10 Seconds of Watching: Inside an RTSP Camera Hijacking
Our RTSP honeypots emulate unsecured IP cameras on port 554. Two sessions, same day. The first watched for 10 seconds and left. The second stayed for 45 seconds, sent a keepalive to avoid being disconnected, and never said goodbye. Both set up video and audio. Both thought they were looking through someone's camera. Neither was.