Most people in Lebanon who install security cameras want one thing: to see their home from their phone, wherever they are. Very few ask the question that matters just as much: if I can reach my cameras from anywhere, who else can? Exposed cameras are cameras and video recorders that anyone on the internet can find and reach. Not hacked, not yet. Simply sitting there, answering whoever knocks.
As a cybersecurity architect who has spent years securing banks and enterprise networks, and who installs camera systems in Lebanese homes, I see the same pattern again and again. This article explains how exposed cameras happen, why they are so common here, and the three checks that tell you in a few minutes whether yours is one of them.
What “exposed” actually means
An exposed camera is not necessarily a hacked camera. It means the device is reachable from the open internet, with nothing between it and a stranger except its own login page.
That matters because the internet is scanned constantly. Specialised search engines index every device that answers, the same way Google indexes web pages, and anyone can search them by country, brand or port. If your recorder answers, it can be found in seconds, by researchers and by attackers alike.
What happens next depends on the device. A recorder with a strong unique password and current firmware will usually turn the visitor away. A recorder still on its factory password, or running firmware with a known flaw, will not.
This is not a theoretical risk
In 2016 the Mirai botnet spread through cameras, video recorders and routers that were reachable from the internet and still used default passwords. Researchers measured it at a peak of around 600,000 infected devices (USENIX Security 2017, “Understanding the Mirai Botnet”). Those ordinary home and office devices were then used to knock major websites offline.
Passwords are not the only problem. In 2021 a flaw was published in a range of Hikvision cameras that let an attacker run commands on the camera without logging in at all. It is rated 9.8 out of 10 for severity and is listed in the US government’s catalogue of vulnerabilities known to be exploited in real attacks (NIST, CVE-2021-36260). Hikvision released a fix, but a camera that is never updated keeps the flaw forever, and Hikvision and Dahua are among the most common CCTV brands sold in Lebanon.
For a homeowner, the realistic consequences are simple and unpleasant: someone watching your cameras, learning when the house is empty, deleting recordings, or using your recorder to attack someone else.
How exposed cameras happen in Lebanon
Almost no one exposes a camera on purpose. It happens through a few habits that are very common in the local market.
Port forwarding for remote viewing
The quickest way to let an owner watch cameras from a phone is to open a port on the home router that points straight to the recorder. It works on day one, the client is happy, and the job is done. It also places the recorder on the public internet, permanently, for everyone.
Automatic port opening (UPnP)
Many routers and recorders support a feature called UPnP, which lets a device open ports on the router by itself. Nobody configures anything, and nobody knows it happened. A recorder can become one of the exposed cameras on the internet without anyone touching the router.
Factory passwords that never change
Systems are often handed over with the default admin account still active, or with one simple password reused across an installer’s customers. Combined with an open port, that is the exact recipe Mirai used.
Firmware that is never updated
A recorder is installed, mounted in a cabinet and forgotten. Years later it still runs the software it shipped with, including every flaw discovered since.
Owners who live far away
Many Lebanese homes are watched by owners living abroad, or by family checking on parents and empty houses. Remote access is a real need here, not a luxury. It can be done safely, as we explain in our guide to managing your home in Lebanon from abroad. Done in a hurry, it is how most exposed cameras happen.
What other countries already require
Some markets no longer leave this to the buyer. Since 29 April 2024 the United Kingdom requires consumer connectable products to meet baseline security rules (UK Government, Secure by Design). Passwords must be unique per product or set by the user, and must not be easily guessable (PSTI Regulations 2023, Schedule 1). In Europe, the ETSI EN 303 645 standard sets the same baseline for consumer IoT devices, including software that can be kept updated.
Lebanon has no equivalent rule today. Until it does, the responsibility sits with two people: the one who buys the camera and the one who installs it.
Is yours one of the exposed cameras? Three checks
- Ask how you view your cameras remotely. If setup involved “opening a port”, typing an IP address or a number like :8000 into the app, your recorder is very likely reachable from the internet. Check your router’s port forwarding page and switch off UPnP unless you know you need it.
- Look up your own home connection. Search “what is my IP” on a phone connected to your home Wi-Fi, then look that address up on a device search engine such as Shodan. If it lists a camera, DVR or NVR, that is your system, visible to anyone. Only ever look up your own address.
- Check the password and the firmware date. If you never set the recorder’s password yourself, assume it is still the default or one your installer reuses. In the recorder’s settings, find the firmware version and its date. Anything more than a year or two old needs updating.
If any of the three worries you, our full guide to securing smart devices in Lebanon walks through every setting step by step.
The safe way to watch your cameras from anywhere
You do not have to give up remote viewing. You only have to stop opening the front door to everyone.
- Use a VPN into your home network. Your phone connects through an encrypted tunnel first, then sees the cameras as if you were at home. The router keeps no ports open to the world.
- Or use the manufacturer’s secured cloud app, with a strong unique password and two-step verification turned on. It is convenient, but your footage then travels through the vendor’s servers. We explain that trade-off in our article on smart home privacy.
- Put cameras on their own network, separate from your family’s phones and laptops, so a weak camera cannot become a path into everything else.
- Update firmware on a schedule, and replace recorders the manufacturer no longer supports.
Our security installation team sets up every Newcleo camera system this way by default, and can audit and fix an existing system without replacing the cameras.
For shops, clinics, offices and hotels
Businesses run the same recorders as homes, usually with more cameras and more sensitive footage. An exposed recorder on a business network is also a way in to everything else on that network: accounts, point of sale, guest data. Our managed cybersecurity service includes IoT and smart building security assessments for exactly this case.
Measuring the problem in Lebanon
We are measuring how many cameras and recorders in Lebanon are currently exposed to the internet, using the same search engines security researchers use, counting devices only and never accessing any of them. The results will be published on this page. Journalists and researchers who want the figures when they are released can contact us.
About the author
Firas Abdel Dayem is a Cybersecurity Architect with a background in banking security and managed security services, and the founder of Newcleo Technologies, a smart home and security integrator based in Zahle, Lebanon, working since 2015. Read his story.
Frequently asked questions
Does exposed mean my camera has been hacked?
No. Exposed means it can be found and reached from the internet. Whether someone can get in depends on its password and firmware. Exposure is the open door, not the break-in.
My installer set up remote viewing. Is my system exposed?
Not necessarily. If remote viewing works through a VPN or the manufacturer’s secured app with no ports opened on your router, it usually is not. If a port was opened or UPnP is on, it very likely is. Check 1 and Check 2 above will tell you.
Is it legal to look up exposed cameras?
Looking up your own internet address to see what it exposes is a normal security check. Trying to log in to a device you do not own is not, so never do it.
Can I still watch my cameras from abroad safely?
Yes. A VPN or a properly secured vendor app gives you the same view without leaving the recorder open to everyone.
How do I know if my exposed cameras have already been accessed?
Most recorders keep a login log. Look for logins at times you were not using it, or from countries you do not recognise. If you find any, change every password, update the firmware, close the open port and switch off UPnP.
Not sure whether your system is one of the exposed cameras? Ask Newcleo Technologies for a camera security check.