want to understand how scanners find exposed devices, and how to test their own network the way an attacker would, can start with ethical hacking foundations. CERT-In's advisories on consumer device vulnerabilities are worth following if you run more than a couple of devices.