Breached webcam and baby monitor site flagged by watchdogs

The public is being warned about a website containing thousands of live feeds to baby monitors, webcams and CCTV systems.

Data watchdogs across the world have drawn attention to the Russian-based site, which broadcasts footage from systems using either default passwords or no log-in codes at all.

The site lists streams from more than 250 countries.

It currently provides 500 feeds from the UK alone.

They include what appear to be images from:

an office in Warwickshire a child's bedroom in Birmingham a home's driveway in Nottinghamshire a gym in Manchester, a pub in Salford a shop interior in London

Some of the feeds showed a static image but did not otherwise appear to be working.

Camera owners are being urged to check their equipment and set hard-to-guess passwords containing a mixture of lower and upper case letters, numbers and other characters.

The privacy watchdogs have provided the name of the site to the media, however the BBC has opted not to publish it.

The UK's Information Commissioner's Office acknowledged that other members of the press might reveal the details, guiding people to the feeds.

'The bigger risk for ourselves is that people continue to use unsecure passwords,' a spokesman told the BBC.

'The underlying problems with this don't just relate to this one webcam site, but potentially to anyone who uses a default password on any device.'

'If there's an example that shows the dangers of using default passwords that we think could be used as a way of getting that message out there and saying this is a major problem... [then it's] a good opportunity.'

Password problems

The site in question lists the feeds both by country and by device manufacturer.

China-based Foscam was the most commonly listed brand, followed by Linksys and then Panasonic.

'We are still trying to determine which Linksys IP cameras are referenced on the site,' said a spokeswoman from the US firm.

'We believe they are older Linksys IP cameras which are no longer being manufactured.

'For these cameras we do not have a way to force customers to change their default passwords. We will continue to educate consumers that changing default passwords is extremely important to protect themselves from unwanted intruders.

'Our newer cameras display a warning to users who have not changed the default password; users receive this warning whenever they log into the camera, until they set a new password.'

Foscam and Panasonic have yet to respond.

This is not the first time problems with Foscam cameras have been highlighted. In 2013, a family based in Houston, Texas revealed that they had heard a voice shouting lewd comments at their two-year old child coming out of their Foscam baby monitor.

The company provided a software fix the same year that prompted owners to revise default login credentials, but many owners are unlikely to have installed it.

For now, the ICO said it was unable to halt the Russian website or others like it beyond the UK's borders.

'If a website in the UK did this we would take action against it because firstly it's a breach of the Data Protection Act because you are accessing people's information and you shouldn't be, and secondly there are also issues around the Computer Misuse Act as well,' the spokesman added.

Password tips:

The University of Surrey's Prof Alan Woodward is among security experts who have suggested internet users should now update their login details.

He suggests the following rules should be observed when picking a new password.

Don't choose one obviously associated with you

Hackers can find out a lot about you from social media so if they are targeting you specifically and you choose, say, your pet's name you're in trouble.

Choose words that don't appear in a dictionary

Hackers can precalculate the encrypted forms of whole dictionaries and easily reverse engineer your password.

Use a mixture of unusual characters

You can use a word or phrase that you can easily remember but where characters are substituted, eg Myd0gha2B1g3ars!

Have different passwords for different sites and systems

If hackers compromise one system you do not want them having the key to unlock all your other accounts.

Keep them safely

With multiple passwords it is tempting to write them down and carry them around with you. Better to use some form of secure password vault on your phone.