The Red and The Black

https://blog.12security.com/the-red-and-the-black/

by Andrex • 7 years ago

68 29 7 years ago

blog.12security.com

a2tech• 7 years ago

There is no information in this announcement--not even a teaser.

mikece• 7 years ago

True... but I've wondered how Wyze was making money on their $20 cameras with free cloud storage of events for 30 days. It's not exactly a free product but doesn't cost enough for what it does. I'm going to go unplug all of mine right now.

tehlike3• 7 years ago

See my comment above.

Their model was to sell smarter features as they build. In addition to this, apparently.

davrosthedalek• 7 years ago

...or, flash them with an alternative firmware. https://github.com/EliasKotlyar/Xiaomi-Dafang-Hacks

AnimalMuppet• 7 years ago

with free cloud storage of events for 30 days

That turns out to be the same as "give us 30 days to pull any information we care about from your camera feed" - unless they decide it's worth making a copy, in which case they have forever.

Animats• 7 years ago

Is that about this leak?[1] Or something else, like misusing the video?

[1] https://www.theverge.com/2019/12/30/21042974/wyze-server-bre...

EvanAnderson• 7 years ago

It looks like the prior two posts have some details: https://blog.12security.com/wyze/

Andrex5• 7 years ago

The other blog posts on the site have the full (well, developing) story. Unfortunately I was only able to link one, and I was having a tough time coming up with a title so I used an excerpt from this post.

https://blog.12security.com/wyze/

https://blog.12security.com/wyze-essay-2-aresflare/ <- technical details aplenty

saagarjha• 7 years ago

Still quite a tease. I can’t say that I particularly like this style of reporting.

tehlike3• 7 years ago

There is a good reason many of us have been flashing it with dafang hacks from https://github.com/EliasKotlyar/Xiaomi-Dafang-Hacks

headbansown2• 7 years ago

That's a shame because I always liked their terminals and keyboards. Oh, wait.

jmgao• 7 years ago

That's Wyse, a different company.

DonHopkins2• 7 years ago

Wyse was trying to get the Ann Arbor Ambassador fired.

headbansown2• 7 years ago

That is a beauty; can't believe I'd never seen/heard of it back in the day!

jdashg• 7 years ago

"I'm not blaming business leaders per se, as they are at the mercy of large historical and economic forces that limit what can influence them and the options open to them to choose"

I'm frustrated by the continued conflation of understandability and excusability. A band robber's motives are understandable, but we don't excuse them. However, while the systemic forces acting on business leaders make it understandable when they make mistakes, but we must draw a sharp line between understanding and excusing.

We can't credit leaders in good times, while also excusing them when systemic failures corrupt them.

Andrex5• 7 years ago

Edit- I'm looking more into 12Security, and they seem sketchy too. But IPVM seems to lend enough credit to take this seriously.

---

Full information is available at the following two blog posts, with more to come:

https://blog.12security.com/wyze/

https://blog.12security.com/wyze-essay-2-aresflare/ (many technical details here)

It also seems like a WSJ journalist has been helping on this (since they were compromised), so if this is real I'd expect an article soon.

yalogin• 7 years ago

The intent of the post is not about security vulnerabilities but actual espionage, it will be beneficial if the author simply presented the whole case instead of providing a teaser like this. They could have purchased a catchy URL, as is the standard practice nowadays, but it’s good to always come out with the proper case. Ow with this teaser I cannot help but think that it’s more of a PR move, unless proven otherwise.

Andrex5• 7 years ago

A lot of technical details are available here, and they seem staggering: https://blog.12security.com/wyze-essay-2-aresflare/

tehlike3• 7 years ago

@dang although the title of the post is from the article itself, it is not descriptive of what it is. I liked previous title more.

Andrex5• 7 years ago

Yup, this seems pretty likely to drop off the front page now. ¯\_(ツ)_/¯

Which means HN users with Wyze devices will likely be in the dark about just how bad this is (only taking the company's official word) until the WSJ exposé.

blondin• 7 years ago

well, with all the criticism we give them, journalists know how to come up with great story titles, don't they? :)

jacobolus• 7 years ago

In particular this post seems to have nothing to do with the Stendhal novel in its content, themes, style, ..., https://en.wikipedia.org/wiki/The_Red_and_the_Black

dang2• 7 years ago

The bigger problem is that this article says nothing—it is merely an announcement of an announcement:

we now believe at this time, and this evidence will be released over the next week, that Wyze was committing espionage against American citizens in the United States

That somebody "now believes something at this time and this evidence will be released over the next week" doesn't come close to being a substantive submission for Hacker News. Here we can wait for the actual information. "Over the next week" sounds like they plan to dole it out in pieces though, which is also not good for Hacker News. (Tricks to get page views generally aren't.)

https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...

https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...

BubRoss• 7 years ago

This title was changed from something informative to something that says nothing about the story at hand.

Andrex5• 7 years ago

It's a HN-ism we have to abide by even if I tend disagree with the title being changed in most cases.

Unfortunately the other two blog posts were similarly poorly titled.

dang2• 7 years ago

The submitted title, "Wyze was committing espionage against American citizens in the United States", wasn't informative. The actual information here is merely that someone believes something and says they will release evidence "over the next week".

See https://news.ycombinator.com/item?id=21919237.

mkopinsky• 7 years ago

The forum post at https://forums.wyzecam.com/t/updated-12-29-19-data-leak-12-2... has all the details from the company's perspective. The rest seems like scare-mongering to me.

mrbonner• 7 years ago

I wanted to purchase a few of the Wyze cameras for my house because of the price ~$20 each. At first, I thought this price could be a loss-leader strategy for more lucrative services (premium or longer cloud storage), kind of like Ring but with much cheaper hardware. Alas, when I found out that the cloud storage is free for 30 days I was skeptical. How would you make money from this sale?

I'm not a paranoid person. I do have Ring doorbell, a P.O.S Samsung camera and Alexa in my house. My rationale is that since those cameras are for outside of my home, I wouldn't care about being spied upon. But if the Wyzes are used by the CCP for surveillance foreign territories, this could spell a lot of trouble. For example, a week prior to the Pearl Harbor event, the imperial Japan phoned Japanese-American in Hawaii to ask about the weather, troop movement, military vehicles movement. I can't imagine if those outside cameras are used for the purpose, the intelligence gathered is paramount.

You could argue that since everybody is carrying a smartphone with camera nowadays, it wouldn't take much effort to "spy" foreign territories simply by checking social media uploaded. While it is true, would it be more devastating if they can see every thing anytime/anywhere they want?

The Red and The Black

Related Stories