The Personal Information Protection Commission urged users to change the default user account (ID) and password without fail, as hacking incidents targeting IP cameras, known as ‘homecams’, have occurred one after another.

The Personal Information Protection Commission announced on the 22nd that, together with related ministries, local governments, and major professional organizations, it will promote an ‘IP Camera Security Enhancement Public-Private Cooperation Campaign’. This is a follow-up measure to the ‘Plan to Advance the IP Camera Security Management System’ jointly announced by related ministries in December last year.

An IP camera is a camera connected to wired or wireless internet that can transmit video to other devices. It is used in homes, small businesses, medical institutions, and public facilities.

However, hacking incidents that exploit IP camera security vulnerabilities continue, so caution is needed. In particular, if users keep using default IDs such as ‘admin’, ‘root’, and ‘user1’, or initial passwords such as ‘0000’ and ‘123456’ without changing them, hackers can easily break in. This can lead to invasions of privacy in which the inside of a home or the daily routines of visitors to business sites are broadcast in real time to outsiders. At the end of last year, police arrested four suspects who had hacked 120,000 IP cameras in South Korea and sold the stolen footage on an overseas illegal website.

The Personal Information Protection Commission recommended changing the default ID and password before use, and continuing to change them periodically thereafter. In particular, a password should be set to eight or more characters, mixing the three types of letters, special characters, and numbers to make it hard to guess.

In workplaces where significant bodily exposure is clearly expected, external internet access to IP cameras should be restricted. In the case of bathhouses, restrooms, changing rooms, and saunas, the installation of IP cameras is prohibited under the Personal Information Protection Act.

When purchasing an IP camera, it is necessary to check whether the product has received information security certification from a domestic specialized institution. Products bought through overseas direct purchase without separate verification procedures may have difficulty receiving future security updates or after-sales support.

The Personal Information Protection Commission plans to use an ‘IP Camera Inspection Checklist’ to promote voluntary inspections and implementation of security measures for public facilities, medical institutions, and small businesses.