3 ms·

I would not touch a Wyze camera with a 10 foot pole. Given the recent enormous security breaches, the likely connections to the Chinese government, and the incr

by 40four 7y ago

I would not touch a Wyze camera with a 10 foot pole. Given the recent enormous security breaches, the likely connections to the Chinese government, and the incredibly low price point, there are red flags waving everywhere. Read this blog series about Wyze, and then make up you mind if you are comfortable having that piece of hardware in your home. I think it is pretty clear the risks are not trivial. https://blog.12security.com/tag/wyze/ https://blog.12security.com/tag/wyze/

quit32 7y ago
Great write up. I agree I do not trust them very much and would not use them on a network that has internet access. They are a great cheap option when using their custom RTSP firmware with synology surveillance stations. I throw them on their own SSID that is isolated from other local networks and does not have internet access. The SS can reach into their network but they can't initiate connections out. Still they briefly need internet when setting up to enable RTSP but I'm more concerned about them being remotely accessible at anytime and having access to anything else on my network. Even my setup would allow my email and the isolated network's topo to leak bc of brief internet access.
- 40four 7y ago
  That’s interesting usage. I wasn’t aware of the Synology products, I’ll admit I’m not very knowledgeable about security systems. Sounds like you take proper precautions!
- runnerup 7y ago
  I don't think that was a great write up. I'm no panda-hugger but I was hoping for evidence/walk-through for the following claims made in the article, and I didn't find any direct evidence in the article. Did I not read it closely enough? (Pretty sure the claims are made without support) > Yi Camera is a front for the Chinese Ministry of State Security. Full stop. > Yi Cameras send all customer data to Xiaomi as I have previously claimed with Wyze.
  - 40four 7y ago
    To be fair, I updated the link to the the ‘tags’ page, since it includes the whole series, after @quit32 commented. They might have been referring to one of the first couple in the series , the link originally pointed to #1. Honestly I’m not familiar with the Yi cameras, I haven’t read that newest post, I’ll have to look into it. But, 12 Security is credited with disclosing the 2nd Wyze security breach in December 2019 (the 1st one not even a full calendar year before). Wyze reluctantly admitted the breach days later, but went into damage control mode, claiming the DB was only exposed for part of the month of December. 12 Security says otherwise, that it was exposed for the majority of the calendar year, and many parties across the globe accessed it according to logs. https://web.archive.org/web/20200306023236/https://www.nytimes.com/2019/12/30/business/wyze-security-camera-breach.html https://web.archive.org/web/20200306023236/https://www.nytim...
arcticfox 7y ago
> it is (or at least was) theoretically possible for any individual anywhere in the world to access the live video feeds of every single Wyze camera that was online Holy cow. And easy to do if you found their unsecured database.
TheAdamist 7y ago
Fair point, however with the webcam firmware it operates as a standard USB webcam, no drivers or software from wyze used, just the replacement firmware loaded via microsd. So the risks are mitigated for the most part since it has no network connection.

by 40four 7y ago

quit32 7y ago

Great write up. I agree I do not trust them very much and would not use them on a network that has internet access. They are a great cheap option when using their custom RTSP firmware with synology surveillance stations. I throw them on their own SSID that is isolated from other local networks and does not have internet access. The SS can reach into their network but they can't initiate connections out. Still they briefly need internet when setting up to enable RTSP but I'm more concerned about them being remotely accessible at anytime and having access to anything else on my network. Even my setup would allow my email and the isolated network's topo to leak bc of brief internet access.

40four 7y ago
That’s interesting usage. I wasn’t aware of the Synology products, I’ll admit I’m not very knowledgeable about security systems. Sounds like you take proper precautions!
runnerup 7y ago
I don't think that was a great write up. I'm no panda-hugger but I was hoping for evidence/walk-through for the following claims made in the article, and I didn't find any direct evidence in the article. Did I not read it closely enough? (Pretty sure the claims are made without support) > Yi Camera is a front for the Chinese Ministry of State Security. Full stop. > Yi Cameras send all customer data to Xiaomi as I have previously claimed with Wyze.
- 40four 7y ago
  To be fair, I updated the link to the the ‘tags’ page, since it includes the whole series, after @quit32 commented. They might have been referring to one of the first couple in the series , the link originally pointed to #1. Honestly I’m not familiar with the Yi cameras, I haven’t read that newest post, I’ll have to look into it. But, 12 Security is credited with disclosing the 2nd Wyze security breach in December 2019 (the 1st one not even a full calendar year before). Wyze reluctantly admitted the breach days later, but went into damage control mode, claiming the DB was only exposed for part of the month of December. 12 Security says otherwise, that it was exposed for the majority of the calendar year, and many parties across the globe accessed it according to logs. https://web.archive.org/web/20200306023236/https://www.nytimes.com/2019/12/30/business/wyze-security-camera-breach.html https://web.archive.org/web/20200306023236/https://www.nytim...

arcticfox 7y ago

> it is (or at least was) theoretically possible for any individual anywhere in the world to access the live video feeds of every single Wyze camera that was online Holy cow. And easy to do if you found their unsecured database.

TheAdamist 7y ago

Fair point, however with the webcam firmware it operates as a standard USB webcam, no drivers or software from wyze used, just the replacement firmware loaded via microsd. So the risks are mitigated for the most part since it has no network connection.