5 ms·

'Smart' doorbells for sale on Amazon came stocked with security vulnerabilities

91 points by 0xmohit 6y ago

kyriakos 6y ago
How's being on amazon relevant?
- dariusj18 6y ago
  I think it indicates the reach of the product. The implication being that many more people are more likely to purchase the item if it is on Amazon rather than just being sold by a single retail site.
- ProAm 6y ago
  Because Amazon has a history of product quality and control problems.
  - ksk 6y ago
    How do other retailers compare? Are there any metrics?
- nkrisc 6y ago
  Because the researchers bought the products from Amazon.
strogonoff 6y ago
From the linked article[0], which the posted URL appears to be a blogspam regurgitation of: > After the seller of the Victure doorbell declined to give a refund, we took the case directly to Amazon, who agreed to fully refund the customer. That’s probably the most viable way: if enough people request refunds, Amazon will have to address the shady sellers. [0] https://www.which.co.uk/news/2020/11/the-smart-video-doorbells-letting-hackers-into-your-home/ https://www.which.co.uk/news/2020/11/the-smart-video-doorbel...
- CamelCaseName 6y ago
  NCX (Negative Customer Experience) is the metric in question here. Enough returns relative to other products in its category will first get the listing temporarily removed, and then permanently removed, if issues continue. You can read a bit more here if interested: https://sellercentral.amazon.ca/gp/help/external/RTPNYUAU5EQ9RGU https://sellercentral.amazon.ca/gp/help/external/RTPNYUAU5EQ...
- dang 6y ago
  Ok, we've changed to that from https://www.cyberscoop.com/smart-doorbells-amazon-ebay-ncc-vulnerabilities/ https://www.cyberscoop.com/smart-doorbells-amazon-ebay-ncc-v.... Thanks!
yters 6y ago
I also saw a very popular security camera product called Wyze that surreptitiously sends customer information to computers outside the US. https://www.amazon.com/gp/customer-reviews/R1GN9BTTWQZK3P/ref=cm_cr_dp_d_rvw_ttl?ie=UTF8&ASIN=B076H3SRXG https://www.amazon.com/gp/customer-reviews/R1GN9BTTWQZK3P/re... https://www.amazon.com/gp/customer-reviews/R2NX523G3R0CZ8/ref=cm_cr_dp_d_rvw_ttl?ie=UTF8&ASIN=B076H3SRXG https://www.amazon.com/gp/customer-reviews/R2NX523G3R0CZ8/re...
- milkytron 6y ago
  Since those reviews were posted, Wyze has actually enabled support for RTSP, which would address some of the issues those reviews mentioned. I haven't tested it out myself, but it seems to be working for a lot of people. I'm not sure if it still attempts to send data back to its own mothership though.
  - yters 6y ago
    How does RTSP solve the privacy problem of potentially sending user information to another country?
    - dylz 6y ago
      After initial sideloading of the new firmware (unsupported IIRC, you're on your own), you can grab the RTSP credentials and disconnect the camera entirely. It is usable as an offline IP camera after that. No cloud, just give it LAN access only. Before this there was no non-proprietary way to access.
  - kelnos 6y ago
    RTSP has nothing to do with privacy. It's just another way to schlep streaming media around the internet. They may have also stopped sending data back to their own servers, but that's completely orthogonal.
- wdb 6y ago
  How is that different from all the products that send customer information to the US?
moralsupply 6y ago
LockPickingLawyer has plenty of videos showing how pretty much everything that Amazon sells has security issues... https://www.youtube.com/channel/UCm9K6rby98W8JigLoZOh6FQ https://www.youtube.com/channel/UCm9K6rby98W8JigLoZOh6FQ
ec109685 6y ago
Not surprising. They can’t keep obviously fake product like this off their site: 1000GB USB 2.0 Flash Drive 1TB Metal Design - Silver USB Flash Drive 1000GB https://www.amazon.com/dp/B0859Z28C2/ref=cm_sw_r_cp_api_fabc_9teVFbYFGSXD2?_encoding=UTF8&psc=1 https://www.amazon.com/dp/B0859Z28C2/ref=cm_sw_r_cp_api_fabc... Despite alerting them, more fake product appears. Obviously 1TB for $29 isn’t a real product.

91 points by 0xmohit 6y ago

kyriakos 6y ago

How's being on amazon relevant?

dariusj18 6y ago
I think it indicates the reach of the product. The implication being that many more people are more likely to purchase the item if it is on Amazon rather than just being sold by a single retail site.
ProAm 6y ago
Because Amazon has a history of product quality and control problems.
- ksk 6y ago
  How do other retailers compare? Are there any metrics?
nkrisc 6y ago
Because the researchers bought the products from Amazon.

strogonoff 6y ago

From the linked article[0], which the posted URL appears to be a blogspam regurgitation of: > After the seller of the Victure doorbell declined to give a refund, we took the case directly to Amazon, who agreed to fully refund the customer. That’s probably the most viable way: if enough people request refunds, Amazon will have to address the shady sellers. [0] https://www.which.co.uk/news/2020/11/the-smart-video-doorbells-letting-hackers-into-your-home/ https://www.which.co.uk/news/2020/11/the-smart-video-doorbel...

CamelCaseName 6y ago
NCX (Negative Customer Experience) is the metric in question here. Enough returns relative to other products in its category will first get the listing temporarily removed, and then permanently removed, if issues continue. You can read a bit more here if interested: https://sellercentral.amazon.ca/gp/help/external/RTPNYUAU5EQ9RGU https://sellercentral.amazon.ca/gp/help/external/RTPNYUAU5EQ...
dang 6y ago
Ok, we've changed to that from https://www.cyberscoop.com/smart-doorbells-amazon-ebay-ncc-vulnerabilities/ https://www.cyberscoop.com/smart-doorbells-amazon-ebay-ncc-v.... Thanks!

yters 6y ago

I also saw a very popular security camera product called Wyze that surreptitiously sends customer information to computers outside the US. https://www.amazon.com/gp/customer-reviews/R1GN9BTTWQZK3P/ref=cm_cr_dp_d_rvw_ttl?ie=UTF8&ASIN=B076H3SRXG https://www.amazon.com/gp/customer-reviews/R1GN9BTTWQZK3P/re... https://www.amazon.com/gp/customer-reviews/R2NX523G3R0CZ8/ref=cm_cr_dp_d_rvw_ttl?ie=UTF8&ASIN=B076H3SRXG https://www.amazon.com/gp/customer-reviews/R2NX523G3R0CZ8/re...

milkytron 6y ago
Since those reviews were posted, Wyze has actually enabled support for RTSP, which would address some of the issues those reviews mentioned. I haven't tested it out myself, but it seems to be working for a lot of people. I'm not sure if it still attempts to send data back to its own mothership though.
- yters 6y ago
  How does RTSP solve the privacy problem of potentially sending user information to another country?
  - dylz 6y ago
    After initial sideloading of the new firmware (unsupported IIRC, you're on your own), you can grab the RTSP credentials and disconnect the camera entirely. It is usable as an offline IP camera after that. No cloud, just give it LAN access only. Before this there was no non-proprietary way to access.
- kelnos 6y ago
  RTSP has nothing to do with privacy. It's just another way to schlep streaming media around the internet. They may have also stopped sending data back to their own servers, but that's completely orthogonal.
wdb 6y ago
How is that different from all the products that send customer information to the US?

moralsupply 6y ago

LockPickingLawyer has plenty of videos showing how pretty much everything that Amazon sells has security issues... https://www.youtube.com/channel/UCm9K6rby98W8JigLoZOh6FQ https://www.youtube.com/channel/UCm9K6rby98W8JigLoZOh6FQ

ec109685 6y ago

Not surprising. They can’t keep obviously fake product like this off their site: 1000GB USB 2.0 Flash Drive 1TB Metal Design - Silver USB Flash Drive 1000GB https://www.amazon.com/dp/B0859Z28C2/ref=cm_sw_r_cp_api_fabc_9teVFbYFGSXD2?_encoding=UTF8&psc=1 https://www.amazon.com/dp/B0859Z28C2/ref=cm_sw_r_cp_api_fabc... Despite alerting them, more fake product appears. Obviously 1TB for $29 isn’t a real product.