ICANN Blogs

Read ICANN Blogs to stay informed of the latest policymaking activities, regional events, and more.

Inurl+viewerframe+mode+motion =link= -

If you own an IP camera (regardless of the brand), follow these steps to ensure you don't end up as a search result:

This public link is valid for 7 days and shares a thread, including any personal information you added. This link or copies made by others cannot be deleted. If you share with third parties, their policies apply. Can’t copy the link right now. Try again later.

While using Google to find unsecured cameras might sound like a theoretical curiosity, the implications are severe. The primary risk is the . If this dork reveals a camera inside a private residence, a corporate boardroom, a medical facility, or a security operations center, it offers an unfiltered view of that space to anyone with an internet connection.

The most immediate risk is that strangers can watch live, real-time video of private homes, businesses, backyards, or inside rooms.

The threat extends far beyond simple voyeurism. A compromised camera on a business network can serve as a beachhead for a larger cyberattack. Once inside, hackers can move laterally to access more sensitive systems, steal customer data, or deploy ransomware. In industrial settings, compromised cameras can provide adversaries with visual intelligence on factory layouts, security protocols, and even proprietary equipment, posing a threat to national security and economic competition. inurl+viewerframe+mode+motion

The inurl:viewerframe?mode=motion search is not a new vulnerability. It is part of a list that has existed for nearly two decades. The concept of Google hacking dates back to , when vulnerability scanner developer Chris Sullo included a Google plugin in the Nikto tool. Shortly after, hacker Johnny Long began compiling a dictionary of these search queries, or "Google Dorks," which eventually became the Google Hacking Database (GHDB) in 2004.

If your camera appears in search results, it means it is accessible to anyone. Follow these steps to secure it: A. Disable Public Access

A user sets up port forwarding for remote viewing (e.g., to watch their home via a phone app). They forward port 80 (HTTP) to the camera’s IP address. But they forget to enable "password protection for public access." Now, anyone on the internet can see the camera. Google finds it in hours.

: A specific filename or directory common to the web interface of Axis communications devices. Mode=Motion If you own an IP camera (regardless of

As the Internet of Things expands, the intersection between public search indexing and private hardware security remains a critical battleground for digital privacy and device safety.

Accessing a public link is technically legal, but viewing private spaces without consent violates ethical boundaries. Illegal

If you need to view your cameras remotely, don't expose them to the open internet. Instead, connect to your home network via a VPN and then access the local IP of the camera. Final Thought

The answer lies in a fundamental misunderstanding of network security by manufacturers and users alike. Can’t copy the link right now

# pseudocode queries = ['inurl:viewerframe "mode=motion"', 'inurl:viewerframe mode=motion'] for q in queries: hits = search_api(q) for url in hits: if allowed_by_robots(url): resp = http_head(url) if resp.content_type in ['text/html','application/pdf']: analyze_embed(url, resp) record_metadata(url, resp)

Such functionality, once intended for legitimate surveillance, becomes a privacy nightmare when left exposed to the internet.

Traffic intersections, parking garages, and school corridors.

These dorks are not limited to Panasonic devices either. The Google Hacking Database includes hundreds of similar strings used to target various brands. For instance, searching for intitle:"Live View / - AXIS" can uncover a different set of cameras, those manufactured by Axis Communications, a major player in the network video market.

: A Google search operator that restricts results to URLs containing a specified string.