Retail IP Cameras, Default Passwords, and Flat Networks
A chain of three pet supply stores uses eight IP cameras per store, a central network video recorder (NVR) in each store, and a cloud viewing service. The cameras ship with the same default admin password, and firmware has not been updated in three years. The store manager can view cameras from home through a vendor-provided web portal that uses only a username and password; the same password is reused for the point-of-sale back office. The NVR keeps 30 days of footage on a 2 TB drive, and footage is exported to USB drives when incidents occur. Recently, a camera was found communicating with an unknown IP address at 3 a.m., and an employee reported that camera footage from the stockroom had been viewed by someone outside the company. The stores have no VLANs; cameras, POS terminals, and guest Wi-Fi share one flat network.
1. Map the likely attack path and rank three fixes.
Read the worked answer
The likely path is internet scanning or vendor-portal credential guessing, then login with default or reused camera credentials, then lateral movement across the flat network. Because cameras, POS terminals, and guest Wi-Fi share one network, an attacker on a camera can reach the back office and possibly the NVR. The 3 a.m. outbound connection suggests the camera is already compromised or contacting command-and-control. Fix 1: change default credentials immediately, give each camera a unique password, and enable MFA on the vendor portal. Fix 2: isolate cameras and NVRs on a separate VLAN with no route to POS or back-office systems; allow only the minimum cloud viewing traffic. Fix 3: update firmware, disable unused services such as UPnP and port forwarding, and replace cameras that no longer receive updates. Ranked this way because credential compromise is confirmed, segmentation limits blast radius, and firmware closes known holes. The reused POS password must also be rotated.
2. How should NVR storage and the footage-export process be controlled?
Read the worked answer
Restrict NVR administration to named accounts, not a shared store password. Keep the NVR on the camera VLAN and block direct internet access. Enable disk encryption if the NVR supports it, and physically lock the NVR and its network port. Retention should follow a defined policy, for example 30 days, with automatic overwrite and an exception process for legal holds. Export only when there is a documented incident. Use a dedicated evidence USB drive, record who exported what and when, hash the file if possible, and store the drive in a locked cabinet. Wipe or destroy export media after the retention period. Review who can view live and recorded footage, especially the stockroom, and log cloud-viewing access. The goal is confidentiality and integrity of evidence, not just keeping 30 days of video.
3. What immediate steps should be taken after the suspected unauthorized footage viewing?
Read the worked answer
Preserve evidence first: do not power off or wipe the NVR or camera if logs would be lost; isolate the device from the network instead. Export and hash relevant logs, including cloud portal logins, camera access logs, and NVR audit logs. Identify which accounts were used and from which IP addresses. Reset camera and portal credentials, revoke active sessions, and enable MFA. Check whether the reused POS password was used elsewhere and rotate it. Notify legal or privacy owners because footage of employees may be personal data; assess whether notification is required. Interview the reporting employee and document the timeline. Then remediate the network segmentation and firmware issues so the same path cannot be reused. Keep a chain-of-custody record for any exported footage.