I commented this in another post, but at least for the affected surveillance cameras and recorders, the firmware for these devices is built on Busy Box. The man

I commented this in another post, but at least for the affected surveillance cameras and recorders, the firmware for these devices is built on Busy Box. The manufacturers either opened up telnet or left telnet open for these firmwares until about 3 years ago when it started getting exploited. The characteristics for how these surveillance devices were hacked are that the devices are using older firmware with an exploitable telnet feature and that the default credentials are still intact. There are a few vectors (using UPnP, HTTP API, directory traversal) that can be applied to bypass authorization. Throw in a global directory of these devices (shodan.io) and you have the ability to search for these devices with specific firmwares, run every attack vector to compromise these systems, and, once connected, have them do _whatever_you_want_.