Slashdot Mirror
Serious Amazon Ring Vulnerability Leaves Audio, Video Feeds Open To Attack (betanews.com)
Mark Wilson shares a report from BetaNews: Security researchers from Dojo by Bullguard have discovered a vulnerability in Amazon's Ring doorbell that leaves it prone to man-in-the-middle attacks. As well as enabling a hacker to access audio and video feeds in a severe violation of both privacy and security, the vulnerability also means that an attacker could replace a feed with footage of their own. Revealing the security flaw at Mobile World Congress, Yossi Atias from Dojo, demonstrated how a feed could be hijacked and injected with counterfeit video. The vulnerability poses a number of risks. The ability to spy on audio and video feeds has obvious privacy implications, but it could also enable a hacker to monitor comings and goings to determine when a house will be empty. Using easily-available tools, it is possible to intercept Ring's RTP stream and extract a viewable MPEG video.
You forfeight your right and expectation to privacy.
This isn't a privacy issue, it is a security slip (or rather intentional gap only)
a different leak, not the previous one where an unsecured AWS bucket was shared from a Ukrainian software subcontractor that had access to every single RING video on the entire worldwide network, a new leak instead?
Do tell.
I have reached the point of laughing at this shit.
It's a connected consumer device, therefore it is 100% guaranteed to be riddled with security holes, potential bypasses, exploits, and privacy risks.
Pretty much without fail, this connected shit, this smart home shit ... whatever the fuck we call it ... this stuff is proven to either lack basic security, or have a weak ass attempt at security, or is in of itself malicious.
So, boo mother fucking hoo ... you bought a fucking device which leaves a fucking tech company in charge or security on your house.
That shit is on you for being such a fucking moron in the first place.
If you made companies who make connected products 100% legally liable for both security and privacy, I would still assume in 10 years the quality of this stuff would still be garbage.
I am not surprised to hear this, and I'm tired of having to say it ... but buying this fucking shit because it's shiny and cool and you can run your life from a fucking app ... that doesn't entitle you to any fucking sympathy for running stuff you don't understand written by people who are more interested in serving you ads than selling you a secure product.
Fuck Amazon and any other making a fucking internet connected doorbell. If you're stupid enough to buy this shit, you deserve what you get.
The overwhelming majority of connected gadgets are literally pointless, written by idiots, and so insecure as to be laughable. Obsessively buying this crap and getting burned by it ... that's all on you.
Using easily-available tools, it is possible to intercept Ring's RTP stream and extract a viewable MPEG video.
So that means I can intercept the video on my LAN and storage the video locally? Cloud-dependent video is just stupid, I want local (with cloud storage as just an option).
That streams porn to people's doorbells in 3...2...1...
it's a gadget with video cameras and microphones connected to the internet..... it getting hacked, and hacked continuously, is inevitable.
Seriously how did we ever get along without these devices? Oh I know, we just did and were better for it.
Jokes on them! My ring, like a good number of peoples, has never worked! Good luck spying on my âoebrickâ.
Bezos: We wants it, we needs it. Must have the precious.
The proper way to implement these devices is to allow them to only communicate on the LAN. No attempts to connect to the Internet, no receiving instructions from the Internet. To access them away from your home, you set up a VPN sever on your home router. Your phone, tablet, or laptop then connects to that VPN, making it appear as if it's connected to your home LAN, and thus giving you access to all these devices on your LAN.
Unfortunately, the VPN server part of that is rather challenging to set up. People are lazy / technically challenged. These device manufacturers have to cater to the lowest common denominator, which means they need a way for these devices to work even for the laziest and most clueless buyer. So they make these devices connect to their server over the Internet. (Not that they mind, since it allows them to collect usage data.) Your phone, tablet, or laptop then connects to their servers, when then hands off the connection to your home device. But because you're now trusting a third party, that exposes you to all sorts of attacks by the Internet at large.
Another pointless research, triggered only by amazon buying Ring.
Determining when house is empty can be easily done just monitoring the house or using any number of other monitoring tools... which are way easier to accomplish. Spying on ones feeds is same...
in fact it should be way more open and flexible, I fear because of this idiotic furor we will see less focus on quality and functionality and waste of resources on pointless security features.
In addition, if you really need that much privacy and security , why dont you invest on serious security solution. Ring aint security but a monitoring solution primarily.
Why is every single smart-home anything exclusively using WiFi? Give me hard-wired LAN for everything, or I won't touch it.
I've been on the market for a smart doorbell - primarily just for the camera tbh, not really for anything else - and there doesn't seem to be a single one that is exclusively wired LAN.
I'll opt for putting in a security camera instead, but that's a lot less subtle and a lot more likely to freak the neighbours. A proper dumb-doorbell with a dumb-LAN-wired camera (none of the cloud storage shite) is all I want.
It's been patched as of 3.4.7 current ring app version is 3.10.x. the linked article even mentions it has been fixed.
I didn't know about Amazon Ring. Sometimes reality surpasses one's weirdest imagination. I am... flabbergasted.
Internet Of Idiots.
From the very end of the linked article:
"Important note: Ring has patched this vulnerability in version 3.4.7 of the ring app (Without notifying users in the patch notes!). Please make sure to upgrade to a newer version ASAP as the affected versions are still backward compatible and vulnerable."
(I think I'm beginning to understand that whole "read the last page first" philosophy.)
It was a floodlight cam for my driveway. I noticed that when I would do Live view that it was showing old footage. I walked out into the driveway and I wasn't showing in the footage. Plus it was showing daytime footage in the stream when it was night time.
As such, shutting off the power to the device for a few minutes and turning it back on seemed to reset it. I wasn't sure if I had been hacked or if something was frozen in the software. Either way, I constantly monitor it.
I must say, even though I'm generally fairly well informed about what's going on in this field, I was left scratching my head over WTF an "Amazon Ring" was, and in what way such a thing could have some sort of vulnerability. One extra word ("doorbell") would've cleared that right up (fortunately it's in the summary).
I'm sure that headline, as it is, is completely meaningless for a lot more people.
To maximize the power of your product listing , ensure that the negative reviews or the complete lack of reviews is taken care of on your listing page. Both are equally lethal!