0

A good chunk of ip cameras come with an easy default password which is the same for all models. It usually is something like admin, 1234, root ...

The basic customer doesn't know that millions of ip are being scanned every seconds and that their ip camera will be discovered in minutes if not in seconds. Thus, the basic customer often does not change the default password.

Why are most ip camera manufacturers, which obviously know those fact since it's their business, not setting a different randomly generated password for each camera ?

Improve this question
7
  • 1
    You are assuming the cameras would be installed on the public internet with an external IP, which would be very unusual, especially for the "basic customer".
    – TTT
    Aug 18, 2018 at 13:53
  • @TTT Taking a look at shodan shows how much ip cam are connected to the public internet. Port forwarding is available on the most commons routers and easy enough for a basic customer to use.
    – Xavier59
    Aug 18, 2018 at 14:03
  • You might as well ask why companies produce software which has security problems, even though they could in theory know better. Maybe because they don't know better (i.e. have no idea that this might be a problem at all or don't consider this really a problem) even if you assume they do. Maybe because they care more about an easy setup to keep support costs down than they care about a secure setup. Don't assume that others see this as a serious problem just because most users at this site will see it this way.
    – Steffen Ullrich
    Aug 18, 2018 at 14:04
  • @SteffenUllrich I get it but in this particular case 1/ this is an obvious security flaw and they know it, otherwise, why mind setting a password at all ? 2/ I don't see a valid reason for which setting a random password instead of a default password would increase production cost.
    – Xavier59
    Aug 18, 2018 at 14:10
  • 1
    @Xavier59: Using a random password would mean that they could not just flash the same image on the device and ship the same documentation but that there need to be a unique way for each device where they set a device specific password, print it on some label and put it on the device or in the documentation. These are additional costs. And the alternative to enforce a password change on setup is already too complex for some customers and they will either fail doing this or set a trivial password or set a password they cannot remember later - and thus end up to be a burden for the support.
    – Steffen Ullrich
    Aug 18, 2018 at 14:18

2 Answers 2

Reset to default
2

Cost.

Configuring a random password per device, and including this in the documentation (e.g. a sticker or similar) costs money. People don't check such things as security before they buy; the main bullet points for ip cameras tends to be video quality and things like cell phone apps.

Thus security doesn't really give an advantage to a manufacturer, and they ignore it. In essence they externalize it - the customer has to pay the price of poor security.

Improve this answer
1

Because they expect the password to only be used during the initial installation phase and not permanently. If you've got security on the mind enough to have cameras installed, you should have the forethought to change the passwords after the installation to rule out the installation company of being that much more of a threat in knowing what it is and how to get in.

Granted, this isn't always the way it ends up working and the passwords usually get left at the default values, but it's at least what the intent is (probably).

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .