A flaw in Amazon's Ring doorbells leaked customers' Wi-Fi credentials

mood · Nov 7, 2019

A flaw in Amazon's Ring doorbells leaked customers' Wi-Fi credentials
November 7, 2019
https://www.cyberscoop.com/ring-doorbell-wi-fi-flaw/

Internet-connected doorbells sold by Amazon’s Ring service contained a security vulnerability that would have made it possible for hackers to intercept a customer’s Wi-Fi username and password, then launch a larger attack on the network, according to findings made public Thursday.

Researchers from the Romanian security firm Bitdefender discovered earlier this year that when a user first configured their Ring doorbell app, it accepted credentials in an unsecure format as it created a new digital access point.
All of those transmissions were sent through an unencrypted HTTP format, meaning anyone with access to that open network could have obtained the Wi-Fi username and password, Bitdefender said.
(Hackers likely would have needed to be within a close physical proximity to carry out this attack.)
Click to expand...

Bitdefender: Ring Video Doorbell Pro Under the Scope

Bitdefender researchers have discovered an issue in Amazon’s Ring Video Doorbell Pro IoT device that allows an attacker physically near the device to intercept the owner’s Wi-Fi network credentials and possibly mount a larger attack against the household network.

At the moment of publishing this paper, all Ring Doorbell Pro cameras have received a security update that fixes the issue described herein.
More information is available in the technical whitepaper below: [...]
Click to expand...

Log in or Sign up

A flaw in Amazon's Ring doorbells leaked customers' Wi-Fi credentials

mood Updates Team