The Grocery Store Camera on the Public Internet
A neighbourhood grocery store installed six IP cameras and a DVR in 2018. The installer enabled remote viewing by forwarding ports 80, 554 and 8000 on the shop's broadband router to the DVR, left the DVR on admin/admin, and set the same password on the vendor's cloud viewing app, which has no multi-factor authentication. The billing computer, which stores customer names and phone numbers for a loyalty scheme, sits on the same unmanaged switch as the cameras. Last week a customer found a live view of the shop's billing counter on a website that indexes insecure cameras. The DVR log shows 14 successful logins from three foreign IP addresses in four days, and the owner has just bought an AI 'people counting' add-on that uploads ten-second clips to the vendor's cloud under a click-through agreement. The owner wants to change the admin password and 'move on'.
1. Assess what the foreign logins most likely mean, and list the containment steps you would take before changing any password.
Read the worked answer
The 14 successful logins from three foreign addresses most likely mean the default admin/admin credential was used by an automated scanner and then by a human. The attacker may have viewed live and recorded footage, changed DVR settings, created another account, or enabled a DDNS or email alert that survives a password change. The public indexing of the feed confirms that live video was exposed beyond the shop.
Before changing the password:
- Photograph and export the DVR log, including source IPs, usernames and timestamps; hash the export.
- Remove the port-forwarding rules at the router and disable UPnP; this cuts the exposure immediately.
- Disconnect the DVR from the shop LAN while preserving its storage, or block it at the switch if the switch supports it.
- List existing DVR users and look for unknown accounts, changed ports, DDNS settings and firmware changes.
- Check the billing computer and loyalty database for signs of access from the camera network.
- Notify the owner and preserve evidence before wiping or resetting.
Changing the password first can tip off the attacker and may not remove a hidden account. Containment comes before credential rotation.
2. Propose a secure remote-viewing design and the priority order of changes.
Read the worked answer
Design: remove all inbound port forwarding and place the cameras and DVR on a dedicated IoT VLAN with no route to the billing computer and no direct internet access. For remote viewing, use the vendor cloud with a unique strong password and MFA, or a VPN such as WireGuard hosted on a small router, so the DVR is never directly reachable from the internet. Replace the DVR if it no longer receives firmware updates.
Priority order:
- Remove exposure: delete port forwarding, disable UPnP and remote management from the WAN. This is free and takes minutes.
- Evict the intruder: audit accounts, remove unknown users, update firmware, then set unique credentials and enable MFA on the cloud app.
- Segment: move cameras to an isolated VLAN or a separate router; block inter-zone traffic; give the billing PC its own protected segment.
- Harden and monitor: disable unused services, set password policy, enable logs and review them, and document the AI add-on's data flows.
Reasoning: the largest risk is direct internet exposure, so it is fixed first. Segmentation limits what a future camera compromise can reach, and monitoring detects recurrence.
3. What should the owner ask the AI vendor, and what does Indian data protection law require here?
Read the worked answer
Questions for the vendor: What exactly is collected-video, audio, face templates, people counts? Where is it stored and for how long? Is it used to train models, and can the owner opt out? Who are the sub-processors and in which countries are they located? How is access controlled and logged? What happens on deletion, and how quickly? What is the breach-notification commitment? Does the click-through agreement actually create a data-processing contract?
Indian law: the DPDP Act, 2023 applies to personal data of customers and staff. The store must give a clear notice and obtain consent for the loyalty data and for any identifiable video processing, use the data only for the stated purpose, keep it secure, erase it when the purpose ends, and notify the Data Protection Board and affected persons of a personal data breach. The AI vendor is a data processor, so the store remains accountable and needs a written contract with security and deletion terms.
Practical advice: do not enable the AI add-on until the vendor answers these points; disable audio recording; set a short retention period; and treat the loyalty database as a separate high-value asset that must not share a network with cameras.