Slashdot Mirror
Serious Amazon Ring Vulnerability Leaves Audio, Video Feeds Open To Attack (betanews.com)
Mark Wilson shares a report from BetaNews: Security researchers from Dojo by Bullguard have discovered a vulnerability in Amazon's Ring doorbell that leaves it prone to man-in-the-middle attacks. As well as enabling a hacker to access audio and video feeds in a severe violation of both privacy and security, the vulnerability also means that an attacker could replace a feed with footage of their own. Revealing the security flaw at Mobile World Congress, Yossi Atias from Dojo, demonstrated how a feed could be hijacked and injected with counterfeit video. The vulnerability poses a number of risks. The ability to spy on audio and video feeds has obvious privacy implications, but it could also enable a hacker to monitor comings and goings to determine when a house will be empty. Using easily-available tools, it is possible to intercept Ring's RTP stream and extract a viewable MPEG video.
Flashing for the lazy,no need to even leave the house now: "Ding-dong!" --> "Long-dong!!!"
Get a cloudfree camera and internal DVR. Same functionality without you paying to contribute to the massive surveillance networks Scumazon and Scroogle are building.
Frankly, I don't want cloud storage as an option, unless it's encrypted with my own keypair. I don't want to buy a camera, then pay monthly for the privilege of contributing to Amazon's outsourced surveillance network.
I got a Doorbird instead. Is it more secure than the Ring? Doubtful. But it can run off the cloud if you want it to, with a little effort. The camera stream is available as RTSP, and the video intercom function supports SIP. My Doorbird is firewalled and talks to a home DVR system and Asterisk server. Same functionality, off the cloud, and will keep working if the company goes the way of the dodo.
If construction was anything like programming, an incorrectly fitted lock would bring down the entire building...
That's fair enough those who don't accept security is just posturing, role-based countless dollars and time on a fruitless task, when they could have adjusted their life to function from a philosophy of everyone's going to know anyway. There are two ways to solve the problem. Eliminate it. And this case that one is a lost cause. The second way to solve a problem is to adjust your underlying system of operation to count on these sort of things happening and plan on not being able to predict when so that you are motivated to prepare and when it happens are not traumatized by it. Similar to how we learn not to cry and freak out just cuz it's raining on a day we want to play outside we learned to accept that sometimes it's going to rain. And we plan and prepare for it so that we don't have to care when it does.
So, you're right. Let me just get that right out in the open first, because you're right even though you probably won't get any up-mods for it.
But as I'm reading this it strikes me as problematic in the way you've presented your argument. I keep hearing the words of others echoing in my head, telling me that I was too biased to be heeded when I tried to protect them in this manner.
So you (both of us, really) have to figure out a way to make this argument sound like it is coming from someone rational and unbiased, but still knowledgeable. I've tried leaving out the emotionally-charged rhetoric and just piling on raw facts, but then this same archetypal person will just assume I'm trying to bamboozle them with complicated words, instead.
So, seriously here. How do we get this same point across when we're not preaching to the choir?
Depends?
Bezos: We wants it, we needs it. Must have the precious.
The proper way to implement these devices is to allow them to only communicate on the LAN. No attempts to connect to the Internet, no receiving instructions from the Internet. To access them away from your home, you set up a VPN sever on your home router. Your phone, tablet, or laptop then connects to that VPN, making it appear as if it's connected to your home LAN, and thus giving you access to all these devices on your LAN.
Unfortunately, the VPN server part of that is rather challenging to set up. People are lazy / technically challenged. These device manufacturers have to cater to the lowest common denominator, which means they need a way for these devices to work even for the laziest and most clueless buyer. So they make these devices connect to their server over the Internet. (Not that they mind, since it allows them to collect usage data.) Your phone, tablet, or laptop then connects to their servers, when then hands off the connection to your home device. But because you're now trusting a third party, that exposes you to all sorts of attacks by the Internet at large.
Get even. Play a high quality porno loop , pretending its from your camera. Might even make you a few new friends, and give the watchers something to do.
From the very end of the linked article:
"Important note: Ring has patched this vulnerability in version 3.4.7 of the ring app (Without notifying users in the patch notes!). Please make sure to upgrade to a newer version ASAP as the affected versions are still backward compatible and vulnerable."
(I think I'm beginning to understand that whole "read the last page first" philosophy.)
To maximize the power of your product listing , ensure that the negative reviews or the complete lack of reviews is taken care of on your listing page. Both are equally lethal!