41 ms·
A podcast that hacks Ring camera owners live
- kick 7y agoIt's obviously bad to hack into a citizen's systems without consent, but there's some kind of value that might be created here. Ring cameras are basically being used as a gigantic police-partnered dragnet: Amazon’s Ring Planned Neighborhood “Watch Lists” Built on Facial Recognition https://theintercept.com/2019/11/26/amazon-ring-home-security-facial-recognition/ https://theintercept.com/2019/11/26/amazon-ring-home-securit... If this provides a disincentivize to an average user buying Ring cameras, their immature 'prank' may have unintentionally helped the nation.
- throwawaysea 7y agoI disagree that it is a 'dragnet'. That seems like an emotionally-colored take. It is camera owners voluntarily sharing footage with police when they request it. Citizens are allowed to lawfully film in many locations (their own homes, public spaces, etc.) and citizens are allowed to voluntarily exchange information they own with entities of their choosing.
- glenda 7y agoFrom what I’ve seen sharing these videos publicly also provides a potential thief with your location and information about the placement of your cameras, which is not a smart move if security is your main motive.
- Johnny555 7y agoWhat information is disclosed that the thief can't discover himself by driving or walking by your house? It seems unlikely that a thief needs to see a published list of camera locations to find my house, unless for some reason he's looking specifically for houses that are protected by Ring cameras. My ring doorbell cam is readily visible from the street, so there's no secrets about placement.
- OnlineGladiator 7y agoKnowing where the cameras are lets the thief know where the blind spots are. The thief wouldn't be able to see a hidden camera just by walking by (or at least it's much less likely). I don't think most Ring cameras are meant to be hidden though, since it's primarily sold as a doorbell.
- aidenn0 7y agoAt some point quantitative changes to cost and availability make a qualitative change in the invasiveness of a technology. I don't know enough about how ring footage is being used to say whether or not it's crossed that point, but this can't be dismissed just because it's something that's always been legal and happening at a smaller scale.
- HarryHirsch 7y agoJust the sheer scale of data collection by the Ring public-private partnership is worrisome already. Some of us worry about the amount of information held by Facebook, even those that do not have a Facebook account. The same principle applies here.
- throwawaysea 7y agoIf it is legally filmed footage (for example on public spaces or in a private residence), then there is no legitimate expectation of privacy.
- HarryHirsch 7y agoThere's the tiny issue that storage became so cheap over the last 20 years that recordings can now be kept indefinitely. In the past you had a CCTV camera, and you could store maybe a month's worth of movie (on tapes, in a safe), until you had to overwrite it. Now you just keep filming and have a never forgotten record of who lives in the neighbourhood. And if Facebook runs it though its face recognition system they get names, friends and other preferences. That completely changes the nature of CCTV recordings. The law just hasn't caught up with it, also because of prolific lobbying by the usual bigdata actors.
- homonculus1 7y agoExpectation of privacy was defined in an era when recording was expensive, on the assumption that there was a certain degree of anonymity in public just from the sheer impossibility of tracking everybody. There is no reason that our rights should be limited to what was found necessary to protect in the past. There must be a new category of expectation of transience, that Jeff Bezos and the FBI won't keep a permanent record of your every waking moment.
- throwaway2048 7y agoConsider if a police force was near omniscient, and could view everything happening in a city publicly, at all times 24/7. Don't you think that changes the nature of things, even if technically legal?
- erikpukinskis 7y agoOmniscient police would be a qualitatively new development, for sure. But as surveillance increases, so does stealth. You’d have to include that in your model.
- heavyset_go 7y ago> It is camera owners voluntarily sharing footage with police when they request it. Police can request that you share the footage you have, or police can get a warrant and obtain the footage directly from Ring. The difference between a camera whose footage you control and Ring is that Ring provides a nice interface to let police know that potential video evidence that you captured exists. A camera system that you rolled out yourself doesn't send a message to law enforcement agencies each time your cameras potentially capture evidence. The knowledge that video evidence exists makes it infinitely easier to get a warrant for it from a judge.
- throwaway393955 7y agoThey don't need a warrant. They only need to make a friendly administrative subpoena to Amazon, which will happily fork over the data without challenging the order, even if the owner has refused. https://arstechnica.com/tech-policy/2019/08/police-can-get-your-ring-doorbell-footage-without-a-warrant-report-says/ https://arstechnica.com/tech-policy/2019/08/police-can-get-y...
- heavyset_go 7y agoThis is a good point, as well. Part of Ring's business model is integration with law enforcement. The incentives in place certainly don't align with user privacy. Thanks for the link.
- throwawaysea 7y agoThis is a false story that relies on an incorrect statement from someone in the Fresno police department. Your own article contains this update: > UPDATE 5:55pm ET: After we published our story, a representative from Ring responded to our request for comment to deny all allegations in the Government Technology report. > "The reports that police can obtain any video from a Ring doorbell within 60 days is false," a spokesperson said. "Ring will not release customer information in response to government demands without a valid and binding legal demand properly served on us. Ring objects to overbroad or otherwise inappropriate demands as a matter of course. We are working with the Fresno County Sheriff's Office to ensure this is understood."
- throwaway_tech 7y ago>Ring cameras are basically being used as a gigantic police-partnered dragnet: Isn't that sort of like saying humans are basically used as a gigantic police-partnered dragnet...seeing as our entire criminal system is primarily driven by eye witnesses of crimes? Only what we know is eye-witnesses often have conflicting testimony, some will refuse to assist police officers (out of concern for their own safety or they just don't give a shit), and others outright lie. For example, a UFC fighter's step-daughter was recently kidnapped and murdered (abducted right from a gas station)...video would later assist identify the suspect and lead to arrest, but also identify eye witnesses to the abduction (who never came forward because they "didn't want to get involved") but after the video identified the witnesses, their testimony ended up being important.
- hannasanarion 7y agoA police camera watching a gas station is not the same as a police camera watching your front door.
- jsight 7y agoNo, but my camera watching what happens outside of my house is also not the same as a police camera. I didn't have such a camera at my old house, but if I did, there were several happenings that would have been reported to police.
- reaperducer 7y agothere were several happenings that would have been reported to police. Reported. Not prevented. The companies that make money off of law enforcement have conditioned people to believe cameras=prevention and camera=safety, which is false.
- Tempest1981 7y agoTrue, but camera=deterrent?
- ActorNightly 7y agoThis is a very hyperbolic take. Police do not have access to the cameras, only the server stored footage, which is both optional to share and optional to even participate in.
- reaperducer 7y agoUntil all video starts streaming to the server in a software update. For the safety of your children.
- ActorNightly 7y agoAt which point the company gets massive federal lawsuit violating multiple laws, and gets shut down quick.
- bradknowles 7y agoNo, a democracy dies to thunderous applause.
- __jal 7y agoThis is a red-herring. Nobody cares about physical access to essentially disposable cameras. The stored footage is the whole game.
- ActorNightly 7y agoYes, and stored footage is completely optional with Ring cameras.
- __jal 7y agoCan you point to a page where Ring says this? I cannot find any indication that these work with anything other than their cloud service.
- throwaway393955 7y ago
- dzhiurgis 7y agoHow is helping petty thieves and junkies is helping the nation?
- PascLeRasc 7y agoDo you look like any "petty thieves and junkies"? Are you sure? It's your word against Amazon's.
- fpgaminer 7y agoAs someone who tends to fall on the side of privacy more often than not, I'm actually not sure how I feel about facial recog+home security cameras. I'm completely against any fully automated system where the police can have access to the camera's data. But on the other hand, what if the system was implemented completely locally, and all with the owner's control and permission? So your Ring app pops up and says "Hey, your local police department is looking for a suspect and your camera spotted them. Would you like to share the footage?". So many petty crimes (e.g. home burglaries, car breakins, etc) go unsolved because the police just don't have the tools and resources to go after all those crimes. I have neighbors who've had their homes and cars broken into. It's a violating experience, and I think it's justified to want the perpetrators of those crimes caught and sentenced appropriately; at the very least to dissuade others. Within the context of a well built, local, permissioned system, I'm not sure I'm against it. Of course A) The likes of Amazon would never build such a system responsibly; they'd rather gobble up and abuse the data themselves. B) There are serious security concerns, as evidenced by TFA. C) Civil disobedience and similar acts are an important part of democratic society, and mass surveillance, responsible or not, threatens that. And finally, D) something which I think everyone misses when it comes to facial recognition systems ... they're still not very good. SOTA published recog systems make a mistake on 1 in 1000 faces (http://vis-www.cs.umass.edu/lfw/results.html http://vis-www.cs.umass.edu/lfw/results.html), and that's on LFW which is fairly high quality. I'm sure FAANG does better, and SOTA will continue to improve quickly, but is that good enough for this kind of application? So I'm torn.
- trevyn 7y agoHow do you know the request is connected to violation of a law you agree with?
- mikepurvis 7y agoIf nothing else, you could review the footage yourself before deciding to share. If they person the system thinks it recognized looks like they're minding their own business, bury it.
- fpgaminer 7y ago
- bobongo 7y agoI wonder whether Nest cams are being used in a similar fashion.
- mv4 7y agoYes they are. FTA:"The NulledCast is a podcast livestreamed to Discord. It's a show in which hackers take over people's Ring and Nest smarthome cameras and use their speakers to talk to and harass their unsuspecting owners."
- NulledMember 7y agoThe discord was made to talk about the last situation that happend on the website. The Cast was not made for any of this Ring thing. Some Kid named Chance done this shit while they were in the podcast.
- remotecool 7y agoI have no problem with this. I have ring cameras all around my property and so do most of my neighbors and it's already caught multiple people attempting breaking and stealing packages. They get hacked because of poor password choices. You are fighting against a changing tide and the benefits of the cameras vastly outweigh the privacy concerns.
- themagician 7y agoIt’s not even a changing tide. Security has always been more important than privacy to the average person. In the 90s monitored home security was a HUGE business. Thousands for an install and thousands more per year to have someone sit around and watch for unusual activity and report it to the police. ADT and Brinks are all that’s really left, but I remember dozens of companies competing in this space growing up. Now you can get the same essential service, better in many ways, for $99 and a small monthly fee.
- remotecool 7y agoIt sounds like we agree.
- wronglebowski 7y agoI read this and I'm not sure how to feel. This is the real world impact of devices that can actually impact our lives being internet accessible and with security that doesn't match. That's not to say a simple password and email isn't secure enough, just that there's much bigger repercussions when your nest gets hacked as opposed to your GrubHub account.
- angry-sw-dev 7y agoHaving your life compromised is never comfortable, but it's never less comfortable then when you suddenly realize you're being watched and having your home "invaded" in a potentially very personal way. So if I understand it, the scenario is the digital equivalent of someone who uses a single key to fit every lock in their lives -- front door, back door, car door, ignition, safe deposit box, etc... The key is stolen, possibly through no specific fault of the owner, and the owner may not realize it has even happened... ...and then these discord shock jocks go off and brute force these compromised email/password combinations until they stumble upon a working pair and then the hapless victim is subjected to the electronic analog of them unlocking the front door of their home and bursting into the living room yelling "hahaha gotcha, kill yourself!" ...all in order to increase their views/ratings. I think it's just a shitty thing to do, but even more so when it involves children, or people who have no control over the cameras (like animal shelter workers)... I suppose _maybe_ if they made an effort to alert the owner first, an email "hey we have your u/p, if you don't change it in 72 hours you're going to be on our show"... I think the nulledcast crew ought to take a lesson from Jon Stewart: BE A FUCKING PERSON ... think about how shitty what you're doing is, and no, the fact that these people are saps with insecure logins does not mean they deserve this.
- grahamperich 7y agoI'm trying to figure out exactly how these ring hacks are happening. My whole family and extended family is concerned about them. So just to be clear, there isn't a known vuln with Ring specifically, right? It's just that people's email/passwords are getting popped somewhere else on the internet, and then because of password reuse their Ring account is also compromised? Is that the gist of it?
- Wordball 7y agoIf you have a Ring camera pointed at the street, this is literally what you are asking for.
- OrgNet 7y agoI have a camera pointed at the street but it is not a ring camera... am I asking for it?
- LinuxBender 7y agoHave any children heard "Santa Claus" tell them to run across the street to get their present from the elf in the white van?
- dmschulman 7y agoActually, yes. Almost https://abcnews.go.com/US/ring-security-camera-hacks-homeowners-subjected-racial-abuse/story?id=67679790 https://abcnews.go.com/US/ring-security-camera-hacks-homeown...
- cryptozeus 7y agoOnce again there is no need for this, anyone using these kinds of systems are literally trading privacy over small value provided feature.
- danso 7y agoBeing able to check on children remotely are not a small value to most working parents, or at least, not particularly smaller than most tech improvements in life.
- heavyset_go 7y agoThere are plenty of companies that provide solutions to this problem that don't integrate with law enforcement as part of their business model.
- cryptozeus 7y agoYeh I meant not go with fancy new products like ring and alexa which does not care for your privacy.
- baroffoos 7y agoIf your children are too young to call you for an issue then they should not be left alone while you work.
- jaywalk 7y agoI think "hacks" is a pretty strong word here. They're basically just brute forcing accounts with email and password combos that have been leaked from other sources.
- Someone1234 7y agoIt is the same headline as the "Did Disney+ get hacked?" stuff the other day. 10m+ credentials were available almost immediately because people re-use username/password combos across every site. That's why I am pro-password managers. Even if they're imperfect, password re-use remains a major active threat (contrast that with a lot of theoreticals against password managers). Around ten of my accounts' information has been leaked (inc. big ones like Adobe). But I don't re-use credentials so aside from an uptake in spam, it has had no impact. Typically these were services I haven't used in years.
- draw_down 7y agoI don’t know about that. “Hack” is an overloaded term, but one of its meanings is to gain unauthorized access. Seems apt.
- michaeloder 7y agoWhy is Ring allowing brute forcing? Individual cameras should be set to only allow logins at least a few seconds apart increasing up to several minutes and perhaps blocking IP addresses with excessive volume. If they're brute forcing Ring's servers an application firewall would catch and block this.
- pgoggijr 7y agoI don't think that the above comment means brute-forcing in the "try a million different passwords in a short time-period" sense, it's referring to finding a list of known password and email combinations and trying just those. I would expect that a few attempts wouldn't trip any brute-force alarms.
- g4k 7y ago
- mrcu5 7y agoThe title makes it sound like there is a security issue with the cameras, but the "hacks" are from password leaks.
- bronson 7y agoThat's still a security issue with the camera. Maybe passwords are insufficient for their role. Edit, further discussion (from 15 mins ago): https://news.ycombinator.com/item?id=21776250 https://news.ycombinator.com/item?id=21776250
- baroffoos 7y agoAt some point we have to admit that passwords have not worked and the general public does not understand how to use them despite decades of education attempts. This problem would be entirely solved if they enforced the use of 2fa
- ehsankia 7y agoAt the very least, have e-mail 2fa for new devices, it's fairly trivial, isn't too annoying, and works decently enough. Most banks and important services do this. Whenever you login for the first time on a new device or far away IP, it sends you an email to authorize the new device. It's pretty trivial but goes a long way.
- surround 7y agoThe cameras should be hard wired or at least hosted locally. Allowing open connection to the internet is a serious security issue.
- brianberns 7y agoI agree, but isn’t the remote access “feature” a big part of the marketing for these devices? E.g. check on your pet when you’re at work.
- boatswain 7y ago> The software churns through previously compromised email addresses and passwords to break into Ring cameras at scale. Given the sensitive nature of cameras in homes, I think Ring should require 2FA.
- Someone1234 7y agoI agree. Even "bad" 2FA (e.g. SMS) is better than nothing in this case. However, I suspect some would complain about needing to give a telephone number to use their new camera.
- jrockway 7y agoI think it would be completely reasonable to bundle one of those Bluetooth-based U2F tokens and to require that to be around when you want to access the camera remotely. To add new tokens to your account, you would have to place them on top of the camera, or something. This makes the attack described in the article basically impossible, and lets the camera vendor sell you tokens if you have multiple family members that want to log in. A win-win!
- ActorNightly 7y agoOr just have a min password length requirement that is at least a 5 word sentence. Easier to remember, and more secure.
- just_myles 7y agoYou know, I hadn't thought about that.
- SirYandi 7y agoAlthough password security makes no difference to how these devices were hacked, by password leaks.
- ActorNightly 7y agoMethod wise, you are correct. However, forcing all the users to adopt a new password creation paradigm will statistically make this a very small issue.
- Muuuchem 7y agoLol dude hacked a 8 year old girl and claimed to be santa clause, gave her permission to do what she wanted including breaking the TV LAWL. https://www.digitaltrends.com/news/hacker-accesses-ring-camera-in-little-girls-bedroom-to-tell-her-hes-santa/ https://www.digitaltrends.com/news/hacker-accesses-ring-came...
- dang 7y agoPlease don't do this here.
- jacobwilliamroy 7y agoJust heard about this on the radio eating breakfast. The DJ said "so I guess you should be changing your passwords often if you want to protect your self. And also turn on uh... what was that thing starts with a 2? 2-something? Uhhh... yeah 2-fac-tor authentication... yeah. Do that." The radio crew doesnt talk about computers very often so I thought the way they spoke was interesting.
- deleted 7y ago[deleted]
- soylentcola 7y agoCompletely beside the point, but how is a Discord live stream a "podcast"? Have media folks just started calling any streaming audio a "podcast" now?
- madenine 7y agoIn short, yes.
- tw1010 7y agoThe alternative is "radio" which is even weirder
- ehsankia 7y agoWebStream?
- djrogers 7y agoWhat’s wrong with calling it a livestream? It’s accurate and already in common use.
- jedimastert 7y agoLivestream implied video
- gatherhunterer 7y agoThey call themselves NulledCast. If they operate as and refer to themselves as a podcast, what are “media folks” supposed to call it?
- tantalor 7y ago"I identify as a podcast."
- baddox 7y agoAm I mistaken, or is it not an accident that “podcast” rhymes with “broadcast”? I thought the whole metaphor behind the name was that these were essentially radio broadcasts except you listened to them on your iPod: podcasts. The fact that they weren’t generally live is simply due to the fact that electronic hardware and wireless internet weren’t up to the task at the time. Now, calling live audio streams “podcasts” seems perfectly understandable and arguably even more faithful to the original idea because of the ubiquity of streaming media.
- annoyingnoob 7y agoIf Ring cared about security they would enforce 2FA for everyone.
- 34679 7y agoLuckily, if you click on the link to the original article near the beginning of this article, there's a video clip from a local news outlet that offers a sure-fire way to avoid being hacked, from tech security "expert" Michelle Bordoff: "Wired cannot be hacked." "Someone has to be in your home, hardwired to your modem to see anything on your network." Someone should let the world's governments and financial institutions know that all they need to do to stop hackers is stop using wireless servers.
- stallmanite 7y agoIf she hadn’t mentioned the word modem I’d be on board. An old fashioned analog camera wired directly to a VHS recorder would be a bitch to hack remotely right?
- recrudesce 7y agoBut they are modems. Some of them are just built into routers. VDSL and cable connections require modems to function.
- stallmanite 7y agoI’m talking about an analog camcorder hooked to a vcr. No modem is involved. The point of my comment was to imagine a hypothetical system in which the “security expert”’s statement wouldn’t be ridiculous.
- beshrkayali 7y agoAs it has been said before, the S in IoT stands for security.