6 ms·
Ring lacks basic security features, making it easy for hackers
- danso 7y agoAm I right in assuming that Ring, a company that was later acquired by Amazon, has an entirely different infrastructure than something like Alexa? From what I can tell, Alexa uses the same login system as my Amazon account, and (I assume/hope) is as safe/vulnerable to remote brute forcing as my Amazon account. But this seems not to be the case for Ring?
- tuxracer 7y agoSounds like it's not brute forcing simple using the same email/password for some random site that then gets compromised, malicious actors then try those same credentials to log into Ring and they're in first try
- TwoNineA 7y agoThe 'S' in IoT is for 'Security'.
- OnlineGladiator 7y agoI'm going to steal this - thank you :)
- ebg13 7y agoThat's ok. They did too.
- jibe 7y agoMy colleagues were only able to access my Ring camera because they had the relevant email address and password Come on, what lousy click bait. If you give someone your username and password, it isn't evidence of terrible security.
- danso 7y agoHijacking a specific, known account is only one attack vector, and it is not the attack vector that has brought Ring's security into the news lately. Modern cloud services provide throttling and other protection from brute force attacks: > Ring hackers' software works by rapidly checking if an email address and password on the Ring web login portal works; hackers will typically use a list of already compromised combinations from other services. If someone makes too many incorrect requests to login, many online services will stop them temporarily from doing so, mark their IP address as suspicious, or present a captcha to check that the user trying to login is a human rather than an automated program. Ring appears to have minimal protections in place for this though. Motherboard deliberately entered the wrong password to our account on the login portal while connecting from the Tor anonymity network dozens of times in quick succession. At no point did Ring try to limit our login attempts or present a captcha.
- millstone 7y agoRight, that's why the rest of the sentence is "but Amazon-owned home security company Ring is not doing enough to stop hackers breaking into customer accounts"
- addicted44 7y agoYou've taken that phrase completely out of context. The author is clarifying that their friends were only able to access it because the author gave them the email/password, because the author wants to illustrate what someone who did have your email/password could see. What's relevant are the sentences that come immediately after: >, but Amazon-owned home security company Ring is not doing enough to stop hackers breaking into customer accounts, and in turn, their cameras, according to multiple cybersecurity experts, people who write tools to break into accounts, and Motherboard's own analysis with a Ring camera it bought to test the company's security protections. Then the author goes through some instances and tools built to hack Ring passwords. IOW, the author isn't claiming that Ring is insecure because someone who he gave the email/password to is able to login. The author is showing the kind of information a person who has your email/password can access, and then is showing how easily it is for someone nefarious to get that information.
- Y-Bopinator 7y agoAs usual Vice is late to the party, re-packages a story that has already been circulating, takes all the credit, and does a terrible job presenting it. How is Vice still in business?
- brown9-2 7y agoThe part about the author giving their friend their credentials detracts from the main point of the article, which is: - Ring doesn’t check if the login comes from a new IP address or location - the Ring app doesn’t tell users how many others are logged in - Ring doesn’t check password dumps and alert users of reused credentials I think we should all demand that major consumer electronic companies include these features.
- jmccorm 7y agoI personally remember witnessing the exploit of reused credentials as far back as the 80s in the days of modems and personal BBSes. Here we are almost 40 years later and seeing the same problem, except with high speed live video streams from in and around a user's home. WOW!
- flashman 7y agoRing can do more to protect people who re-use credentials that have been in a data breach. Like Google's better password protection in Chrome,[0] sometimes the stakes are high enough that the responsible thing to do is be proactive on the user's behalf. [0] https://blog.google/products/chrome/better-password-protections/ https://blog.google/products/chrome/better-password-protecti...
- mikevp 7y agoThat's why all my passwords (including my Ring password) look like this: c3Ve*w^ZHKmq1SQK&gGVQCezROLgZy Individually generated, unique for every site I log into.
- deleted 7y ago[deleted]
- spydum 7y agoThis doesn't help if your machine gets infected with malware. They can steal that password and you'd never know - which is the point: unusual account activity should alert the user.
- syntheticcorp 7y agoIf an attacker compromises your machine and steals your password they can also just route their traffic through it, meaning the IP would match the regular one seen by the Ring servers
- spydum 7y agoYes they can, but what we often see is accounts sold off to others. They don't give away their infected machine. They just harvest credentials.
- dreamcompiler 7y agoI'm shocked SHOCKED that an Internet-of-Shit device has poor security. </sarcasm> I'm still waiting for an I-o-S device that has good security.