Decoy · Device
IP camera decoy
Cameras are easy to find and often run default passwords, which makes them a favourite of botnets and curious insiders. This decoy poses as cam-entrance, a Hikvision-style camera with a web login, an RTSP video stream, Telnet and SIP.
What it emulates
Poses as: IP camera (BusyBox).
Nobody needs to log into a camera they were never given access to. Any login, stream request or Telnet session is worth a look.
- HTTP 80
A camera web login page that records every username and password.
- RTSP 554
The video stream port. Asks for a password and records the one sent. Never streams video.
- Telnet 23
Shows a BusyBox login prompt and records every password. Only a planted password opens a fake shell, where nothing runs.
- Camera SDK 8000
Accepts the connection and records the first bytes sent. It does not speak the protocol yet.
- SIP 5060/udp
Records voice-over-IP requests, including who is calling and any credentials. Never replies.
What it catches
Every touch, explained in plain English.
Each event gets a plain-English explanation. Related events from the same source become one incident with a recommended action.
- Default-password logins on the web page, video stream and Telnet
- Botnet scans that sweep for cameras
- Commands typed into the fake shell
- SIP probes looking for phone systems
MITRE ATT&CK
Techniques come from a fixed table, not from AI, so the same activity always maps the same way.
- T1046Network Service Discovery
- T1059Command and Scripting Interpreter
- T1110Brute Force
- T1190Exploit Public-Facing Application
- T1552.001Unsecured Credentials: Credentials In Files
- T1552.005Unsecured Credentials: Cloud Instance Metadata API
Incidents go to email, Slack, your SIEM or a signed webhook. Kandaro and your SOC
Safe by design
Built to be attacked. Never a way in.
A decoy only listens and answers with fake data. It never runs code and only connects out to Kandaro, so it can never become a way into your network.
It runs nothing
The sensor has no way to run a command, load code or update itself. Every command an intruder types gets a fake text answer.
It connects to one place only
Its only outbound connection is HTTPS to the Kandaro API address set at install time. Nothing Kandaro sends can change that address.
Kandaro can only send it settings
Which decoy to imitate, which services to turn off, which addresses to ignore. There is no field for code, files, commands or updates.
It holds no real secrets
Passwords, keys and records it shows are fake. Its only credential is its own key, which can send events for your organisation and nothing more.
It cannot be used to attack others
It never forwards traffic, never fetches a URL and never serves scripts or programs. Its only UDP replies (SNMP) are rate-limited per address.
Non-root, read-only container with signed images. How we secure sensors
Where to put it
Place it where an intruder will look.
Put it in the network where your real cameras or building systems sit.
Installs in about a minute with Docker, Kubernetes, Ansible, a VM or a Raspberry Pi, and needs outbound HTTPS only. Deployment guide · Where to put your first decoys
FAQ
IP camera decoy questions
Does it show any video?
Can an attacker actually log in?
Is it safe to run on my network?
Related decoys
Pair it with these.
- device
Network printer
Office network printer
Blends into any office network. Nobody logs into a printer by accident.
HTTP 80JetDirect 9100TFTP 69/udpLPD 515IPP 631+3 - device
Managed switch
Managed switch or router
Network gear with Telnet, SSH, a Basic Auth web admin and SNMP.
Telnet 23SSH 22HTTP 80SNMP 161/udpNTP 123/udp - device
NAS
NAS and backup storage
Backups are the first thing an intruder wants to find, and destroy.
HTTP 5000HTTP 80HTTPS admin 5001SSH 22FTP 21+3
Put this decoy on your network today.
Start a 14-day trial of Kandaro Deception. Your first decoy is running in about a minute.
Card required · cancel before day 14 and pay nothing