3 ms·
If we read the same article, we’d have been agreeing that it said it was unlikely to be credential stuffing. > Security experts told BuzzFeed News that the for
by orhmeh09 7y ago
If we read the same article, we’d have been agreeing that it said it was unlikely to be credential stuffing.
> Security experts told BuzzFeed News that the format of the leaked data — which includes username, password, camera name, and time zone in a standardized format — suggests it was taken from a company database. They said data obtained via credential stuffing —when previously-compromised emails and passwords are used to get access to other accounts — would likely not display RIng-specific data like camera names or time zone.
> “One could argue that the person maybe got these through credential stuffing,” Cooper Quintin, a security researcher and senior staff technologist at the Electronic Frontier Foundation, told BuzzFeed News. “But if that was the case, why did that person go through and add the information about names of camera and time zones?”
- qw3rty01 7y agoAll of that information is extremely common when it comes to aggregated information sold/shared for credential stuffing, there's nothing that sticks out as odd or out of place in any of this. It can all be pulled through scripts, there's no extra effort needed.
- strictnein 7y agoThis is a credential stuffing attack. Why did they add it? Why not? I'm betting when they logged in that info came back as part of the API call.
- HenriNext 7y ago> Why did they add it? If they were going to sell the information, and the credentials really allowed to remotely access the cameras, then accessing 'camera=BEDROOM' at 11PM Friday local time may provide more entertainment value than 'camera=GARAGE'? :)