10 ms·
Ring LLC home security company ransomed by ALPHV ransomware
- sourcecodeplz 4y agoThis should be interesting. Also, thanks for not making me visit twitter. Edit: because twitter doesn't load on this particular device I use for HN. Basically the browser is too old. There is no "hate" ... ffs
- StevigeHoning 4y ago[flagged]
- codetrotter 4y agoBecause often when you click on a link that goes to Twitter and start reading a thread they will pester you to make an account and won’t let you read the whole thread if you don’t. Also, Elon Musk.
- logicallee 4y agoFor what it's worth, this behavior has always bothered me hugely (can't read a thread without registering), but disappeared shortly after the last point you cite. Now there is just a nag notification similar to a cookie acceptance bar, you can dismiss it and read the whole thread without interruption: https://twitter.com/vxunderground/status/1635427567271329792 https://twitter.com/vxunderground/status/1635427567271329792 Let me know if it works for you now. (I have no affiliation to Twitter, just curious.)
- codetrotter 4y agoThanks, that’s a nice change then :)
- ikt 4y agothere's also a billion times where i've clicked on a twitter link which is a useless summary and a link to the actual article
- CatWChainsaw 4y agoI manage to avoid that by using uMatrix to block scripts, and it's not even supported anymore.
- z3c0 4y agoSpeaking for myself here, but: > It's a frustrating read past X amount of characters, promoting low-quality takes, or alternatively, a segmented mess of an essay > Low-quality discourse that usually only muddies the subject > JavaScript
- pengaru 4y ago[flagged]
- cbeach 4y agoTwitter used to be controlled by the blue tribe. Now it’s been bought by a (perceived) member of the red tribe. It’s a simple as that. People feel the need to signal their tribal affiliation and attack those from other tribes. Been part of human behaviour since humans began.
- op00to 4y agoNo.
- IntelMiner 4y ago[flagged]
- harvey9 4y agoNon partisan reasons to dislike Twitter as a tool of communication were posted before you made this comment. Anyway, your experience of any social media depends on how you curate it. For example I only follow professional photographers on Instagram so that's the only kind of content I see there.
- ashwagary 4y ago>Anyway, your experience of any social media depends on how you curate it. That's not entirely true anymore. Many users of Twitter have recently mentioned the alarming number of violent videos being added to their "For You" suggestions. These users are largely self-siloed into the industry they operate in and self-describe as people that dont follow "fight video" accounts or people that consume that content. It seems either the suggestion algo has been broken, is being gamed by users, or the platform owners are choosing to feed users toxic content that they didnt request for some reason.
- chaxor 4y agoOn a tech forum one would expect the reasons to be more centered upon tech rather than (what I think you're referring to anyway) politics. Twitter sucks because it's full of JavaScript and tracking that you don't need, so I would imagine that most on HN would find it burdensome to even view the content, since many in tech whittle the content down to only getting the packets necessary - which Twitter/Facebook make very difficult. Nitter has a much better user interface and makes it much easier to see what is happening on your device. Other than that, the content is mostly just low quality as well, so there's little reason to use it.
- eps 4y agoYou are getting downvoted for "lol".
- BLKNSLVR 4y agoBecause it very quickly became difficult to read a narrative without losing ones way into... I don't even know, unrelated pointlessness that has no right to exist. It's a gateway to somewhere I've never had any desire to visit: other people's drama.
- jeroenhd 4y agoIf Twitter doesn't work (well), I recommend nitter.net (or other instances of Nitter, it's open source software). Addons are available for various browsers to automatically redirect. Nitter is meant as a privacy-friendly Twitter front-end, but I mainly use it because Twitter takes literal seconds to load a 280 character post and Nitter works almost instantly. As an added bonus, it doesn't rely on Javascript to render. For example: https://nitter.net/vxunderground/status/1635427567271329792 https://nitter.net/vxunderground/status/1635427567271329792
- sourcecodeplz 4y agoThank you men. I knew about it. But it didn't always work..
- bilekas 4y agoThis was always going to happen.. you can't have that much access to sensitive data and expect to be prepared for stuff like this. It's going to be really bad for customers but it's okay. I'm sure we'll get the "We value privacy" compulsory email any day now.
- rftyuikdjhgvcf 4y agoI'm just shocked it happened before all rings become zombies on some botnet. maybe we are just missing the news.
- incahoots 4y agoI'm genuinely surprised we haven't had something like that happen....yet. All these "smart" appliances, fridges, & stoves gotta have the same vulnerability just waiting to make them bots. Considering they're all running some old Android instance.
- mrguyorama 4y agoIt has happened. Lots of these devices ARE on botnets. I think it was cloudflare who claimed a significant amount of DDoS traffic comes from hacked IOT devices
- rftyuikdjhgvcf 4y agomidori. it was mostly modems. haven't heard about the security cameras yet.
- bretpiatt 4y agoInfo on ALPHV https://www.cyber.gov.au/acsc/view-all-content/advisories/2022-004-acsc-ransomware-profile-alphv-aka-blackcat https://www.cyber.gov.au/acsc/view-all-content/advisories/20... May not be Ring directly, could be in 3rd party supplier with an undetermined level of data access https://twitter.com/TheRegister/status/1635506291232894976 https://twitter.com/TheRegister/status/1635506291232894976
- deleted 4y ago[deleted]
- z3c0 4y agoI wonder what kind of data they had access to. It's usually much easier to reach AND dump, say, an invoicing system, than what I can only imagine is an extremely large set of user data. Either way, bad look for a company that pitches itself as a home security company. "Hey, we said your home would be secure, not our architecture."
- yftsui 4y agoTitle should be fixed as “ALPHV ransonware Claims hack of Ring”, there is no proof besides the claim picture on their own website.
- josephg 4y agoI've said it before and I'll say it again: - Companies should suffer massive fines / damages / criminal charges when they leak the personal data of millions of customers. - I think EULAs are a ridiculous run-around the law. They should be non-enforceable. Its far from perfect, but case law is pretty clear that people and companies are liable for damages due to foreseeable harm that they cause. (Except EULAs dodge this.) (I am not a lawyer, this is not legal advice.) Software engineers & security engineers can make just about anything secure. But we can only do so if we're given time and money to hire the expertise when needed. We need to make it incredibly expensive for companies to lose personal data like this. Management teams should be clamoring to hire the best security engineers. But they'll only do so if they're sufficiently motivated. The risk of massive liability is the right incentive to convince companies to invest in getting information security right. The current status quo is ridiculous.
- echelon 4y ago> I've said it before and I'll say it again Don't tell us, tell your legislators. Ideally with some kind of narrative that ties to a financial incentive for the lawmaker and his or her constituents. If the security industry got together and lobbied for this as both a jobs program (security companies offering services to tech companies) and as a means of protecting Americans/constituents, then it might get somewhere.
- InCityDreams 4y ago>Ideally with some kind of narrative that ties to a financial incentive for the lawmaker and his or her constituents. Absofuckinglutely. Never talk to a politician without remembering that if they don't get a cut...
- JumpCrisscross 4y ago> never talk to a politician without remembering that if they don't get a cut Most voters don't care about digital security. That means most politicians, reasonably, don't care either. Most voters do care about their economies. So linking what you're talking about to talking points the political can use is helpful. Not because they're going to get a cut.
- Moksha108 4y agoMoney in almost all banks is guaranteed and secure. Personal data held by almost all companies is not secure or guarantees per UALA.
- villgax 4y agoGood riddance
- hoseja 4y agoCouldn't happen to a nicer bunch of panopticon-peddlers.
- topicseed 4y agoIs there any proof of these claims, has Ring confirmed this?
- tyingq 4y agoThere's a little more info on Vice, noting the situation was posted on an internal Amazon Slack channel with a "don't discuss" instruction. https://www.vice.com/en/article/qjvd9q/ransomware-group-claims-hack-of-amazons-ring https://www.vice.com/en/article/qjvd9q/ransomware-group-clai...
- lynx23 4y agoLeaking user data isn't really penalized enough. First two incidents, high monetary penalty, third incident, company is closed permanently in the interest of public security.
- InCityDreams 4y ago>company is closed permanently in the interest of public security. So there goes a janitors job, secretaries etc. Local cafes, bars, transport lose out. The dependents of all the company are now involved. There's a long chain of consequences after this. Why not just target the guilty: maybe any punishment should make them suffer.
- lynx23 4y agoWell, I'd argue if the first two high penalties did not have an effect, the company is likely rotten from within and can not really be fixed, so close it. Also, I find your "but you have to think about the children^WJobs" argument pretty hollow. Nothing can be changed, because some gay lesbian from a foreign country might loose their already precarious job. Come on, is this really an argument for something?
- deleted 4y ago[deleted]
- quantified 4y agoThat makes all of them vested in the outcome that that company was actually good in its security of sensitive information. If they are important to anyone actually involved in the company, the company will take care of things properly. The same argument is made for why breadwinners shouldn't get jail time when they commit a felony.
- caskstrength 4y ago> So there goes a janitors job, secretaries etc. Local cafes, bars, transport lose out. The dependents of all the company are now involved. There's a long chain of consequences after this. Why not just target the guilty: maybe any punishment should make them suffer. I agree. It would be better to make execs personally criminally liable.
- mtlmtlmtlmtl 4y agoIs this the same Ring that was giving away video to the police with no warrant? Seems more like a home insecurity company to me. And why is it an LLC?
- op00to 4y agoThe same reason everyone uses LLC. To limit the liability of their endeavor.
- mtlmtlmtlmtl 4y agoThanks for the non-answer. I know what an LLC is. But I would pretty inclined to distrust a "security" company that has "Limited Liability" in their name when they store a lot private data serverside. Doesn't exactly inspire confidence in their commitment to actual security and not merely convenient insecurity which seems to be their actual product. Hence the question.
- tyingq 4y agoNot sure what you're saying here. Are you saying it would be better if they were a c-corp, or a sole proprietorship, or something else?
- bsenftner 4y agoThey're weakly hiding their Amazon parent.
- mtlmtlmtlmtl 4y agoHah, didn't realise they were owned by Amazon. I guess I shouldn't be surprised that a company with such a terrible ethical track record is a part of the fractal of dark patters that is Amazon.
- ra120271 4y agoMy personal trust of devices like this is low - and since it is capturing public side recordings (outside my front door) I'm less worried about the vidoes. I just prefer to treat them as untrusted devices and put them on my guest network isolated from the rest of my network.
- mtlmtlmtlmtl 4y agoApparently quite a few people have Ring cameras inside their homes as well. And another point. You might not think video outside your home matters, but it could be invaluable to burglars who want to know when you're not home. I could imagine it being used to deanonymize location data as well because it would provide known locations and timestamps to filter data against.
- _justinfunk 4y agoYou think he's so stupid he goes out his own front door? /butchered sg-1 reference
- zht 4y agoI guess? They can also just park on the street and watch you…
- mtlmtlmtlmtl 4y agoYes, but doing that is much more risky and time consuming. The burglar could find the basic pattern in a matter of hours rather than days of sitting on the house at the risk of being reported as suspicious. They would also be able to tell which entrances are surveilled and use that information for the burglary itself. So you could make an argument that woth their terrible security track record, numerous leaks etc Ring is more of a help to potential burglars than it is useful as a security device.
- sofixa 4y ago> since it is capturing public side recordings (outside my front door) I'm less worried about the vidoes Differences between countries are funny. For instance, in France Rings don't fly because you're filming a public place, and by default people have an expectation of privacy and the right not to be filmed. If you want to film a public place (like put a camera that covers the street), there's a specific process to follow that includes getting a permission from the privacy authority, putting up warnings, and having processes (who has access to the videos, when, why, etc.).
- FollowingTheDao 4y agoAnother good reason not to use (Ring is a police state apparatus).
- AndrewTerry 4y agothis is interesting. I had an alert from an ID monitoring service I subscribe to today advising of a “mid severity breach” for an undisclosed service. The details leaked were my name, email address, and town of residence. The notification says the service is undisclosed as the provider is still working with law enforcement. I wonder if this it.
- m4jor 4y agoRaw link to the ALPHV page: http://alphvmmm27o3abo3r2mlmjrpdmzle3rykajqc5xsj7j7ejksbpsa36ad.onion/528b08dd-bd0b-4d63-b9ef-eff3a5543b77 http://alphvmmm27o3abo3r2mlmjrpdmzle3rykajqc5xsj7j7ejksbpsa3... Will be interesting to see what happens.
- T3RMINATED 4y ago[dead]
- jimnotgym 4y agoRing sounds like such a neat idea. I'm in bed and I heard a noise at the front door...I open the app...start live view...black screen Really? Is it that hard? The extension ringer is a great idea too. Place it wherever you will hear it...ding-dong...there was someone at your door about 20-30 seconds ago. Seriously! A doorbell with a camera, the camera won't connect, the bell won't ring
- kevincrane 4y agoDo you think the camera didn’t work because the parent company got ransomwared? Or is this anecdote related to the posted story in a different way that I’m missing
- Vrondi 4y agoI have a wifi webcam with no Internet access at my front door. It doesn't need Internet access (in fact, it's blocked from going outside the router). It's happily streaming video onto my home network. I just open the stream in VLC on any device to see the live video feed instantly. Easy to make a shortcut that opens the address in VLC. Video is also being archived locally elsewhere on my home network, but no outside hosting is needed for either instant live access or home archiving. Just a minimum of research. When shopping for a camera, only buy one that has ONVIF compatability. Then you can use it with third party apps.
- stuckkeys 4y agoWhich one/s you got? I got the eUfy and the only reason I went for it is because of the built in battery. Curious to know what product you are using.
- vorpalhex 4y agoEven my beloved Ubiquiti's doorbell cam suffers in much the same ways (and my nest had it too). There must be some difficulty here that is non-obvious for all the competitors to be falling into the same flaws.
- 4y ago
- zenexer 4y agoOriginal Tweet rather than an archived version: https://twitter.com/vxunderground/status/1635427567271329792 https://twitter.com/vxunderground/status/1635427567271329792 There’s since been an important follow-up tweet: > Ring denies being a victim of ALPHV. Ring has stated to various media outlets they believe a 3rd party vendor has suffered a data breach. And a relevant reply: > I mean, file under MRDA, but Ring told me earlier today that "We currently have no indications that Ring has experienced a ransomware event."
- Forestessential 4y agoi dont see any ransoming.
- lolinder 4y agoWe should change the URL to point to the Vice article instead. This is a tweet of a screenshot of the hacker's home page, and while we have no specific reason to disbelieve them, we also have no reason to believe they're telling the whole truth. The Vice story has more context: Ring denies any compromise to their own systems (and if you can't find the ransomware it's not doing its job very well), but there is a third party vendor with no access to customer data who is currently affected. https://www.vice.com/en/article/qjvd9q/ransomware-group-claims-hack-of-amazons-ring https://www.vice.com/en/article/qjvd9q/ransomware-group-clai...
- aaron695 4y ago[dead]
- _tom_ 4y ago"Ransomed" means they paid the ransom, not they demanded it.