Slashdot Mirror
Home Security Camera Sends Video To Wrong User (bbc.com)
An anonymous reader quotes a report from the BBC: A leading security camera-maker has sent footage from inside a family's home to the wrong person's app. Swann Security has blamed a factory error for the data breach -- which was brought to its attention by the BBC -- and said it was a "one-off" incident. The BBC first learned of the problem on Saturday, when a member of its staff began receiving motion-triggered video clips from an unknown family's kitchen. Until that point, Louisa Lewis had only received footage from her own Swann security camera, which she had been using since December. The development coincided with Ms Lewis's camera running out of battery power and requiring a recharge. A Swann spokeswoman said that "human error" had caused two cameras to be manufactured that shared the same "bank-grade security key -- which secures all communications with its owner." "This occurred after the [family] connected the duplicate camera to their network and ignored the warning prompt that notified: 'Camera is already paired to an account' and left the camera running," she added.
A subtle attempt to shift blame to the people that bought this piece of (apparent) junk, ""This occurred after the [family] connected the duplicate camera to their network and ignored the warning prompt that notified: 'Camera is already paired to an account' and left the camera running," she added."
'Camera is already paired to an account'? Could mean it's already been paired to my account and I'm trying to re-pair it. Could be a message indicating success – that you've paired it to the intended account. I'm sure the company will claim this message's meaning is crystal clear and that the people who bought it are partially to blame. I'm not buying that (the dodge or the webcam).
"We are regretful that this was not addressed immediately and adequately by our support team, when discovered. We have addressed this and made some internal changes."
They do however have a previous incident where the exact same thing happened, and in that case they apparently suggested it was because two completely unrelated users used the same user and password (which wasn't true).
Warning messages like this are entirely useless. If someone gets a message 'Camera is already paired to an account', they'll get annoyed and click through it. It doesn't tell them what the problem really is, it doesn't warn them of the consequences, and it's just plain in the way of them finishing the onerous task of registering their devices to get basic functionality.
A better message might have warned them, 'this camera appears to be already registered to another account, possibly because it was resold. If you continue, the camera's previous owner will be able to view this camera in your home'. Even better, it could instruct them to contact tech support to switch ownership of this camera. Better yet, do away with the annoying useless popup message and just deregister the old account's ownership.
They say it's a one-off factory error, but they still should have been able to foresee a camera being bought by one user and later sold to another user. Dealing with that problem would have made the one-off factory error a nonissue. Yes it would have deregistered the old camera, but at least that's something that can be handled through support rather than by sending video to the wrong account.
Another good cloud implementation. The video leaves the local network, goes to some server somewhere where anyone can access it, and then the server sends it to someone else. Of course, you COULD just store the video on the local SDcard in the camera, but then it wouldnt be cloud enabled.
It's like the phrase "highly classified" - it means nothing. In the US something can be classified as confidential, secret or top-secret. There is no category "highly." So what is bank-grade? I mean, we're talking key size here, so just give us a number. And obviously the implementation is broken if human error can put the same key on different devices.
Is that like the "military-grade aluminum" Ford has been advertising as making their trucks out of now? Does that mean they were made out of recycled beer and coke cans picked up in military bases from Bagram to Bragg?
The only thing necessary for evil to triumph is for it to be pitted against a slightly greater evil
Yeah, right.
Meh.
All this means is that they're using standard crypto -- and if it's really "bank grade" then it could be a little behind the times. Banks still use 3DES all over the place. That's not a security problem, exactly, but they really need to update.
I'm surprised they didn't use the more common "military-grade security" phrase. It's not one whit more meaningful than "bank-grade security", other than it probably indicates use of AES, perhaps AES-256, given the NSA's apparent concern about quantum computing.
I guess both phrases can be taken to indicate "We aren't complete idiots who roll our own ciphers" though it definitely leaves the door wide open for "(but we are stupid enough to roll our own protocols and implementations)". No way to know on the latter point without looking at the details.
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
Bank grade would be a four digit PIN.