Data security company Rapid7 released a new study this week which exposed several vulnerabilities in popular video baby monitors. Video baby monitors allow parents to monitor their children remotely and may be used to connect distant family members with the newest members of their family. The research tested ten standard video-based baby monitors for six potential vulnerabilities and found various levels of security and privacy issues in each device. 

A primary concern revealed in the study is that different baby monitors exhibited different levels of potential unauthorized access. Some of the baby monitors were vulnerable to unauthorized access by someone with physical access to the device, while other devices required access to the family’s home network. A subset of devices exhibited security loopholes which could potentially be exploited by an attacker through the internet. 

Additional security vulnerabilities exposed in the report include a lack of encryption for local and remote communication as well as recorded data, potentially exposing recorded footage from the devices. Furthermore, as baby monitors are not typically considered to be a potential security threat, default access credentials such as usernames and passwords were often unchanged by users or easy to decipher by cyber criminals. Here is a list of the affected devices:

The research paper goes beyond baby monitors and raises general questions about the security of the Internet of Things. Internet of Things (IoT) refers to devices that contain a CPU, memory, run software, and communicate with other devices, such as smart fridges, smart cars, and other products which integrate our physical lives with computer-based systems. This study is a good reminder that something as simple as a baby monitor is still a networked device. As more of us integrate our home and work devices, “a compromise on an otherwise relatively low-value target – like the video baby monitors covered in this paper – can quickly provide a path to compromise of the larger, nominally external, organizational network.”