They discovered it was transmitting a private Wi-Fi security key unencrypted over an open network, using a username of 'camera' and password '000000'. As explained in a blog today, Biggs and his team took advantage of poor encryption, or absence of it entirely, on the camera. He confirmed the accounts had now been removed from the camera's firmware, as have a number of other glaring vulnerabilities that allowed them to access the Dropbox and Gmail accounts in the first place.

The most you could do with these accounts would be to cause issues for the developers who are using these accounts for testing.' 'You would not expect a development company to use this type of account for this kind of activity and they certainly should not have been left in the final firmware. These would be on every camera,' Biggs told FORBES. We didn’t access the accounts due to legalities but we had everything we needed to do so.

'The accounts left in the firmware appeared to be shared developer accounts used to receive motion alerts and video clips for testing.

Gmail drop box