September 4, 2026
The Smart Camera That Joined Someone Else’s Botnet
The camera is “AI” now, which in retail language means it has a model and a cloud account. It also has a firmware team that ships late, a default password tradition, and a need to phone home to an ASN you have never read. When that box is on the same LAN as the laptop that does payroll, the botnet does not need to be clever. It needs to be adjacent.
The boring compromise path
Nobody hacks your camera to watch the driveway. They want a foothold that can scan the printer, replay mDNS, and hide behind your residential origin when they knock on other people. Your public IP’s reputation then becomes communal. Neighbors on the same CGNAT suffer with you. Look up that public address on IP Lookup after a strange spike. If the origin is still your ISP, the costume did not change — the household did.
Put vision on a leash
- Guest or IoT SSID with no access to the workstation VLAN.
- IPv6 firewall on. Global addresses without inbound deny make NAT theater.
- UPnP off so the camera cannot open a surprise port “for remote viewing.”
- DNS you chose, so you can see the names it loves at 3 a.m.
Then verify. From a laptop on the family SSID you should not be able to hit the camera admin page. From the camera’s documented cloud hosts, BGP Lookup should show a stable vendor ASN, not a rotating bulletproof prefix. Rotating origins are a product problem. Treat them like an uninvited VPN.
Mesh satellites are routers in denial
Every node is firmware. A hallway unit with an old image is an admin plane with a fern on it. Update them. Disable WPS. Do not put the “AI doorbell” on the backhaul SSID that carries file shares.
When the house feels possessed
Run a traceroute to a known-good destination. If the second hop is not your ISP, a device is tunneling. Look up that hop’s address. A hosting ASN in a country you do not visit is the camera — or the “free VPN” app on a phone — announcing your household to the world.
Look up your public IPv4 and IPv6. Both origins should be the ISP you pay. Anything else is a roommate you did not invite.
FAQ
Is cloud recording safer than local?
It moves the problem. You must still isolate the device and trust the vendor ASN. Local NVR plus a flat LAN is how ransomware finds backups.
Can I just disable the camera’s AI features?
You can reduce chatter. You cannot skip firmware and isolation. The botnet does not need the pretty detection box.