6 ms·

Even if it was the official article title, "Data Leak" is extremely misleading; the attack is called credential stuffing and is unrelated to any sort of breach

Even if it was the official article title, "Data Leak" is extremely misleading; the attack is called credential stuffing and is unrelated to any sort of breach on Ring's end. Edit: finished reading the article, and the entire text is just as misleading as the title, credential stuffing happens all the time and really isn't newsworthy.

bart_spoon 7y ago
The rhetoric surrounding Ring has reached a fever pitch. Seems like we get a new article or two every day about Ring, and the quality varies wildly. Its hard to know what to take seriously and what is just media preying on people's fears.
HenriNext 7y ago
No, actually the article claimed the opposite: the attack was likely NOT credential stuffing..
- qw3rty01 7y ago
  After reading the article, it's pretty clear that it was credential stuffing and that the writer didn't take the time to understand how it worked. Not sure what security experts they talked to, but credential stuffing absolutely can get all the information described, and the whole part about wifi connected devices is completely unrelated.
  - HenriNext 7y ago
    I'm not making any guesses what actually happened. Just stating that you misrepresented what the article actually said when you wrote "the attack is called credential stuffing". Your sentence gives impression that the article would have said it, but the article made a point for the opposite.
    - qw3rty01 7y ago
      The Amazon spokesperson directly said it was credential stuffing--the article was trying to argue that it was more than that in an extremely misleading way.
      - HenriNext 7y ago
        You may be totally right and it was credential stuffing and the article may have been wrong, misleading, incompetent and stupid. Nonetheless, you misrepresented what the article actually said -- the article raised both, the possibility credential stuffing (implied by Amazon spokesperson), and doubt about it (unspecified security expert, WiFi attacks).
        qw3rty01 7y ago
        Calling out an article for being misleading is not the same as misrepresenting it.
        HenriNext 7y ago
        Yes they are different, and you did both: called it out for being misleading, and simultaneously misrepresented what it actually said (I've already detailed the reasons above, and others have quoted them verbatim to you). The best before date of this conversation has clearly expired, so let's just stop here.
      - geofft 7y ago
        It's in Amazon's interest to argue that it wasn't a failing on their part.
        caf 7y ago
        I mean, being this susceptible to credential stuffing is a failing on their part, too.
  - Pfhreak 7y ago
    > Not sure what security experts they talked to https://www.eff.org/about/staff/cooper-quintin https://www.eff.org/about/staff/cooper-quintin
    - qw3rty01 7y ago
      The article implied he wasn't the only one they talked with. There isn't anything he said that was explicitly incorrect (unlike some of the other unnamed security researchers), but he must not have much experience with credential stuffing incidents given his responses.
    - sp332 7y ago
      And here is his take on it. https://twitter.com/cooperq/status/1207780461834977281 https://twitter.com/cooperq/status/1207780461834977281
      - qw3rty01 7y ago
        I really wish this was included in the article, his conclusion makes a lot more sense in that context (though I still disagree with it).
      - 55555 7y ago
        His take is a result of him trying not to completely let go of the story he's already decided is significant. There is no story. There isn't really a great way to defend against credential stuffing attacks when the adversary has access to a huge residential proxy network and you don't want to greatly inconvenience your users. All major US banks are pretty vulnerable to credential stuffing attacks. If banks aren't going to defend against it, Ring isn't.
orhmeh09 7y ago
If we read the same article, we’d have been agreeing that it said it was unlikely to be credential stuffing. > Security experts told BuzzFeed News that the format of the leaked data — which includes username, password, camera name, and time zone in a standardized format — suggests it was taken from a company database. They said data obtained via credential stuffing —when previously-compromised emails and passwords are used to get access to other accounts — would likely not display RIng-specific data like camera names or time zone. > “One could argue that the person maybe got these through credential stuffing,” Cooper Quintin, a security researcher and senior staff technologist at the Electronic Frontier Foundation, told BuzzFeed News. “But if that was the case, why did that person go through and add the information about names of camera and time zones?”
- qw3rty01 7y ago
  All of that information is extremely common when it comes to aggregated information sold/shared for credential stuffing, there's nothing that sticks out as odd or out of place in any of this. It can all be pulled through scripts, there's no extra effort needed.
- strictnein 7y ago
  This is a credential stuffing attack. Why did they add it? Why not? I'm betting when they logged in that info came back as part of the API call.
  - HenriNext 7y ago
    > Why did they add it? If they were going to sell the information, and the credentials really allowed to remotely access the cameras, then accessing 'camera=BEDROOM' at 11PM Friday local time may provide more entertainment value than 'camera=GARAGE'? :)
geofft 7y ago
> credential stuffing happens all the time and really isn't newsworthy. If a bad thing happens all the time and people are unaware of it, calling attention to it is entirely newsworthy. To you, as a jaded security person who understands that there are systemic risks to any network-connected service and nobody is good at defending against them, perhaps it's perfectly normal. To a customer who is making the decision between buying a network-connected doorbell for their security and buying a perfectly normal offline doorbell, the fact that credential stuffing happens all the time is a thing they need to hear about! (Also, there are straightforward ways to resist these attacks, such as "You must use 2FA," "You can only pair a new device with your Ring account while it's in physical proximity to your Ring device," "You must use either 2FA or physical proximity," "The app will generate a password for you and won't let you use an existing one, feel free to write it down on a piece of paper," etc. A home security system should be more paranoid than a politics forum or a meme generator at keeping accounts secure.)
- dylz 7y ago
  I really hope physical proximity is also some kind of handshake with the device, and not spoofable in-app "GPS"
  - funcDropShadow 7y ago
    I hope physical proximity does not mean standing in front of the door. Outside.
- jessriedel 7y ago
  Under that justification, it would require at a bare minimum giving the reader the proper context, e.g., "similar non-breach threats exists for a large number of common online services, such as [list examples the reader is likely to know]".
  - geofft 7y ago
    Sure, but also, my impression is that similar threats do not exist for e.g. Google (because of heuristics on login attempts, scans on the backend for breached passwords, aggressive and un-silenceable notifications about new logins, a well-staffed security team, etc.). So an accurate statement is that most online services that do not specifically invest in account security are vulnerable. Then customers can decide whether they want an internet-connected home security system from a company that doesn't invest heavily in account security.
phjesusthatguy3 7y ago
I think your objection is misplaced. It doesn't matter where the credentials came from if there's a list out there that targets Ring accounts.
- lucb1e 7y ago
  Would you say that a thousand houses "leaked their owner's data" (presence information) if someone went by ten thousand specific homes and rang their doorbells to test if someone is home based on information they got from a third party? I would say there is a substantial difference between compiling a list of valid Ring credentials by trial and error based on data you already have from another party ("credential stuffing") and Ring disclosing the credentials either on purpose or through a hack ("leaking data" / "data breach"). Note that another comment calls into question whether this really was credential stuffing, but that's not what I mean to comment on.
  - 0xEFF 7y ago
    Yes, if those thousand houses were connected to a wire that allowed them to be rung simultaneously and remotely.
  - phjesusthatguy3 7y ago
    >Would you say that a thousand houses "leaked their owner's data" (presence information) if someone went by ten thousand specific homes and rang their doorbells to test if someone is home based on information they got from a third party? That's not what's the headline says, and that's not what TFA says. Someone "leaked" a list of valid credentials to Ring accounts. A better analogy would be if someone collected ten thousand keys they found around the city, tried them on every lock they came across, and then created a map showing which keys worked on which locks. And provided an infinitely-copyable keyring to go along with the map. Ring says they're not responsible for the data being out there, and that's probably true. But the data is out there, and that's a problem for the people on the list.
EncryptEntropy 7y ago
Thanks, so I didn’t have to read article. Really misleading title, I was thinking “...How do only 3k accounts leak...?”

bart_spoon 7y ago

The rhetoric surrounding Ring has reached a fever pitch. Seems like we get a new article or two every day about Ring, and the quality varies wildly. Its hard to know what to take seriously and what is just media preying on people's fears.

HenriNext 7y ago

No, actually the article claimed the opposite: the attack was likely NOT credential stuffing..

qw3rty01 7y ago
After reading the article, it's pretty clear that it was credential stuffing and that the writer didn't take the time to understand how it worked. Not sure what security experts they talked to, but credential stuffing absolutely can get all the information described, and the whole part about wifi connected devices is completely unrelated.
- HenriNext 7y ago
  I'm not making any guesses what actually happened. Just stating that you misrepresented what the article actually said when you wrote "the attack is called credential stuffing". Your sentence gives impression that the article would have said it, but the article made a point for the opposite.
  - qw3rty01 7y ago
    The Amazon spokesperson directly said it was credential stuffing--the article was trying to argue that it was more than that in an extremely misleading way.
    - HenriNext 7y ago
      You may be totally right and it was credential stuffing and the article may have been wrong, misleading, incompetent and stupid. Nonetheless, you misrepresented what the article actually said -- the article raised both, the possibility credential stuffing (implied by Amazon spokesperson), and doubt about it (unspecified security expert, WiFi attacks).
      - qw3rty01 7y ago
        Calling out an article for being misleading is not the same as misrepresenting it.
        HenriNext 7y ago
        Yes they are different, and you did both: called it out for being misleading, and simultaneously misrepresented what it actually said (I've already detailed the reasons above, and others have quoted them verbatim to you). The best before date of this conversation has clearly expired, so let's just stop here.
    - geofft 7y ago
      It's in Amazon's interest to argue that it wasn't a failing on their part.
      - caf 7y ago
        I mean, being this susceptible to credential stuffing is a failing on their part, too.
- Pfhreak 7y ago
  > Not sure what security experts they talked to https://www.eff.org/about/staff/cooper-quintin https://www.eff.org/about/staff/cooper-quintin
  - qw3rty01 7y ago
    The article implied he wasn't the only one they talked with. There isn't anything he said that was explicitly incorrect (unlike some of the other unnamed security researchers), but he must not have much experience with credential stuffing incidents given his responses.
  - sp332 7y ago
    And here is his take on it. https://twitter.com/cooperq/status/1207780461834977281 https://twitter.com/cooperq/status/1207780461834977281
    - qw3rty01 7y ago
      I really wish this was included in the article, his conclusion makes a lot more sense in that context (though I still disagree with it).
    - 55555 7y ago
      His take is a result of him trying not to completely let go of the story he's already decided is significant. There is no story. There isn't really a great way to defend against credential stuffing attacks when the adversary has access to a huge residential proxy network and you don't want to greatly inconvenience your users. All major US banks are pretty vulnerable to credential stuffing attacks. If banks aren't going to defend against it, Ring isn't.

orhmeh09 7y ago

If we read the same article, we’d have been agreeing that it said it was unlikely to be credential stuffing. > Security experts told BuzzFeed News that the format of the leaked data — which includes username, password, camera name, and time zone in a standardized format — suggests it was taken from a company database. They said data obtained via credential stuffing —when previously-compromised emails and passwords are used to get access to other accounts — would likely not display RIng-specific data like camera names or time zone. > “One could argue that the person maybe got these through credential stuffing,” Cooper Quintin, a security researcher and senior staff technologist at the Electronic Frontier Foundation, told BuzzFeed News. “But if that was the case, why did that person go through and add the information about names of camera and time zones?”

qw3rty01 7y ago
All of that information is extremely common when it comes to aggregated information sold/shared for credential stuffing, there's nothing that sticks out as odd or out of place in any of this. It can all be pulled through scripts, there's no extra effort needed.
strictnein 7y ago
This is a credential stuffing attack. Why did they add it? Why not? I'm betting when they logged in that info came back as part of the API call.
- HenriNext 7y ago
  > Why did they add it? If they were going to sell the information, and the credentials really allowed to remotely access the cameras, then accessing 'camera=BEDROOM' at 11PM Friday local time may provide more entertainment value than 'camera=GARAGE'? :)

geofft 7y ago

> credential stuffing happens all the time and really isn't newsworthy. If a bad thing happens all the time and people are unaware of it, calling attention to it is entirely newsworthy. To you, as a jaded security person who understands that there are systemic risks to any network-connected service and nobody is good at defending against them, perhaps it's perfectly normal. To a customer who is making the decision between buying a network-connected doorbell for their security and buying a perfectly normal offline doorbell, the fact that credential stuffing happens all the time is a thing they need to hear about! (Also, there are straightforward ways to resist these attacks, such as "You must use 2FA," "You can only pair a new device with your Ring account while it's in physical proximity to your Ring device," "You must use either 2FA or physical proximity," "The app will generate a password for you and won't let you use an existing one, feel free to write it down on a piece of paper," etc. A home security system should be more paranoid than a politics forum or a meme generator at keeping accounts secure.)

dylz 7y ago
I really hope physical proximity is also some kind of handshake with the device, and not spoofable in-app "GPS"
- funcDropShadow 7y ago
  I hope physical proximity does not mean standing in front of the door. Outside.
jessriedel 7y ago
Under that justification, it would require at a bare minimum giving the reader the proper context, e.g., "similar non-breach threats exists for a large number of common online services, such as [list examples the reader is likely to know]".
- geofft 7y ago
  Sure, but also, my impression is that similar threats do not exist for e.g. Google (because of heuristics on login attempts, scans on the backend for breached passwords, aggressive and un-silenceable notifications about new logins, a well-staffed security team, etc.). So an accurate statement is that most online services that do not specifically invest in account security are vulnerable. Then customers can decide whether they want an internet-connected home security system from a company that doesn't invest heavily in account security.

phjesusthatguy3 7y ago

I think your objection is misplaced. It doesn't matter where the credentials came from if there's a list out there that targets Ring accounts.

lucb1e 7y ago
Would you say that a thousand houses "leaked their owner's data" (presence information) if someone went by ten thousand specific homes and rang their doorbells to test if someone is home based on information they got from a third party? I would say there is a substantial difference between compiling a list of valid Ring credentials by trial and error based on data you already have from another party ("credential stuffing") and Ring disclosing the credentials either on purpose or through a hack ("leaking data" / "data breach"). Note that another comment calls into question whether this really was credential stuffing, but that's not what I mean to comment on.
- 0xEFF 7y ago
  Yes, if those thousand houses were connected to a wire that allowed them to be rung simultaneously and remotely.
- phjesusthatguy3 7y ago
  >Would you say that a thousand houses "leaked their owner's data" (presence information) if someone went by ten thousand specific homes and rang their doorbells to test if someone is home based on information they got from a third party? That's not what's the headline says, and that's not what TFA says. Someone "leaked" a list of valid credentials to Ring accounts. A better analogy would be if someone collected ten thousand keys they found around the city, tried them on every lock they came across, and then created a map showing which keys worked on which locks. And provided an infinitely-copyable keyring to go along with the map. Ring says they're not responsible for the data being out there, and that's probably true. But the data is out there, and that's a problem for the people on the list.

EncryptEntropy 7y ago

Thanks, so I didn’t have to read article. Really misleading title, I was thinking “...How do only 3k accounts leak...?”