Fifteen years ago, the internet of things (IoT) was in its wild west phase. Consumers and small businesses began buying cheap IP cameras to monitor their homes, stores, and parking lots. However, these devices were rarely secured.
Many of these cameras shipped with default usernames and passwords (like admin/admin), or no password at all. Furthermore, their web interfaces were designed to be accessed directly via an IP address. Because search engine crawlers constantly scan the web to index pages, they found these open IP addresses and indexed the video feeds just like they would index a standard blog post.
Typing inurl:viewerframe mode=motion into Google would yield pages of results showing: inurl viewerframe mode motion
It became a bizarre form of digital voyeurism and a stark lesson in IoT security.
While Google has closed the loophole, the underlying issue—unsecured devices connected to the internet—still exists. However, the tools used to find them have changed. Fifteen years ago, the internet of things (IoT)
Today, if a cybersecurity researcher wants to find unsecured cameras, they do not use Google. They use Shodan.
Shodan is a search engine specifically designed for internet-connected devices. Instead of crawling web pages, it scans the IP addresses of the entire internet and logs the metadata of the devices running on them (open ports, software versions, banners). While Shodan requires a paid subscription to view certain results and actively tries to prevent abuse, it is a chilling reminder that the spirit of viewerframe mode=motion is still alive. It became a bizarre form of digital voyeurism
The practice of using these types of queries raises ethical questions regarding privacy and security. While it may be used for legitimate purposes, there is always a risk of exploitation:
Despite the decline, Shodan (a search engine for internet-connected devices) still indexes thousands of devices with port:80 "viewerframe". Why?
In the OSINT community, finding exposed cameras raises a moral question: "Should I report it or ignore it?"
Responsible Disclosure Steps (If you accidentally find an exposed feed):
Fifteen years ago, the internet of things (IoT) was in its wild west phase. Consumers and small businesses began buying cheap IP cameras to monitor their homes, stores, and parking lots. However, these devices were rarely secured.
Many of these cameras shipped with default usernames and passwords (like admin/admin), or no password at all. Furthermore, their web interfaces were designed to be accessed directly via an IP address. Because search engine crawlers constantly scan the web to index pages, they found these open IP addresses and indexed the video feeds just like they would index a standard blog post.
Typing inurl:viewerframe mode=motion into Google would yield pages of results showing:
It became a bizarre form of digital voyeurism and a stark lesson in IoT security.
While Google has closed the loophole, the underlying issue—unsecured devices connected to the internet—still exists. However, the tools used to find them have changed.
Today, if a cybersecurity researcher wants to find unsecured cameras, they do not use Google. They use Shodan.
Shodan is a search engine specifically designed for internet-connected devices. Instead of crawling web pages, it scans the IP addresses of the entire internet and logs the metadata of the devices running on them (open ports, software versions, banners). While Shodan requires a paid subscription to view certain results and actively tries to prevent abuse, it is a chilling reminder that the spirit of viewerframe mode=motion is still alive.
The practice of using these types of queries raises ethical questions regarding privacy and security. While it may be used for legitimate purposes, there is always a risk of exploitation:
Despite the decline, Shodan (a search engine for internet-connected devices) still indexes thousands of devices with port:80 "viewerframe". Why?
In the OSINT community, finding exposed cameras raises a moral question: "Should I report it or ignore it?"
Responsible Disclosure Steps (If you accidentally find an exposed feed):