11 ms·
Wyze security incident update
- EVa5I7bHFq9mnYK 3y ago3rd party libraries are a serious security problem that nobody wants to talk about, because there is no easy solution. I once lost $300k to a hack related to that issue.
- KryptoKnight 3y agoThis company non stop spams me, might just have to ditch the cam. I have grown used to throwing away hardware due to infinite fees, self bricking, or hacked out of the box. Consumer electronics have taken a painful dive in quality control. And hey Wyze unsubscribe me already !!!
- mahbran10 3y ago[dead]
- Amehle 3y ago[flagged]
- twisteriffic 3y ago> The incident was caused by a third-party caching client library that was recently integrated into our system. This client library received unprecedented load conditions caused by devices coming back online all at once. As a result of increased demand, it mixed up device ID and user ID mapping and connected some data to incorrect accounts. That seems like enough of a line of bullshit to steer me away from ever using wyze.
- hn_20591249 3y agoYeah I would very much likely to know what caching library has a failure mode of returning content for the wrong keys, that seems pretty bad if not a highly suspect explanation
- pylua 3y agoDevice id and user ids are non unique?
- mistrial9 3y agohash collisions?
- avg_dev 3y agoThis sounds like a pretty decent guess to me. I bet you are right.
- NathanKP 3y agoI'd bet it's this, plus something even stupider like hashing a connection timestamp millisecond as the "uniqueness" of the hash. I've seen a lot of terrible code implementations that assume that there will never be two clients connecting in the exact same millisecond
- tgsovlerkhgsel 3y agoDo you think the issue was something else? "People randomly see other people's content" is an issue that would immediately make me think some issue with caching is the culprit. Given their openness in the rest of the communications, I don't see why they would make this part up. Edit: Of course, I'm also curious what the actual bug was. A discussion below is suggesting several plausible ways (e.g. concurrency issues, insufficient entropy in some key) how a problem could happen under load (although many of these would also lead to the problem happening with less load, just much less often).
- 15457345234 3y ago> I'm also curious what the actual bug was Hardware. Rowhammer-type effects occurring accidentally under sudden load spikes. The hardware has just got too dense. (I should clarify this is speculation, but reading the recent article included here on sudo using special maximum-distance bitfields to hold state internally (https://news.ycombinator.com/item?id=39165342 https://news.ycombinator.com/item?id=39165342)... it must be a problem that's being observed in the wild)
- tgsovlerkhgsel 3y agoI can't imagine that happening with a sufficient frequency. A system making such mistakes so often would just be too unstable to keep an uptime >1h.
- 15457345234 3y agoWith the 'cattle not pets' mindset that pervades modern development is the lifespan of ephemeral cache VMs that closely monitored? They get spun up and down on demand in most architectures. I can see this being an edge case failure when the system is trying to scale up, the existing VMs are getting absolutely hammered, the hypervisor is trying to start up new ones, memory pressure and iops on the existing ones are maxed out... It just seems like the most obvious root cause to me, a single bit-flip in a hashed value is going to give you the wrong result data without any other error because the hash value is already essentially heavily compressed, meanwhile the hash table is almost certain to be 100% stored in memory and very heavily accessed from multiple directions in a read/write manner.
- Twirrim 3y agoHow so? I've seen caching clients exhibit some really weird behaviour under heavy load. It's not beyond the pale that, eg, the caching library doesn't do proper locking before writing, resulting in writes stomping all over each other. Caching is normally read heavy, not write heavy, so it's plausible it wouldn't be something you'd see much under typical operation. After an outage, they'd be dealing with a thundering herd level of traffic as everything tries to reconnect, that'd be very different from normal write loads, even different than the write load they'd have seen when they first enabled caching.
- darkwater 3y agoYes but either the library is seriously bugged (like, expecting writes to be ordered and screwing up things if it gets too many writes for different objects at the same time) or there was some serious bug in their implementation. Anyway the attitude and the message passed in the communication seems like handwashing to me. I might be too cynic, though.
- jabart 3y agoHow else would you say a 3rd party library had a bug under heavy load? 1. You don't want a defamation lawsuit your way. 2. If it was vendor code, you have a contract that may be under a NDA. 3. If it was a vendor, lawyers, lots and lots of lawyers, they likely had to say the minimal amount. The fact they sent out communications for each type of incident in such a short time was great.
- yjftsjthsd-h 3y agoThe problem is how much they're pointing fingers at the library in the first place.
- dns_snek 3y agoI might be splitting hairs, but they say that the incident was "caused by a third party library" when in fact, the incident was caused by insufficient testing on their part. It sounds like they're trying to shift blame for the incident but then they try to pat themselves on the back for all the effort they put into security. It comes across as dishonest. Technical details are appreciated but they should've emphasized that this is their own fault. Bonus points if they commit to at least consider E2EE which would sidestep the issue.
- sigden 3y ago[dead]
- deleted 3y ago[deleted]
- SigmundA 3y agoI would at least want to know the client library so I can never use it for anything. Also never trust the client and I hope they don't mean the actual client app such that it can access other user id without server validation...
- woodrowbarlow 3y agosounds like a hashing function with insufficient entropy. "increased demand" would lead to a higher likelihood of hash collisions.
- beala 3y agoNot sure I follow. Hash functions don't require entropy, and a hash collision in a hash map shouldn't cause incorrect data to be returned (it just makes them less efficient).
- RandomRandy 3y agoI think that they are saying that the output space, i.e. the list of all possible hashes, is too small. Thus, IDs 1234 and 5678 lead to the same hash. The collision is not in the insertion into the hash map but rather in the look up.
- achille 3y agoSame thing happened to OpenAI. Will you steer clear of OpenAI forever as well? https://news.ycombinator.com/item?id=35294082 https://news.ycombinator.com/item?id=35294082
- twisteriffic 3y ago... Yes?
- wutwutwat 3y agoThere are only two hard things in Computer Science: cache invalidation and naming things. -- Phil Karlton
- pkaeding 3y agoAnd off-by-one errors
- lightspot21 3y ago...and off-by-one errors!
- t0mas88 3y agoThe whole thing points at everyone but themselves... "Originated at AWS" then "caused by a caching library" Very little ownership on Wyze's side.
- hamburglar 3y agoCoincidentally, I just cancelled my wyze service because the product and support are so terrible. I wanted a simple way to see if there was a package on my doorstep but instead I got something that alerts me when any dog, person, or vehicle goes down my street, and all I’ve gotten from support is robotic responses suggesting I update my firmware and ignoring my direct questions, running out the clock on my ability to return the thing. At this point I’m not surprised their engineering is bad and amused that it’s caused two different security incidents.
- belter 3y agoSounds like its redis-py again...
- jasongill 3y ago> We’ve identified your Wyze account as one that was affected. This means that thumbnails from your Events were visible in another Wyze user’s account and that a thumbnail was tapped. Most taps enlarged the thumbnail, but in some cases it could have caused an Event Video to be viewed. Kudos to Wyze for doing the things noted in the thread like being honest and prompt with notification etc, but "thumbnails from your Events were visible... and that thumbnail was tapped" is a pretty mealy-mouthed way to say "another person saw your private pictures and videos taken with your Wyze cameras"
- KryptoKnight 3y agoSo 30 min of me sitting on my ass are on the web. Ok… enjoy viewers.
- tripdout 3y agoWell obviously, and I think people can figure that out. I actually appreciate the more specific details on how the private pictures and videos were actually viewed using terminology from the Wyze app.
- thekevan 3y ago"like being honest and prompt with notification etc," On the Wyze subreddit, people have been griping about the fact that it took them days to even acknowledge something happened. When I read the Wyze email about it, there was no new info in it, it had pretty much all already been discussed online.
- sneak 3y agoNobody should ever be surprised that sending video to someone else’s computer (ie “the cloud”) results in third parties viewing that video.
- 1letterunixname 3y agoOr buying cheap, no-brand or upstart brand cameras with cloud capabilities. I had a heck of a time finding a proper POE recording DVR camera system for my mom's house without online or cloud bullshit, but still I isolated it on the network to not take any chances of UPnP port opening or dial-home crap. The only system I would trust would be one that laid out their security model, source to their apps, and had a self-hosted server DVR option. The captological signals of 99.9% of security system websites do not instill confidence in my mind.
- imglorp 3y agoGot any brand/model recommendations? I also want to run full local.
- sponaugle 3y agoI have 30 POE IP cameras connected to BlueIris (Running on a server). It records based on activity, and is entirely local (including being on a dedicated VLAN). The cameras are a wide variety of IP POE cameras which is helpful as I am not stuck to a single brand.
- LeafItAlone 3y agoIt’s 2024. Everything is connected to the internet. Dropbox, Google, and Apple all offer multiple terabyte level plans. The default today is to store in the cloud. We are all storing data in someone else’s computer. Instead of blaming the users, we must hold the companies responsible. Data privacy laws must be stricter and these incidents must be taken more seriously.
- jasonjayr 3y ago
- psanford 3y agoThere's a bunch of things in here that don't really make sense: > The incident was caused by a third-party caching client library that was recently integrated into our system. This client library received unprecedented load conditions caused by devices coming back online all at once. As a result of increased demand, it mixed up device ID and user ID mapping and connected some data to incorrect accounts. What? How does load on the system affect correctness? > The outage originated from our partner AWS What does this mean? Was there an AWS outage for a service they use, or was this just a normal loss of an instance? It's interesting that they blame external entities for the root causes of the incident and don't take responsibility for what is ultimately on them.
- 0x0 3y ago> What? How does load on the system affect correctness? Seen this happen quite often with code that is not multi-thread safe, especially in languages like c# and java, such as using a static class property for data that should be request-scoped, or not using the appropriate concurrent collection classes etc.
- skipkey 3y agoIt’s just a WAG, but I bet someone used a timestamp as a unique key, or at least part of one, so you were unlikely to get collisions except under load.
- CodesInChaos 3y agoI assume the code was always incorrect, but only exhibits the problem in practice under high load. This could be a race-condition/data-race, or treating short hashes as unique.
- jabiko 3y agoI would have liked them going more into the details of the caching issue. It sounds like they think the cache library was responsible for the issue, but a more technical analysis of what exactly went wrong within that library would be great.
- tgsovlerkhgsel 3y agoThis is one of the reasons why you want end-to-end encryption wherever possible. Even a bad implementation with cloud-synced encryption keys (which defeats most of the benefits of e2e) would have stopped this. The response in this case (notifying customers and specifically stating whether they were affected or not) is excellent, but this seems to be a repeat of a previous incident from September 2023: https://www.theverge.com/2023/9/8/23865255/wyze-security-camera-feeds-web-view-issue https://www.theverge.com/2023/9/8/23865255/wyze-security-cam...
- avg_dev 3y agoWow. That is decidedly not a good trend. Once is definitely bad enough, but twice…
- dns_snek 3y agoThere was another, different incident reported in 2022 spanning 3 years, and a data breach in 2019. https://www.consumerreports.org/home-garden/home-security-cameras/wyze-didnt-completely-fix-security-camera-flaws-for-3-years-a3726294358/ https://www.consumerreports.org/home-garden/home-security-ca...
- ls65536 3y agoI wonder how many people would continue to so casually use these services if they understood that, for the most part, there is rarely proper end-to-end encryption of their data with these services. It is awfully disingenuous when these companies' marketing materials describe their services as "encrypted" when it usually just means there are two independent TLS pipes, which both terminate in their "cloud"; this surely gives a false sense of security to end-users who may not understand the implications of such a setup.
- dns_snek 3y agoToo many. I've consulted with friends who installed "smart" security cameras and other IoT devices. I really spelled it out, saying that there's a very real possibility that one day they'll find out someone's been listening in on all of their private conversations (audio) or watching them through their own cameras. Responses typically range from "I'm not that interesting" to "I really don't care". I think it's too abstract of a threat for most people to take seriously before it happens to them.
- syntaxing 3y agoThis is one of the things Apple does right. HomeKit working local is a pretty great setup and just works. I put my HomeKit cameras on a VLAN without internet and device isolation and they still work seamlessly. The hard part is getting cameras that are wireless. I use scrypted but even then, getting ONVIF or RTSP isn’t as straight forward nowadays. I also have a local frigate backup which works great too. You can pipe in the detection to scrypted with MQTT.
- radredgreen 3y ago[dead]
- iAMkenough 3y agoI'm looking forward to the day HomeKit supports 2K and/or 4K video recordings.
- syntaxing 3y agoScrypted does this. I actually have no clue how it works but you get 2K streaming and recording.
- t8sr 3y agoA little off topic, but how is it possible that a tech startup named itself “Wyze” and didn’t get sued by Google over the “Waze” trademark? In some accents it sounds exactly the same, and they’re sort of in an adjacent product space.
- sqlacid 3y agoAm I the only one that saw Wyze and thought Wyse? Guess I'm old.
- t8sr 3y agoRight, that’s another one. I get that the trademark space is pretty dense, but still - trademarks exist to stop consumers getting confused, and this naming really is confusing? Waze could come out with a line of dash cams, and then you'd have Waze cams and Wyze cams.
- vel0city 3y agoTrademarks are about confusing names in a similar product market. Just having a similar-ish sounding name doesn't mean it violates the trademark. Self-driving cars are pretty different market to home security cameras.
- t8sr 3y agoYou're thinking of Waymo :) Waze is a crowdsourced traffic & maps thing. It's vaguely, if you squint, adjacent. I don't think it would be completely crazy, for example, for Waze to introduce a line of dash cams.
- firefalcon222 3y agoNot my project but I have had great success with https://github.com/gtxaspec/wz_mini_hacks https://github.com/gtxaspec/wz_mini_hacks & V3 model. The V3 models need to be downgraded to a specific firmware first and patching it exposes RSTP streams using https://github.com/AlexxIT/go2rtc https://github.com/AlexxIT/go2rtc. Everything doable without ever installing Wyze app on an environment air gapped environment with no internet.
- kevinsync 3y agoI'm having great success with half a dozen v3's in tandem -- for $30 a camera, the quality is really unbeatable -- setup / notes below. 1. all cameras (firmware v4.36.9.139) have 64gb+ micro SD cards and record to local storage -- many people seem to have issues with anything greater than 32gb in v3's but I've found that this Verbatim tool [0] formats FAT32 at high capacity with no problems 2. all cameras have wz_mini_hacks [1] on the SD card with RTSP enabled 3. all cameras are connected via ethernet instead of wifi using this adapter [2] and wz_mini_hacks config 4. network blocks all outgoing internet connections for all cameras to keep them LAN-only -- this means I have to connect to VPN to review video when outside the house, but I'm cool with that 5. all RTSP streams are also recorded over the network via Agent DVR [3] to a NAS 6. the Wyze app (free tier, not paid) works normally with all of the above in place -- I find it much more intuitive to review recent videos in-app (streamed off the SD card), and then review the very occasional older video from a computer off the NAS (scrubbing through in VLC on a computer) For what it's worth, I don't use them like a Ring camera where you're responding to realtime video events / talking through the camera to a delivery person -- this is mostly just for 24/7 recording. I have all object/motion detection events turned off, just a straight uninterrupted feed recording local and on the network. Links: 0. https://www.verbatim.com/index/search.php?words=fat32+tool https://www.verbatim.com/index/search.php?words=fat32+tool 1. https://github.com/gtxaspec/wz_mini_hacks https://github.com/gtxaspec/wz_mini_hacks 2. https://www.amazon.com/dp/B07M5X9795 https://www.amazon.com/dp/B07M5X9795 3. https://www.ispyconnect.com/docs/agent/about https://www.ispyconnect.com/docs/agent/about
- kevinsync 3y agoSomething else I forgot to mention -- when you add the cameras to your network, give them a static DHCP lease by MAC address in your router (separate ones, for both wifi and ethernet if applicable) If you don't and IP addresses cycle, your RTSP stream URLs will change and your recording software will just consider the camera disconnected. The Wyze app sometimes will get confused too (with ethernet in particular, if IP addresses change), and rebooting the cameras sometimes means physically cycling power if you don't know where it's at in your network. Better to just reserve a specific IP up front, write it down, and never think about it again. I also use a lot of these types of crappy smart plugs [0] throughout the house (as well as starting to replace some with actual wifi outlets [1] for aesthetics) and it's actually really useful to be able to force a power cycle on certain things from my phone. Links: 0. https://www.amazon.com/gp/product/B09LXGHR5X https://www.amazon.com/gp/product/B09LXGHR5X 1. https://www.amazon.com/KP200-Outlet-Required-Control-Certified/dp/B07N3CK3MM https://www.amazon.com/KP200-Outlet-Required-Control-Certifi...
- uconnectlol 3y agoconnected cameras have been easily hackable circa 2001 and this isnt changing any time soon especially not with node.js smartcrap
- notatoad 3y ago“Don’t use Wyze” seems like the wrong takeaway from this. I’d go with “don’t put internet-connected cameras in your house if you don’t want those images on the internet”. I’ve got a Wyze in my garage looking over my mountain bikes, and for $35 I don’t really care if somebody else sees that image. But I’d never put one in my living space, regardless of their security track record.
- prmoustache 3y agoWhat is the point of filming your mountain bikes? Do you watch them from your office with fondness of your most recent ride? Will that prevent them from being stolen? I doubt so.
- sponaugle 3y agoThe primary use case for a camera watching something that might get stolen is to provide proof of theft for insurance. In some cases it can provide clear evidence of what exactly was stolen, and in some cases information about who stole it. Unless the camera has lasers, it isn't very good at stopping said theft. ;)
- prmoustache 3y agoWhy would your insurance require a proof of the theft? That is not how insurances work usually.
- chrisco255 3y agoYeah all they require is a police report.
- lopkeny12ko 3y agoOf course you need to provide proof of theft. I can't simply go to my insurance, file a claim for a high-value item, and expect them to not ask any more questions. This would be rife with fraud (read: not a reasonable business model) otherwise.
- creativeSlumber 3y ago>The outage originated from our partner AWS and took down Wyze devices for several hours early Friday morning. ... As we worked to bring cameras back online, we experienced a security issue. Some users reported seeing the wrong thumbnails and Event Videos in their Events tab. ... The incident was caused by a third-party caching client library that was recently integrated into our system. This client library received unprecedented load conditions caused by devices coming back online all at once. As a result of increased demand, it mixed up device ID and user ID mapping and connected some data to incorrect accounts. As an software engineer who's dealt with caches for large high throughput services, this does not make sense to me why they are blaming a caching client. It's your own code that will decide what is the cache key, and what value to pass as the cache key. Did the caching library have a bug where when you ask for a given key, it returned results for a different key? Or more likely did your own code have a bug where you mixed up the keys? I think we need more details on what went wrong in here.
- darknavi 3y agoThis is the sort of thing that makes me salty that Unifi Protect is basically cloud locked in. No direct IP connection with "local" account support on the mobile app.
- wredue 3y agoI recall seeing setting that this cloud access can be disabled, and you could just VPN to get your “local” only access back.
- zzyzxd 3y agodirect IP connection is coming: https://community.ui.com/questions/Unifi-Protect-Mobile-access-through-VPN/78a8c684-dfdf-4a9d-aa90-3c7a675fc8b3#answer/1a9da91c-48b1-4970-8b51-635a53fd7193 https://community.ui.com/questions/Unifi-Protect-Mobile-acce... but even with this, it's still an security camera app that can't send push notification without cloud access.
- matrix_overload 3y agoWyze cameras can actually be used very securely, as long as you bother to jump through some hoops. First of all, google "Wyze RTSP firmware". It's the official firmware from the vendor that enables the RTSP protocol. Now you can enable RTSP via the app and give the camera a fixed IP address in your DHCP server. RTSP is a pretty standard protocol, so you can now view the feed via VNC player, record it 24/7 via ffmpeg, use tools like motion, etc. The camera will still try to connect to cloud, but you can move it to a local-only Wi-Fi network, or outright block it from reaching the outer world on the router side. And if you want advanced stuff (multiple streams, organized recording, etc), there is a plethora of free/open-source security camera tools (iSpy for instance). It all takes time to learn and configure, but you can have your own fully closed-circuit surveillance network, while still using the Wyze's rather cheap hardware.
- Shadowmist 3y agohttps://forums.wyze.com/t/how-to-download-wyze-rtsp-files-the-official-files-includes-v2-v3-pan/237659/6 https://forums.wyze.com/t/how-to-download-wyze-rtsp-files-th...
- BuildTheRobots 3y ago> Wyze Update 04/05/2022: RTSP was considered a beta feature and we are currently assessing the path forward as the firmware versions have aged quite a bit. Wyze has removed the firmware files for these versions for now and will update the pages when plans are finalized. Please note that firmware files take a while to work on and test so you may not see an update in the near future. Wyze apologizes for the inconvenience.
- sgerenser 3y agoInstead of patching, you can also just use PoE cameras that are designed for this use case (local RTSP) and are only a little more expensive than Wyze. I’ve installed an Amcrest doorbell that works well with Scrypted and HomeKit, and plan on adding some Amcrest cameras like these soon: https://www.amazon.com/dp/B083G9KT4C https://www.amazon.com/dp/B083G9KT4C
- frognumber 3y agoIn the meantime, Wyze has rolled back RTSP support, where it was possible to use their devices locally: https://support.wyze.com/hc/en-us/articles/360026245231-Wyze-Cam-RTSP https://support.wyze.com/hc/en-us/articles/360026245231-Wyze... A good response to this might be to put it back, and to extend other devices to be dual-use (Wyze Cloud or HA).
- SparkyMcUnicorn 3y agoFor those that want their Wyze cams 100% local (with RTSP), you can use wz_mini_hacks[0]. I've set up v2 and v3 cams using this, and they've never touched the internet or wyze app. I've use the official RTSP firmware in the past on some v2 cams, but I remember it having some problems and not being as good as this solution. https://github.com/gtxaspec/wz_mini_hacks/ https://github.com/gtxaspec/wz_mini_hacks/
- tehlike 3y agoThanks for this. I was using dafang hacks for v2 but didn't have solution for v3.
- lofaszvanitt 3y agoAccidentally mixed the IDs!
- voakbasda 3y agoAnother in a long line of reasons to avoid low price, off-the-shelf, unauditable, cloud-enabled cameras. I continue to be amazed that there is not a reasonably priced, open source, audited, local-first solution, which doesn’t require a significant personal investment of time to install and maintain.
- UberFly 3y agoI cringe every time I browse Amazon and see the random cam/cloud service/Play store apps that I know so many people are installing without questioning anything about them.
- Cheer2171 3y agoI swear sometimes you people post this ignorance bait to get product suggestions. Local-first cameras are super cheap and easy to find. Most just run their own local RTSP server, which you can connect to live with VLC, homeassistant, whatever. OpenIPC is like ddwrt for ip cameras, here is the supported devices page: https://github.com/OpenIPC/wiki/blob/master/en/guide-supported-devices.md https://github.com/OpenIPC/wiki/blob/master/en/guide-support... But unless you're Richard Stallman, go with the closed source Reolink RTSP camera, which is about $100 and used by big corporate installs. It can integrate with the cloud, but you can set it up to just have each camera run a RTSP server with user/pass auth. You have to secure your own network. But there isn't a really great open source platform for the kind of multi cam security that businesses might need. You have to do your own storage. But grab four reolinks, send the feeds to homeassistant, and most homeowners will be fine.
- jaktet 3y agoAt least with my setup I prefer Amcrest over Reolink (based on compatibility and setup and plugins with the software I use). An open source option that just requires cameras, a computer, and a network is Scrypted + Frigate (+optional Google coral). Amcrest plugin in Scrypted to create a rebroadcast point, then capture it in Frigate for a birdseye view and other security features. If you have Google coral frigate can also do AI object detection (it can do it without but slower). Since Scrypted is the rebroadcast point I also have it hooked up to Apple home kit since I have an Apple TV 4K. Pretty happy so far. Edit: Another comment mentioned https://gitlab.com/Shinobi-Systems/Shinobi https://gitlab.com/Shinobi-Systems/Shinobi which I haven’t explored but am definitely going to also try out now.
- n89nanda 3y agoLooks like they had a similar issue in 2023. https://www.nytimes.com/wirecutter/blog/wyze-security-breach/ https://www.nytimes.com/wirecutter/blog/wyze-security-breach...
- illusive4080 3y agoMy work encountered this same sort of thing after an outage. Our Redis instance or client got confused. If a=b and c=d in our cache, a request for a returned d randomly. We quickly realized that cache is fast but not infallible. Use proper security on all your resources. Don’t rely on UUIDs to obfuscate your data as security.
- pledess 3y agoI'm wondering about the probability that, out of all the affected customers, at least one had the research skills and social skills to identify another customer and successfully ask to meet. Like, for an essay about "His schnauzer needed a mom. WyZettle: the amazing story of a pivot from a home camera service to a dating app."
- spullara 3y agoThis actually looks like a concurrency bug in their request handling code that may have stored the user id and camera id in shared variables, under load the wrong camera id is seen by a user. At least based on the description of what they say happened.
- fatkam 3y agoI have my cameras blocked from the internet and doing backups in the attic.
- _obviously 3y agoAre they wifi or closed circuit?
- fatkam 3y agoPoE / Ethernet
- deleted 3y ago[deleted]
- gerwim 3y ago> Wyze blamed "a third-party caching client library that was recently integrated into our system" for the trouble. Yes, of course. Blame a third party library which was probably created by an open source maintainer instead of testing your own systems.
- summarity 3y agoAlso "was recently integrated" - by ... magic?
- _obviously 3y agoOf course, the reason this keeps happening is the infrastructure is designed to let it happen in certain cases. Notice how they explicitly say, they need to fix it in the front end. They can't fix it in the backend because that would break eavesdropping.
- cromka 3y agoThat’s a bit tinfoily take
- deleted 3y ago[deleted]
- scubadude 3y agoWhy do people have cameras inside their house anyway?
- BugsJustFindMe 3y agoTo make sure my cat feeder doesn't suddenly stop working and kill my cat while I'm away for a few days. Or other variations of similar.
- arealaccount 3y agoIncome
- urbandw311er 3y agoInitially I thought this was about the money transfer company. Curious how there are two software companies with the same name and one hasn’t sued the other.
- ra 3y agoInitially, I thought it was the turn-by-turn mapping app. Apparently, there are three wise companies.
- whatever1 3y agoHow the hell these incidents happen? In the era of cloud and microservices why each user does not have their own dedicated resources?
- seanarnold 3y agoAn individual S3 bucket or policy for each user?
- NegativeK 3y ago> How the hell these incidents happen? Because race to the bottom. People want incredibly cheap products that are internet connected. Your average home user should not have to worry (and won't) about cybersecurity concerns, so this will continue to happen. The only out I can foresee is government regulation stepping in to make these incidents actually hurt for the companies, but America has basically no appetite for that.
- siliconc0w 3y agoPretty much the same thing that hit OpenAI, I wonder if it was the same redis bug.
- X6S1x6Okd1st 3y agoPossibly a collision in the caching library. Pretty bad that the video streams aren't properly permissioned
- micola4151 3y ago[flagged]
- gvanmeter 3y ago[flagged]
- gvanmeter 3y ago[flagged]
- gvanmeter 3y ago[flagged]
- gvanmeter 3y ago[flagged]