Slashdot Mirror
Amazon Key Flaw Could Let Rogue Deliverymen Disable Your Camera (wired.com)
Security researchers claim to have discovered a flaw in Amazon's Key Service, which if exploited, could let a driver re-enter your house after dropping off a delivery. From a report: When Amazon launched its Amazon Key service last month, it also offered a remedy for anyone who might be creeped out that the service gives random strangers unfettered access to your home. That security antidote? An internet-enabled camera called Cloud Cam, designed to sit opposite your door and reassuringly record every Amazon Key delivery. Security researchers have demonstrated that with a simple program run from any computer in Wi-Fi range, that camera can be not only disabled, but frozen. A viewer watching its live or recorded stream sees only a closed door, even as their actual door is opened and someone slips inside. That attack would potentially enable rogue delivery people to stealthily steal from Amazon customers, or otherwise invade their inner sanctum. And while the threat of a camera-hacking courier seems an unlikely way for your house to be burgled, the researchers argue it potentially strips away a key safeguard in Amazon's security system. When WIRED brought the research to Amazon's attention, the company responded that it plans to send out an automatic software update to address the issue later this week.
If you're dumb enough to let random delivery workers into your house without you being present, you're asking for trouble. Security flaws or not, you're an idiot if you allow this. You're asking for trouble.
Just have them let themselves in and come straight to the bedroom - I'm already tied up.
Shocked to learn that such a "well thought out idea" like letting random strangers into your house to drop off a package via an automatic door unlocker and camera would have a security flaw.
I mean, damn. What are the odds of this happening? Surely, Amazon would have tested this out before rolling out the system, instead of rushing it out the door in a mad grab for even more cash.
Right?
Right?
Mr. Hu is not a ninja.
deauth attacks aren't new[s]
this is why i and many others don't use wifi cameras
wired editors should stop sniffing so much glue
The good: Amazon promises they'll be pushing out a patch this week.
The bad: It's about as bad a failure mode as is possible: "Most disturbingly, Amazon's camera doesn't respond to that attack by going dark, or alerting the user that the camera is offline. Instead, it continues to show any live viewer—or anyone watching back a recording—the last frame the camera saw when it was connected."
Okay, maybe there's a worse failure mode possible... if the camera, upon losing connectivity, also spontaneously caught fire and burned your house down.
#DeleteChrome
This was hugely unpopular with the market anyway. This hole might have killed the product.
EngrStudent
Hacking my door takes an axe.
(T>t && O(n)--) == sqrt(666)
How about providing a *wired* (capable) camera. Many people might not use that, but I would be willing to run some CAT5 for extra security or, rather, confidence.
It must have been something you assimilated. . . .
Look, stop trying to invent new tech.
Most homes built until the 1980s had a box built into the porch next to the door, or a door built into the house next to the front door, that revealed a 2x2x2 area (sometimes larger) in which you could place things.
It was opened by a key the delivery people had. And inside by a key the owner had (different door).
It was used for ice deliveries, package deliveries, milk deliveries.
Do that. Add a camera or sensor to that.
Don't make the door to your house be open to delivery people. Give them a place, OUT OF SIGHT, to store things in that only you can pick up.
SERIOUSLY!
-- Tigger warning: This post may contain tiggers! --
This screams liability issues I cannot believe Amazon lawyers would even allow such a terrible ideal. What about people who have home security installed, or a gated community, how about who is going to properly do background checks on all these minimum wage delivery drivers. You know Amazon isn't going to pay them much and exactly who do you think will apply for these positions? I live in a relatively crime free area and wouldn't think of allowing people into my home like this. I'd make other arrangements to get packages delivered.
i think that greatefforts ,it contain many options .thank you
Look at the pixels.
Note, I'd never use this, but...
As I understood the plan originally, the code that they give the delivery person to open the door is a one-time code. So, if the would-be thief has no way to get in again, how is this a total failure? I'd also bet that both the usage time of the code and whether the door was left locked are both sent back to Amazon. They obviously have communication with the lock if they can set a one-time code.
See subject. Think about it. The religious people always joke about their omniscient deities watching everything, including you pooping. This, however, is far, FAR less of a stretch.
Even after the flaw is fixed, what's to stop someone from jamming the wifi signal while they take everything you own?
Any sufficiently unpopular but cohesive argument is indistinguishable from trolling.
I just got and am returning an Arlo camera system from Net Gear. Good hardware HORRIBLE implementation -- like most IOT. It doesn't come with a package that unlocks the door... But is is another example of (video and sound!) sensitive data being sent out over the Internet without the average consumer even having an idea that they have just 'bugged' their own home. If products have warnings about kids suffocating on the wrapper, why don't these IOT gadgets have warnings like: Caution Do not point camera at potentially embarrassing situations or rely on it to perform alarm services when most needed ? As a bonus there is an Internet inserted 10 second delay using it as a simple video doorbell.
Why not give everyone a key to the Amazon warehouse. I'm sure if Amazon has good enough security and tracking, it's users can be trusted.
Amazon wants me to trust them, why doesn't Amazon trust me?
Why can't Amazon ship me stuff while awaiting payment, why don't they take cheques? promissory notes? trades?
Go ahead and install an older version and disable updates. Then fork it and backport security fixes and feature updates yourself. Complaining isn't going to solve anything.
I don't see how this is different than the delivery man simply reaching over and unplugging the Camera's data or power cable. Not sure how Amazon is going to patch that...
they did something like this in the movie speed.
criminal liability is still an issue that no EULA can't take away.
Full disclosure: I'm a big Amazon fan and love my Prime subscription.
Who, honestly, would think it's a good idea to let delivery drivers INTO YOUR HOUSE? In what Mayberry-like universe is this a good idea? I'm perfectly fine with UPS or whoever leaving the package at the side garage or at the front door. In no shape or form do I want or need a driver depositing the package in my foyer. I get all of the IoT madness but this is extremely over the top and doesn't come remotely close to a good idea.
The wifi signal could be swamped out by a strong enough transmitter, also. Wifi security cameras are convenient and easy to set up (I have a couple) but may not be appropriate for the most sensitive locations. My doorway cam is hard wired to a computer in the garage. To foil a physical brute force attack (break into the house and steal the surveillance computer) the computer emails me and puts the clip on dropbox when the motion sensor trips. Even that isn't a perfect solution, but at some point you have to say "good enough".
Oliver's law of assumed responsibility: If you're seen fixing it, you will be blamed for breaking it.
June 14th, UPS center in San Francisco.
Window flaw can allow hacker to break glass and open window
> or otherwise invade their inner sanctum.
Oh no, don't do that! When you invade the inner sanctum, all sorts of weird stuff starts happening. Dead people turn up, people hallucinate, they get framed for murder, they get caught up in all sorts of strange plot twists. And all the photos sitting on the mantle start to look like Lon Chaney.
Do not invade the inner sanctum!
Deliveryman doesn't seem like a legal subclass of Rogue.
Actually, I don't see a good fit, let's call them Rangers.
But back to our original discussion, what class do we put bicycle repairman under?
the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff
So they've done their job. Amazon should fix it. The researchers should continue to do their job. Amazon should keep fixing what they find.
Isn't that the whole point? No software is perfect, even through rigorous QA, shit gets through. Sure, it's broken, people can exploit it. So Amazon should fix it.
You need a criminal who's smart enough and desperate enough to try and pull this off. If you're seriously worried about this, add your own camera and DON'T connect it to the internet. Your paranoia has just been solved.
It's technology. People are going to break it. Fuck. Cmon people, it's 2017.
I tend to rant.
This whole "let some random guy into your home" thing is just a terrible idea.
If Amazon would let people put a sturdy locker on their property that could (theoretically) only be opened by a driver making deliveries, I'd be much more inclined to go with something like that as a solution. Fasten it securely to something and the worst that could happen is the locker itself is stolen.
But letting some rando into my home to drop shit off is NEVER EVER going to happen, period. NE-VER.
Just cruising through this digital world at 33 1/3 rpm...
You isn't that smart... is you?
So you're someone who is able to install an extension or add-on but not smart enough to switch to an earlier browser?
NoScript is out of date and provides a false sense of security. Though I understand the way it works is really quite nice for people surfing unusual pornographic sites with click bait everywhere. So I can understand why you might be intrigued by such a program.
Writing a web extension like NoScript is quite simple. If it's so important to you, then maybe I can recommend writing a replacement.
As for security.... if you understood computer security and web technologies, you'd understand why the removal of legacy extension support is so important.
Honestly, you need an extension that prevents the user from posting on forums.
BTW while I have close friends that feed their families from the Mozilla foundation and used to work with them daily on similar projects, I have no association the foundation. I love what they do and I think one day I may even consider trying their browser again.
the solution to this problem is an add-on to the Amazon Echo that makes it so that when the delivery guy unlocks the door, then steal bar cages immediately create a secured path between the door and the kitchen table and refrigerator. I would recommend a few altered Sony Aibos with teeth to follow and guard the criminal closely.