> ## Content Index
> Fetch the complete content index at: https://www.ostering.com/llms.txt
> Use this file to discover other available public pages before exploring further.
# Cameras and Doorbells
- URL: https://www.ostering.com/taxonomies/smart-home/oph-cameras-and-doorbells/
- Published: 2026-11-05T21:00:00.000Z
- Updated: 2026-11-05T20:53:11.329Z
- Description: Cameras and Doorbells: 13 smart home threats from the Open House taxonomy, with mitigation principles, design measures and STRIDE, CAPEC and CWE mappings.
- Author: Brett Crawley
[Smart Home Threat Taxonomy](https://ostering.com/taxonomies/smart-home/) › Cameras and Doorbells (OPH-CM)
Indoor and outdoor cameras, video doorbells, recorders and their clips put the inside of the house, and the people in it, on the network. Every flaw is a window into a private space.
## Where it sits in the house
The Cameras and Doorbells suit sits at the front door and inside the rooms, looking at the people who live there. It is suit 4 of 13, in the Things deck.
## The table
### Mappings
### Entries in text
- **OPH-CM-A Someone Else's Feed.** A cloud, cache or relay fault serves one household's live view, events or thumbnails to another household's app.
- **OPH-CM-K Default Login on the Recorder.** Cameras and recorders ship with default or weak credentials, or hidden support accounts, and are reachable from the internet through P2P services or port mappings.
- **OPH-CM-Q Stranger in the Camera.** Camera accounts protected by a password alone are taken over by credential stuffing, and the attacker watches and talks to the household through the camera.
- **OPH-CM-J Local Only That Isn't.** The product says video stays local or is end-to-end encrypted, but thumbnails, clips or face data still go to the cloud, unencrypted or viewable by URL.
- **OPH-CM-10 Insider Watches the Feed.** Vendor staff, contractors or support agents can view customer video, or an installer adds their own account to a customer system.
- **OPH-CM-9 Device ID Is the Password.** A vendor P2P SDK treats the device's UID as enough to connect, so anyone who learns a UID can impersonate the device or intercept its stream.
- **OPH-CM-8 Stream Open on the LAN.** RTSP and ONVIF streams answer on the home network without authentication or encryption, so any compromised device on the Wi-Fi can watch.
- **OPH-CM-7 Recording Without the Light.** The camera can stream or record with its indicator light off, under software control, so people in the room cannot tell they are being watched.
- **OPH-CM-6 Footage Shared Beyond the Owner.** Clips are shared through neighbourhood apps, police portals or links that never expire and can be guessed, and the owner cannot see who has them.
- **OPH-CM-5 Camera Sees the Neighbours.** Doorbells and outdoor cameras record the street, the neighbours' gardens and conversations by default, putting the household in breach of privacy law.
- **OPH-CM-4 Doorbell Off the Wall.** A video doorbell comes off the wall with a standard screwdriver, and its flash holds the home Wi-Fi password and account tokens in plain text.
- **OPH-CM-3 Alerts Until They're Off.** An attacker trips the motion alerts again and again, until the owner mutes them or turns the camera off, and then comes back.
- **OPH-CM-2 Clips Kept Forever.** Clips and event history are kept with no limit, so years of comings and goings, children and visitors sit in the account for anyone who gets into it.
† marks a physical-safety consequence. The full principle, measures and mappings for each entry are in the tables above and in the [downloads](https://ostering.com/taxonomies/smart-home/#downloads).
## Seen in the wild
- **OPH-CM-A Someone Else's Feed.** Wyze cameras showed other users' events (Sept 2023 and Feb 2024). [Wyze camera security issue showed 13,000 users other owners' homes (Engadget, Feb 2024)](https://www.engadget.com/wyze-camera-security-issue-showed-13000-users-other-owners-homes-140059551.html)
- **OPH-CM-K Default Login on the Recorder.** Mirai botnet (2016). [Hacked Cameras, DVRs Powered Today's Massive Internet Outage (KrebsOnSecurity, Oct 2016)](https://krebsonsecurity.com/2016/10/hacked-cameras-dvrs-powered-todays-massive-internet-outage/)
- **OPH-CM-Q Stranger in the Camera.** Ring camera takeovers (Dec 2019). [Family says Ring camera in 8-year-old daughter's room accessed by hacker (AP via TechXplore, Dec 2019)](https://techxplore.com/news/2019-12-family-camera-year-old-daughter-room.amp)
- **OPH-CM-J Local Only That Isn't.** Eufy cloud thumbnails and unencrypted streams (Nov 2022). [Eufy camera cloud security leak (9to5Google, Nov 2022)](https://9to5google.com/2022/11/29/eufy-camera-cloud-security-leak/)
- **OPH-CM-10 Insider Watches the Feed.** FTC action against Ring (2023); ADT technician case (disclosed 2020, guilty plea 2021). [FTC Says Ring Employees Illegally Surveilled Customers, Failed to Stop Hackers from Taking Control of Users' Cameras](https://www.ftc.gov/news-events/news/press-releases/2023/05/ftc-says-ring-employees-illegally-surveilled-customers-failed-stop-hackers-taking-control-users)
- **OPH-CM-9 Device ID Is the Password.** ThroughTek Kalay, CVE-2021-28372 (Mandiant, 2021). [Mandiant discloses critical vulnerability affecting millions of IoT devices](https://cloud.google.com/blog/topics/threat-intelligence/mandiant-discloses-critical-vulnerability-affecting-iot-devices)
- **OPH-CM-6 Footage Shared Beyond the Owner.** Ring disclosures to police without consent (2022). [Amazon Admits to Giving Police Ring Footage Without Owners' Permission (Nextgov, July 2022)](https://nextgov.com/analytics-data/2022/07/amazon-admits-giving-police-ring-footage-without-owners-permission/374480)
- **OPH-CM-5 Camera Sees the Neighbours.** Fairhurst v Woodard (England, 2021). [Fairhurst v Woodard, judgment (Oxford County Court, Oct 2021)](https://www.judiciary.uk/wp-content/uploads/2021/10/Fairhurst-v-Woodard-Judgment.pdf)
---
← Previous: [Domotics](https://ostering.com/taxonomies/smart-home/oph-domotics/) · [All suits](https://ostering.com/taxonomies/smart-home/) · Next: [Alarms and Locks](https://ostering.com/taxonomies/smart-home/oph-alarms-and-locks/) →
*Smart Home Threat Taxonomy v1.0 · © 2026 Jonathan Brett Crawley · Licensed under CC BY-NC-ND 4.0 with [additional permissions](https://ostering.com/taxonomies/smart-home/#licence).*