I have recently bought a cheap £20GBP IP camera from an online store. It is branded as "aobo" but the logo was just stuck on and it appears to be a generic model which I have seen for sale under several different brands. enter image description here

The camera uses a default username and password and is accessed using an app called "iSmartViewerPro". There appears to be nowhere in that app where you can change the username or password and once the app is connected to the camera it is possible to view and control the camera from anywhere (even when not on the same network).

I have connected to my router to get the local IP address for the camera and I have tried to access that address in my browser, I am presented with a login box :

The server ##.##.##.## is asking for your username and password, The server reports that this is from IPCamera Login.

I tried the default username on the camera but that is not accepted - so it appears that there would be a different login for the web interface.

So, my question - should I be sceptical about this camera? How am I meant to know that it is secure / or is there anything I can do to restrict access to it?

  • Without an exact product model that's hard to say... – Tensibai Sep 27 '17 at 9:36
  • We can't tell you how to use some random piece of hardware. Look for manuals from the vendor. Hardcoded credentials is always a problem, but you appear to know that already. – schroeder Sep 27 '17 at 9:36
  • 1
    Short answer to title question: no. – schroeder Sep 27 '17 at 9:39

As you've identified it has unchangeable default credentials, this is the point i'd unplug and throw it away. Your alternative is to firewall it off, make it accessible only from your own private network and VPN in to your network to use it.

You may find this interesting https://www.exploitee.rs/index.php/AOBO_Hidden_Spy_Camera_720P

As well as default creds, it has open telnet and ftp and creates its own wireless access point. So to answer your question, no, this is not secure.

  • I did try to telnet on to it but couldn't connect - not sure if that was a good thing or not. I tried to setup a rule on my router but even blocking the destination IP still allowed access to it in the app over 3G. Its been packaged up ready to be returned. Thank you. – wf4 Sep 27 '17 at 10:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.