Breaking into your family’s baby monitor is a worrying prospect for any parent.

Horror stories are circulating on the Internet of parents being woken up in the middle of the night by strange noises coming from their child’s bedroom.

They open the door and find that a stranger is “talking” to their child through a baby monitor.

“While such incidents are rare, they do happen from time to time,” says international digital security company ESET.

Fortunately, there are steps you can take to make sure your baby monitor will do its job, not follow instructions from a stranger, and that it won’t pose a threat to family safety and privacy.

But why would someone “hack” a baby monitor? Some people just want to have fun. Others may have more sinister goals. While some may try to steal personal information heard through the device or confirm that the house is empty in order to break into it.

Whatever the reason, there are two main ways to hack a baby monitor. It depends on the device type:

– RF devices require the interceptor to be in range of the signal and know the frequency the device is using. Both this and the fact that most of the top products of this type use encrypted communications make these models generally more secure, albeit with more limited functionality.

– Wi-Fi devices are more vulnerable to hacking because they are connected to your home router (router) and often to the Internet.

These devices support features that allow parents to stream video through the mobile app wherever they are.

While this gives you peace of mind when you’re out and about, it also opens the door for hackers to scour the internet looking for unsecured cameras to check.

Even devices that don’t offer this feature could theoretically be compromised if an attacker is able to hack into the router. The easiest way to do this is to guess the password or brute-force jailbreak the device, although more sophisticated attacks may try to exploit firmware vulnerabilities.

What can happen

Hackers could eavesdrop on the baby or even chat with him if the device has a speaker.

In some cases, footage from hacked cameras ends up on illegal websites for others to view.

Here are some examples of baby monitor hacking:

• An infamous case in 2014 when a website in Russia broadcast live broadcasts from homes and businesses around the world captured by smart devices protected only by pre-set passwords.

• A 2018 case in which a South Carolina mother in the US noticed that her baby monitor camera had been remotely moved to focus on where she was breastfeeding her son.

• An incident in 2018 where a hacker broadcast messages through a hacked device threatening to kidnap a family’s child.

• An incident in 2019 when an unknown person hacked into the device of a married couple in the American city of Seattle and began to send scary messages to the child.

• A similar case in early 2022 when a stranger took over a baby monitor and terrorized a three-year-old child with threatening messages using a voice changer.

Protection methods

The British consumer advocacy group recently urged parents to tell manufacturers about the safety of devices.

He argued that many of these companies would only change their approach when enough consumers demanded a change.

Various legislative efforts are also underway in the US and European Union to increase the basic levels of security offered by Internet of Things (IoT) devices and smart products. In the meantime, ESET offers a few tips:

1. Research your options carefully and try to choose a reliable manufacturer that has a strong focus on safety and good reviews.

2. Install any software (or firmware) updates for the device.

3. If possible, select a model that does not support remote communication via the app. If so, disable remote access, especially when not in use.

4. Set a strong and unique password and enable two-factor authentication if available.

5. Regularly check device logs for any suspicious activity, such as access by people from an unusual internet address (IP) or at odd times.

6. Protect your wireless router with a strong unique password. Also disable remote access to it, as well as port forwarding or UPnP. Make sure your router is up to date.

Source: RES-IPE