The Internet of Things is here, bringing with it devices that are mostly not that secure. We've published several cases of hacks into baby monitors over the years.
After numerous reports of hacked devices used to monitor babies, the New York Department of Consumer Affairs has launched an investigation into the baby companies that manufacture the devices in question and the security protocols they use.
According to a statement from New York City DCA Commissioner Julie Menin:
“Video monitors intended for parents who want to monitor their young children are not safe, as they provide easy access to any predator who wants to monitor what our children do and say.”
“Internet-connected devices like video surveillance screens are very convenient – but without the right safeguards, they pose serious privacy risks to those who use them. We encourage parents to take the appropriate steps to ensure their devices are secure and to demand that manufacturers make security a top priority.”
The Federal Trade Commission examined five popular baby monitoring devices and discovered that four of them were easily accessible to anyone.
Only one in five used a strong password, while the others used easy passwords like the ever-popular “password.”
Additionally, two of the five did not use any encryption between the display and the router, while the third had no encryption at all between the router and the internet.
Security company Rapid 7 had similar findings after testing 9 baby monitors.
“Eight out of the 9 cameras got an F and one got a D minus,” says security researcher Mark Stanislav of Rapid 7.
“Every device contains a hidden account that the consumer cannot change. Whether it is an administrator account or a support account, it gives backdoor access for hacks into the camera.”
