What I (Unfortunately) Found When I Pointed Shodan at the Internet's Webcams
I've known about Shodan for years — it's the world's first search engine for internet-connected devices, and if you want a fast lesson in how much of the world is sitting online with no authentication at all, its Webcam category will teach you in about thirty seconds.
I had an actual assignment during my associate's degree courses that sent me there deliberately: register for a free account, click into the Webcam category — usually the top-rated one on the whole site — and look around. What you see for each camera is basic: an IP address, an approximate location, and whatever software or OS the device reports, plus, most of the time, a cached screenshot pulled straight from the feed.
That's the part that gets you. It's not hypothetical "someone could be watching" — it's an actual live frame from an actual camera, indexed and searchable, sitting right there in your browser.
A lot of what you find is mundane: driveways, empty parking lots, the occasional porch pointed at a mailbox — people who clearly have no idea the entire internet can see what their camera sees. Some of it is less mundane. I came across a camera pointed into a dark living room where an older man was sitting, smoking a cigarette, bathed in blue light from his TV. At one point he turned slightly and looked directly into the camera — not surprised, not startled, just... a steady stare, then went back to what he was doing...puffing his cigarette.
It was surreal, and beyond weird. It unsettled me to say the least.
But...
The next evening, curiosity got the better of me, and I went back to Shodan, and back to the smoking man's camera. I won't go into detail about what I found, but I can tell you for certain, the man was fully aware the camera was exposed to the entire internet, and that he clearly enjoyed the voyeuristic thrill.
The image is still burned into my mind...
That was the last time I went looking for anything specific on Shodan. I know what's out there now, and I don't go looking for it anymore.
The actual lesson here isn't about one unsettling camera
It's about the sheer scale of devices sitting on the public internet with zero authentication, searchable by anyone with a free account and thirty seconds. Most of the people whose cameras show up in that search bar have no idea they're there. A camera isn't "private" just because it's in someone's house — if it's bound to a public IP with no login required, it's public, full stop.
If you're running any kind of internet-facing camera, NVR, or smart-home hub, the fix is almost always the same short list: change the default credentials (this is the one that actually matters), put the device behind your router instead of forwarding ports directly to it, and if you need remote access, use a VPN back into your own network rather than exposing the device itself. Takes twenty minutes. Keeps you off of a stranger's search results.
Takeaway
Shodan isn't a hacking tool in the way people picture when they hear that word. It doesn't break into anything — it just indexes what's already wide open. That's almost scarier. The barrier to finding an exposed device isn't skill, it's curiosity, and curiosity is free.