Alexa shows private Wyze Cam feed to stranger [video]

https://www.youtube.com/watch?v=HQGX4iMGlUI

by pravda • 7 years ago

215 80 7 years ago

wmeredith• 7 years ago

Wyze was all over this from the get-go. It has already been patched (took about 48 hours): https://reddit.com/r/wyzecam/comments/bvis0f/psa_asking_alex...

Reelin• 7 years ago

What happened — The incorrect camera being shown was once owned by the same customer. After the customer deleted this camera, there was a bug where we did not completely clean up the user-device association for Alexa viewing. This resulted in the customer being able to view the camera from their Alexa device even though he does not own this camera anymore. Because the bug is related to device deletion from Alexa’s system, this bug ONLY impacts cameras that were Alexa enabled and then transferred to another account.

davidhyde• 7 years ago

What a PR disaster. It only takes one incident like this to tank a product. Testing is so important for IOT stuff but it usually gets shipped out way before it’s ready.

bitttttten• 7 years ago

So let's say an account at Wyze "owned" your device, now they can see your private cams.

This sounds like a backdoor.

ssss11• 7 years ago

So someone deleted their data and surprise surprise it wasn’t really deleted? And only got noticed because the tool stuffed up by using it. What’s the bigger issue the stuff up or the fact Google didn’t honour his deletion properly?

Too• 7 years ago

This is why you should never buy/sell electronics used for sensitive stuff like this second hand. Cases like this might seem bad but are still quite isolated and unlikely, imagine if the seller deliberately implanted malware, or buyer trying to get past your 2FA.

mistersys• 7 years ago

Heh.. I'm glad they resolved the issue quickly but this seems like bad security design, whenever a camera is associated with a new account they should have totally new encryption keys so the old account is locked out regardless of leftover information hanging out in Alexa. Not great to hear from a company with thousands+ of cameras streaming 24/7.

ttul• 7 years ago

This was my thought. Someone didn’t design this system with security and privacy in mind at the outset.

munchbunny• 7 years ago

Definitely agreed about making something like designing an encryption key per user account type of mechanism to force an error instead of a privacy violation.

GDPR requires this sort of "security and privacy by design" practice, but it's going to be a long time before there's any real widespread knowledge of how to do it, because it's actually really hard to do. I know developers who don't really understand that this principle goes beyond just 2fa and password best practices.

sonnyblarney2• 7 years ago

"Wyze was all over this from the get-go."

Sorry - this is a regular software bug. They can't just say 'hey patched that bug'.

If they were 'all over it', it never would have happened.

People's private lives are obviously very important to them, these companies should be super conservative like banks, not willy nilly like startups. Unfortunately, I don't think the business would exist as such, the 'real cost of operational overhead' of doing '5 nines' secure instead of '3 nines secure' might be too much for the business model to sustain.

Not in my home.

nyolfen• 7 years ago

i think they deserve some points for responding immediately, patching and explaining transparently. not enough points for me to buy one were i to get security cameras but credit where it's due.

tehlike• 7 years ago

If you are a swe, be mindful of what you say. You have your own bugs. They have their own. Wyze is a small company that is trying to stay afloat, and kudos to them for fixing it. I am sure they will have more bugs going forward, but each one will make them stronger.

Cheer for the improvements, not blame them for bugs.

Even non-swe people have bugs in work they do. Banks do mistakes all the time.

TeMPOraL3• 7 years ago

Unfortunately, I don't think the business would exist as such, the 'real cost of operational overhead' of doing '5 nines' secure instead of '3 nines secure' might be too much for the business model to sustain.

Business models are not sapient beings, they don't have some special right to exist. If a business can't be both done right and profitable, it simply shouldn't exist.

asdkhadsj• 7 years ago

Funny, I was looking into Wyze recently for some basic front yard security. I'll never enable an indoor security camera if it's internet connected, but recently the idea of a front door outside system seems reasonable.

In addition to this incident, anyone have any bad experiences with Wyze?

Sidenote, anyone know if you can disable sound on Wyze? My installation would likely be indoor pointing outdoor for simplicity, but I don't want it to record audio inside.

samnwa• 7 years ago

Saying that Wyzecam was 'all over this' reminds me of Chris Rock: https://www.youtube.com/watch?v=jkxB15nXRvM

CrowFly• 7 years ago

WARNING: If you watch the video your Alexa devices will respond!

devoply2• 7 years ago

I wonder how trivial now it would be for some secret gov org to get a live feed of so many areas if they were so inclined.

heyoni• 7 years ago

They weren’t hacked so much as badly transferred ownership. Basically someone (Alexa or Wyze) didn’t invalidate security tokens after the device was sold and changed hands.

kingo55• 7 years ago

Surely was not the first time a camera was sold second hand.

devoply2• 7 years ago

I know, but if that's trivial so is giving skeleton keys for all your network to the government for a fat contract (Amazon)... or they could just take it like they did with Cisco.

OrgNet• 7 years ago

They just have to ask through secret letters... they don't need to try any hacks...

tarr11• 7 years ago

Watching this video turned on my Alexa when he started talking to Alexa.

Feels like a kind of SQL Injection ("voice injection attack"?) .

sl1ck731• 7 years ago

It is a fun way to mess with your friends who use speaker phone to talk to you while at home.

bookofjoe• 7 years ago

You got that right: After I got an Echo Dot, my daughter (35, married with a 3-year-old son) in Pittsburgh started saying "Alexa, buy diapers" whenever we were on speaker. Alexa would reply something to the effect of "Diapers added to list," and my daughter would laugh so hard. Drove me nuts, to the point where I unplugged my Echo Dot.

whenchamenia• 7 years ago

And they deserve no less for recording you, presumably without permission. Illegal in many states.

ekimekim• 7 years ago

It's more like having an unauthenticated API open to the network, where in this case the network is sound waves in your local space. The idea that anyone is using voice for priveliged operations ("buy X", change my calendar, etc) is horrifying to me.

WrtCdEvrydy• 7 years ago

anyone is using voice for priveliged operations

I remember when people started broadcasting to Siri for people who had their headphones plugged in.

pavel_lishin• 7 years ago

I'm always startled to find out that people with very young kids have these in their house. Presumably there's some way from preventing a 3 year old from running up a $50k bill?

Sendotsh• 7 years ago

That’s been a thing since the start of voice assistants. I’ve even seen local TV ads do it to try get the viewers Google Home to activate, and mine has reacted to TV shows and YouTube channels before.

colechristensen• 7 years ago

There was an episode of 30 Rock where Jack pitches essentially an Alexa-powered TV, and the joke was TV shows controlling the TV itself, never thought of Tina Fey as a SciFi writer but here we are.

I've been meaning to turn off voice detection on my phone because I'm tired of Google reacting to my conversations (and worried enough about Google as it is).

jaboutboul2• 7 years ago

There was a story a while back about a reporter on the TV news that purposely said something to Alexa to show people how the devices can be activated remotely...

maxheadroom• 7 years ago

Feels like a kind of SQL Injection ("voice injection attack"?).

We used to take advantage of this on conference calls, where one of the participants was on speaker-phone and had an Alexa.

"Alex, play 'Never going to give you up' by Rick Astley"

Hopefully, people start waking up to this attack surface, as it's taken adventage of more because it's a very dangerous "gotcha".

Consider, for example, saying, "OK, Google, show me my last messages," during a conference call, in which Google will also read the messages aloud.

Fun times...

akerro• 7 years ago

https://www.youtube.com/watch?v=t7Krn-DH3tw

jaboutboul2• 7 years ago

As someone who has worked with Chinese made IoT devices, I have seen this problem many times. The issue is a bad architectural design of the system where a camera is “bound” to a user account and even if the user returns that camera it’s still bound to their account, and adding it to another account afterwards doesn’t disassociate it from the other user. It’s just stupid things like this that are not well thought out that pop up in the multitude of cheaply made Chinese IoT problems that have flooded the market.

Believe it or not, this is the smallest security flaw in some of these systems/devices...

ablanco• 7 years ago

Which ones do you recommend using?

chime• 7 years ago

Not sure what I would recommend for non-technical people but if you are a bit tech savvy, rolling your own is very robust nowadays. Buy cameras that don't need to be setup using an app (I prefer DHCP/Ethernet with web console), block them from going out at the firewall level, stop all services like mDNS/uPnP on the cams, install Blue Iris or BlueCherry DVR on a $500 laptop with 8TB USB drive, install the iOS/Android apps on your phone, open the right firewall ports, and now you can remotely monitor and watch your house from anywhere, safely.

I have 30 days of footage for 16 cameras recording to a 4TB HDD. The entire setup cost me around $3k over 7 years (cameras were more expensive in 2013).

There is absolutely no way I will ever trust a camera that needs me enter my home wifi password using an app, which then sends the plaintext password to a .cn domain to generate a QR code that the camera scans to configure itself (looking at you MECO Wifi IP cams). Way too many people around the world are falling for these cheap cams.

rodmena• 7 years ago

Horrifying.

kaijia• 7 years ago

Why is there no end-to-end encryption for such IoT devices? Does it mean the central service managing all devices have access to all the video streams?

tedd4u• 7 years ago

Apparently -- it's the Panopticon :(

dillonmckay2• 7 years ago

DRM from the consumer perspective?

tlrobinson• 7 years ago

Are there any camera systems that are internet-enabled (for remote viewing + storage) but use end-to-end encryption for video feeds?

It doesn't seem like too much trouble to have to pair the cameras to your mobile devices on the local network.

If I were an IoT camera company I wouldn't want to have the responsibility of securing video footage of inside peoples' homes.

alias_neo• 7 years ago

Unfortunately these cameras and other such devices are far too underpowered to do when the tasks they're given a lot of the time, let alone encrypt media.

They should he connected to a hub machine with more power to do the encryption and uploading there.

shocks• 7 years ago

I use a Xiaomi Dafang camera with custom firmware. They run on my local network with no access to the WAN. I can view them by tunnelling to a Raspberry Pi and forwarding ports. It works well but I have no solution for recording, yet.

dmje• 7 years ago

Why you'd want to fill your house with [internet connected] webcams is beyond me, let alone cams in your kids' rooms. People are weird.

Krasnol• 7 years ago

This is the first question that comes into my mind.

However I had to scroll down pretty far to find it here. It doesn't look better over at reddit.

No wonder nobody cares about the public space surveillance overload anymore. How could you, if your house is being monitored audio and visually by some company?

This is really frightening.

TeMPOraL3• 7 years ago

However I had to scroll down pretty far to find it here. It doesn't look better over at reddit.

Almost everyone who notices how ridiculously idiotic current IoT is has already spoken about it dozens of times here, on Reddit, or elsewhere. At some point people simply get tired of making the same point over and over and over again.

dillonmckay2• 7 years ago

I used to do CCTV installs and configs, and it seemed the wealthier folks would want cameras inside their house, particularly in their master bedroom.

Other folks simply wanted the exterior perimeter of their house under surveillance.

This is how the Hulk Hogan sex tape was created.

tgsovlerkhgsel2• 7 years ago

The kids rooms are pretty easy. Baby monitors have been a thing for a long time. Making them internet connected just means it's easier for the average person to get it to work on their phone (which may be on a different wifi, in a room just out of wifi range, using an AP with client isolation turned on, ...) which means that much more companies opt to build internet-connected than local-only stuff.

The house? For many, it acts as an alarm system. I also assume that the police will react better to "there's two people robbing my home, I can see them on my camera" than "my alarm app told me a window was broken".

throwayEngineer• 7 years ago

What is the risk? Someone is going to watch me jerk off?

Serious question.

social_quotient• 7 years ago

I understand it being an edge case in testing but I think there is a design issue here with “forever authorization”. Once the device is paired with Alexa I don’t see why Alexa would not still need to get authorization each time it accesses the device? It would seem like once the device went to another account Alexa would attempt authorization and then fail.

Authorization is the problem with a lot of security problems today. I don’t think it should be a corner care, it should be in the initial design of most things (internet of). Calls to banks, use of CC, and now IoT.

I read the resolution from wyze and while I’m happy they patched device associations I was looking for the term “authorization” and didn’t find it. I wish this term had more weight and meaning in the practical use cases we see as consumers. And I wish it was in the initial meetings for us tech devs.

Alexa shows private Wyze Cam feed to stranger [video]

Related Stories