Yes, Your Webcam and Phone Camera Can Be Hacked

As with any device connected to the internet, your cameras are susceptible to hacking. While threat actors are often focused on big-ticket spying targets like critical infrastructure, individuals aren't immune. Your webcam, security camera, and even baby monitor can be exploited for any number of malicious purposes—but cybersecurity best practices can significantly reduce your risk.

Internet-connected cameras are vulnerable to hacking

Webcam hacking grants remote access to your device's camera, which allows bad actors to watch and record the camera view. This means that they can turn your camera on and off, see what the camera sees, and take photos and videos. The potential risks here include everything from snooping on your personal movements and private activities to recording footage for blackmail to "shoulder surfing" in order to steal data to tracking when you are home. Live feeds may also be shared or sold on the dark web, compromising your privacy, digital security, and possibly physical safety.

It's not just your phone and computer that are at risk. All kinds of internet-connected cameras commonly found in consumers' homes—security cameras, pet cams, baby monitors, and smart bird feeders, to name a few—can be hacked relatively easily. These cameras can be integrated into botnets or give threat actors access to other devices on your network. A recent report from cybersecurity firm BitSight (covered by 404 Media) found that content from more than 40,000 unsecured cameras had been exposed online, with researchers noting that this estimate is likely very conservative.

Surveillance camera networks are also widespread and pervasive in our day-to-day lives. The Electronic Frontier Foundation has outlined some of the ways in which video surveillance is conducted and used in cities across the country, from automated license plate readers to mobile surveillance towers. The data are accessible to law enforcement, of course, but these cameras have also been targeted by hackers with live streams exposed online. BitSight also found compromised cameras in public spaces, such as gyms and stores.

How hackers gain access to your camera

Webcam hacking on your phone or computer is primarily the result of malware that allows threat actors to remotely take over your device and gain access to your camera. These programs, like Remote Access Trojans (RAT), are typically delivered via phishing attacks that trick you into clicking links to download and install malicious apps.

Other cameras connected to the internet may be accessed remotely using the default manufacturer usernames and passwords, which are often publicly available. Weak credentials can also be brute-forced, and older devices that no longer receive security updates may be especially susceptible to hacking.

You can search your camera on Shodan.io, which scans for internet-connected devices, or try to access it from a device outside your home network without logging in through a secure app or VPN. If you're successful, your camera could be exposed.

There are also a handful of red flags that your webcam may have been compromised. An obvious one is that your camera indicator light is on or flashing when you're not actually using your camera, such as for a Zoom meeting or video call. Other signs of a malware infection include a fast-draining battery, suspicious or unfamiliar apps or files on your device, strange network activity, and unexpected changes in your webcam settings.

How to prevent your cameras from spying on you

Good cyber hygiene goes a long way toward protecting your devices from hackers. Be wary of clicking links found in emails, texts, social media posts, or other communication, as these may be phishing links used to spread malware that takes over your device. Never execute commands for CAPTCHA tests, a tactic commonly used in ClickFix attacks.

Keep your devices—including all internet-connected cameras—up to date with the latest firmware. Enable automatic updates if available, and check regularly for security patches that address vulnerabilities. Change the default usernames and passwords on your IoT cameras to something strong and unique (again, these defaults are often publicly known). Firewalls and VPNs are also useful tools for blocking unauthorized access to your network and devices.

This is also a good time to check which apps and services have access to your device's camera and disable any you don't recognize or that aren't essential to the app's functionality. Permissions are found in your device settings:

• Windows: Start > Settings > Privacy & security > Camera

• Mac: System Settings > Privacy & Security > Camera

• Android: Settings > Security & Privacy Privacy > Permission manager > Camera

• iOS: Settings > Privacy & Security > Camera

Finally, a low-tech form of protection is a webcam cover—or even a piece of tape—to block your camera's view when it's not in use.