Many homes have devices connected to the internet: Smart TVs, security cameras or baby monitors, voice assistants (Alexa, Google/Gemini, Siri), children's smartwatches with a SIM card, and smart bulbs, plugs and air conditioners. These are called IoT (Internet of Things) devices.
The main risks: default factory passwords (e.g. admin/admin) that everyone knows, missing updates, cameras and microphones that can be accessed remotely, and data being collected about what you watch on TV. An unprotected camera could let strangers see inside your home.
There are many manufacturers (Samsung, LG, Sony, TCL, Hisense, Xiaomi, Amazon, Google, etc.), so menu names may differ slightly by model. The guidance below is general.
⚙️ Step-by-step settings
Menu names may differ slightly depending on the model and version.
Change default passwords
Factory passwords are published online, and attackers try them automatically.
- After setting up, open the device's app (e.g. the camera app) or its settings page.
- Find Account / Security / Device password.
- Replace the default password with a long, unique one.
- Turn on 2-step verification for the device app's account, if it's offered.
- For cameras, also change the separate streaming password (RTSP/ONVIF), if there is one.
- Store your passwords in a password manager.
Update the software (firmware)
Old devices without updates have known holes that attackers exploit.
- Smart TV: Settings → Support → Software Update → turn on Auto Update (Samsung). On LG: Settings → General → About This TV → Software Update. On Google TV / Android TV: Settings → System → About → System update.
- Cameras and IoT devices: open the device's app → Settings → Firmware / Device update → turn on automatic updates.
- Update your TV apps from the TV's app store.
- When buying a new device, choose brands that promise security updates for several years.
- For devices that no longer get updates, consider replacing them or disconnecting them from the internet.
Put IoT devices on the guest network
If a cheap IoT device is compromised, the attacker can't reach your computers and phones.
- Open your router's settings (see the router guide).
- Turn on Guest network, or a separate network for IoT with a different password.
- Turn on isolation (e.g. Allow guests to see each other → No / Client isolation, AP isolation).
- Connect your Smart TV, cameras, smart bulbs and plugs to this network.
- Check that no IoT device has opened ports on the router (turn off UPnP if you don't need it).
Check microphones and cameras
Microphones and cameras can be switched on by mistake or misused.
- Voice assistants: use the physical button to mute the microphone when you're not using it.
- In the Alexa app: Settings → Alexa Privacy → Review Voice History – delete recordings and set up automatic deletion.
- For Google Home / Google assistants: myactivity.google.com → review and delete recording activity; set up auto-delete.
- Smart TV: turn off “always listening” voice features, and cover or disconnect the camera if your TV has one.
- Home cameras: don't point them at bedrooms or bathrooms; turn off remote access when you don't need it.
- Check who has shared access to the camera in the app, and remove anyone who shouldn't have it.
Limit data collection on your Smart TV
Many TVs collect data about what you watch (ACR) for advertising.
- Samsung: Settings → General & Privacy → Terms & Privacy → turn off Viewing Information Services and personalised ads.
- LG: Settings → General → System → User Agreements → turn off Viewing Information / Live Plus.
- Google TV / Android TV: Settings → Privacy → Ads → turn off personalisation; check Usage & diagnostics.
- On other brands, search the settings for the words Privacy, ACR, Viewing data or Ads.
- Menu names may differ slightly by model and year of manufacture.
Smartwatches and trackers for children
A watch with a SIM card or GPS shows your child's location – only parents should see this information.
- Buy from well-known brands with an official app and updates.
- Change the app's default password and turn on 2-step verification.
- Allow calls and messages only from approved contacts (an allowlist).
- Check who the location is shared with and remove anyone who doesn't need it.
- For Bluetooth trackers (AirTag and similar), teach your child to tell you if their phone shows an alert about an unknown tracker.
Before selling or throwing away – reset to factory settings
A device you sell may still hold your accounts, Wi-Fi passwords and recordings.
- Sign out of all accounts (Netflix, YouTube, Google, Amazon, etc.) on the device.
- Remove the device from the manufacturer's app and account.
- Reset it to factory settings from the settings menu (Reset / Factory reset).
- Change your Wi-Fi password if the device had it saved and you're not sure it was erased.
✅ Do / Don't
✅ Do this
- Change default passwords straight away.
- Turn on automatic updates on your TV, cameras and other devices.
- Connect IoT devices to the guest network or a separate network.
- Mute your voice assistant's microphone when you're not using it, and delete old recordings.
- Buy devices from well-known brands that provide security updates.
- Check the privacy and advertising settings on your Smart TV.
- Turn on parental controls and a PIN for purchases on your TV and streaming apps.
- Reset a device to factory settings before you sell it or give it away.
❌ Don't do this
- Don't leave passwords like admin, 1234 or 0000.
- Don't put cameras in bedrooms or bathrooms.
- Don't buy very cheap, unbranded cameras or devices without an official app.
- Don't install apps on your TV from unofficial sources (APKs, “free IPTV”).
- Don't share camera access with people who shouldn't have it.
- Don't link your voice assistant to purchases without a PIN.
- Don't leave remote access and UPnP switched on when you don't need them.
- Don't ignore software update notifications.
👨👩👧 Parental controls on Smart TVs and voice assistants
- Smart TV: in Settings → Broadcasting / Channels or General → Parental controls (Program Rating Lock) – set a PIN and an age limit. Names may differ by model.
- Set a PIN for purchases and app installs in the TV's app store.
- Streaming apps (Netflix, YouTube, Disney+, etc.): create a children's profile and set a PIN on the adult profiles.
- YouTube on TV: use YouTube Kids or a supervised account through Google Family Link.
- Google TV: you can create a child profile linked to Family Link, with time limits and approved apps.
- Voice assistants: in the Alexa or Google Home app, turn on the child/family filters (names vary by service and country), and turn off voice purchasing or require a code.
- Children's smartwatches: allow only approved contacts and check who the location is shared with.
⚠️ Warning signs
- The camera moves, its light comes on, or you hear a voice from the speaker for no reason.
- Sign-ins from unknown devices or places appear in the camera app.
- The device or app password has been changed without you knowing.
- The Smart TV opens apps by itself or shows strange ads.
- Your voice assistant's history contains commands nobody gave.
- Your home internet slows down a lot, and the router shows heavy traffic from one IoT device.
🆘 If you get hacked
- Step 1: Disconnect the device from the power or from Wi-Fi.
- Step 2: Change the password of the device app's account and turn on 2-step verification; sign out of all devices.
- Step 3: Reset the device to factory settings and set it up from scratch with a new password.
- Step 4: Update the firmware before reconnecting it to the internet.
- Step 5: Change your Wi-Fi password and check your router (see the router guide).
- Step 6: If the device no longer gets updates, replace it.
- Step 7: If someone has recorded footage from your home or is threatening to use it, keep the evidence and report it to Kosovo Police on 192 (emergency: 112).
More help: Help & Reporting