Can baby monitors be hacked? What the evidence says

Yes, it has happened: the documented cases

Baby monitors have been hacked, and the record is public. Four cases are enough to see the pattern, and each one comes from a regulator or a security research team rather than a news story.

Year	What happened	Root cause	Source
2013	Live feeds from nearly 700 TRENDnet cameras were posted online, showing “babies asleep in their cribs, young children playing”	Faulty software let anyone view a camera without a password	FTC settlement, 4 September 2013
2015	Rapid7 tested video baby monitors from several makers and disclosed ten new vulnerabilities (CVE-2015-2880 to CVE-2015-2889)	Hardcoded backdoor credentials, authentication bypass, unencrypted traffic	Rapid7 case study, September 2015
2016	The Mirai botnet took over hundreds of thousands of cameras and routers and used them for record-size attacks	Default usernames and passwords that owners never changed	CISA alert TA16-288A
2023	Ring agreed to pay $5.8 million after hackers took over cameras and employees viewed customers’ videos	Credential stuffing with no two-factor sign-in; weak internal access controls	FTC order, 31 May 2023

In the TRENDnet case the FTC said the company’s “faulty software” left cameras “open to online viewing”, and “hackers posted links to the live feeds of nearly 700 of the cameras” (FTC, 2013).

The Rapid7 study is the most detailed look at baby monitors specifically. Five of the seven products named in the report shipped with backdoor credentials, meaning a username and password baked into the device that an owner cannot change (Rapid7, 2015). The summary was blunt: “it is rare to find an IoT device that doesn’t exhibit at least one critical failing” (Rapid7, 2015). Only one vendor in the study, Philips, replied with a timeline for a fix.

The Ring case shows the other side of the problem: the vendor itself. The FTC charged Ring with “allowing any employee or contractor to access consumers’ private videos”, and with failing to stop credential-stuffing attacks that reached the accounts of “approximately 55,000 U.S. customers” between 2019 and 2020 (FTC, 2023). Hackers used the cameras’ speakers to threaten families and taunt children. Ring did not add two-factor sign-in until 2019, after attacks in 2017 and 2018.

How the attacks work

Nearly every documented case needed one of five openings, and each opening has a plain fix. None needs a skilled attacker; most openings are found by automated scanning.

Attack	What it needs	What stops it
Default or reused password	A camera still on “admin / admin”, or a password you also use elsewhere	A unique password of at least 8 characters, never reused (NIST, 2017)
Credential stuffing	A list of passwords leaked from another site, tried against the camera’s cloud login	Two-factor authentication, so the password alone is not enough
Unpatched firmware	A known bug in the camera’s software that was never fixed on your unit	Automatic updates turned on; a vendor that still ships updates
Exposed ports or UPnP	The camera asks your router to open a door to the internet, and the router obeys	UPnP and port forwarding disabled on the router (NCSC, 2020)
Insider access at the vendor	A cloud service that stores your video and lets staff open it	A product that never holds your video, or strict access controls you can read about

Two terms need defining. Credential stuffing is when an attacker takes email-and-password pairs leaked from one site and tries them on another; it only works if you reused the password. UPnP (Universal Plug and Play) is a router feature that lets a device open its own hole in your firewall without asking you; it is convenient for games consoles and dangerous for cameras.

The Mirai botnet shows how little skill is needed. CISA’s alert says “The Mirai bot uses a short list of 62 common default usernames and passwords to scan for vulnerable devices” (CISA, 2016). That list was enough to take over hundreds of thousands of cameras whose owners had never changed the factory password.

How likely is it for a normal family?

Honest answer: a targeted attack on your family is rare, an opportunistic scan of your camera is routine, and nobody publishes a per-household number. The two kinds of risk are different, so they are worth separating.

A targeted attack means someone wants to see your child in particular. Those cases exist, but they are the minority in the record, and they usually involve someone who already knows the family and the password.

An opportunistic attack means a program scans the whole internet for cameras with a known weakness and takes whichever it finds. That is how Mirai worked: the malware “continuously scans the Internet for vulnerable IoT devices, which are then infected” (CISA, 2016). It is also how the Ring accounts were taken: the attackers had leaked password lists, not a grudge against any one family. In 2015, Rapid7 wrote that it was “not aware of specific campaigns of mass exploitation of consumer-grade IoT devices” (Rapid7, 2015). Mirai arrived a year later and settled that question.

So the realistic risk is not a hacker choosing you. It is your camera being one of the easy ones when a scan goes past. The checklist below takes you off the easy list in about fifteen minutes.

The 15-minute checklist

These eight steps remove the openings in the table above. Most are in the camera’s app; two are on your router. Do them tonight, in this order.

1. Set a unique password for the camera’s account and for the camera itself. At least 8 characters, and not one you use anywhere else. NIST’s guidance adds that verifiers should check new passwords “against a list that contains values known to be commonly-used, expected, or compromised” (NIST, 2017); if the app refuses a password, that is why.
2. Turn on two-factor authentication in the camera’s app. This is the single change that defeats credential stuffing.
3. Update the firmware and switch on automatic updates. The NCSC’s advice is to “switch on the option to install software updates automatically” (NCSC, 2020).
4. Disable UPnP and port forwarding on your router. The NCSC recommends you “consider disabling UPnP and port forwarding on your router” (NCSC, 2020); the setting is usually under Advanced or Security in the router’s admin page.
5. Put the camera on a separate Wi-Fi network. Most routers offer a guest network. A camera on the guest network cannot see your laptops and phones if it is ever compromised.
6. Review who has access to the camera’s account. Remove the babysitter from two years ago, the old phone, and any shared login.
7. Turn off cloud recording and remote viewing you do not need. If you only watch from inside the house, the NCSC says that “we recommend you disable it” (NCSC, 2020). Less stored video means less to leak.
8. Cover or unplug the camera when not in use. A camera that is off cannot be watched.

If you can only do three, do 1, 2 and 3. They cover the openings behind every case in the table at the top of this page.

What the architecture changes

Some of the risks above cannot be fixed with a setting, because they come from how a product is built. Two design choices remove whole categories of attack rather than reducing them.

No account means nothing to credential-stuff. Credential stuffing needs a login page that accepts an email and a password. A product with no accounts has no such page, so a leaked password list has nothing to try. There is also no password for you to reuse, no profile for the vendor to lose, and no “forgot password” flow for a stranger to abuse. Pairing is done between the two devices directly, for example by scanning a code, and the baby-side device decides who gets in.

End-to-end encryption means the vendor cannot leak what it never holds. End-to-end encryption, often written E2EE, means the two devices agree on the keys between themselves; the video is encrypted on one device and decrypted only on the other. A relay in the middle, the vendor’s servers and your internet provider all see scrambled data they cannot read. The Ring case was possible because the videos sat on Ring’s servers in a form staff could open (FTC, 2023). When the stream is encrypted end to end and never stored, that class of insider risk disappears, because there is nothing on the server to view.

The standard most real-time apps use for this is DTLS-SRTP, the same protocol family behind encrypted video calls. The practical test is simple: ask whether the vendor could show your video to its own staff if a court told it to. If the vendor never has the video, the answer is no, and the architecture is doing the work.

Are radio (DECT/FHSS) monitors safer?

Safer from the internet, yes. Private, not necessarily. A radio monitor has no Wi-Fi and no account, so none of the attacks in the table above apply; nobody in another country can reach it.

What it does not give you is encryption. FHSS (frequency-hopping spread spectrum) is a radio technique that jumps between channels many times a second. It makes a signal harder to follow and reduces interference. It is not a cipher, and marketing that calls hopping “secure” is describing something else. Whether a given model encrypts at all is in its manual, and many manuals do not say.

DECT monitors do encrypt, but the standard cipher is weak. In a 2012 doctoral thesis, Erik Tews reverse-engineered the DECT algorithms; the abstract states that an “attack against the DECT radio protocol is described, that decrypts encrypted DECT voice calls” (Tews, 2012). The attacker still has to be within radio range of your home, which is a far smaller group than the whole internet. The honest summary is: a radio monitor swaps a global risk for a local one.

When to replace a monitor

Replace a monitor when its maker stops updating it, when it still cannot do two-factor sign-in, or when it was named in a security advisory and never patched. A camera that cannot be fixed is a camera you cannot make safe.

Signs that it is time:

• The app has not been updated for more than a year, or the maker no longer lists the model.
• The camera still ships with a fixed username and password that you cannot change. Rapid7 found this in five of the seven products it named, and the report notes such accounts are “either difficult or impossible to disable under normal usage” (Rapid7, 2015).
• There is no two-factor option in the app at all.
• Remote viewing cannot be turned off, so the camera is always reachable from the internet.
• You have reason to think someone else had the password, and you cannot change it or review account access.

Old monitors do not have to go in the bin. Many families use an older iPhone or iPad they already own instead, which gets security updates from Apple for years; see using an old iPhone as a baby monitor and app vs dedicated monitor for the trade-offs.

Where Nanuka fits

Nanuka is a baby monitor app for iPhone and iPad, and we built it around the two architectural choices above. This section is written by the team that makes it, so read it with that in mind.

Nanuka has no accounts, no sign-up and no password. Devices are paired directly to each other with a QR code or a short code, and the Baby Station must approve the request before anything streams. There is no login page, so there is nothing to credential-stuff and no profile of you for us to hold, lose, or be asked to hand over. The live stream is encrypted end to end with DTLS-SRTP and travels directly between your two paired devices. It is never stored, recorded, transcoded or played back on any server, including ours. When your home network will not allow a direct connection, the encrypted stream is bounced through a relay we run, which forwards packets it has no key to read. You can compare a short verification phrase on both devices to confirm you are connected to the device you think you are. Where the video goes, step by step, is in where does baby monitor video go.

What Nanuka needs: two Apple devices running iOS 16 or later (one Baby Station, one Monitoring Station), and an internet connection on both.