Attackers Terrify Homeowners After Hacking Ring Devices

guest · Dec 14, 2019

Attackers Terrify Homeowners After Hacking Ring Devices
December 13, 2019
https://www.bleepingcomputer.com/ne...errify-homeowners-after-hacking-ring-devices/

In a series of hacks targeting Ring camera devices, attackers are terrifying homeowners and making them feel violated in their own homes after taunting them or speaking to their children over the device's speakers.

In one attack, the hacker has a creepy conversation with an eight-year-old girl while she in her room by herself and tells her to break her tv or "mess up your room".
In at least one of the attacks, the person speaking to the Ring device tries to get the owner to visit a site and screams out "Nulled" as the homeowner pulls out the device's batteries. [...] was probably a reference to the live-streamed NulledCast show for the users of the Nulled hacking forum.

According to a report by Vice, NulledCast commonly promotes its shows by advertising how they will be live-hacking Ring and Nest devices for the amusement of their viewers.
After news of the Rings attacks being reported by the media, in what appears to be a prank, Nulled briefly showed a site seizure notice by law enforcement. A few hours later, the site was returned to normal, but with many of the messages related to Ring hacking removed from the site.
Click to expand...

Ring Devices hacked through credential stuffing
In a statement released by Ring, the attackers are gaining access to devices through credential stuffing attacks and that there has been no unauthorized access to Ring's systems or networks.

"Recently, we were made aware of an incident where malicious actors obtained some Ring users’ account credentials (e.g., username and password) from a separate, external, non-Ring service and reused them to log into some Ring accounts. Unfortunately, when people reuse the same username and password on multiple services, it’s possible for bad actors to gain access to many accounts."
Ring also suggests that all owners of their devices enable 2-factor authentication on their accounts so that even if an attacker gains access to their credentials, they will not be able to log in without the special code sent to the owner's phone number.
Click to expand...

Motherboard / Vice: Inside the Podcast that Hacks Ring Camera Owners Live on Air

guest · Dec 15, 2019

Now hackers are breaking into Ring cameras
December 15, 2019
http://www.digitaljournal.com/tech-...are-breaking-into-ring-cameras/article/563606

News has broken of a Ring camera being hacked and allowing the attacker to speak to a eight-year-old girl in her bedroom. Will LaSala, Director of Security Solutions, Security Evangelist at OneSpan tells Digital Journal about the risks.

According to the BBC, a video showing a hacker talking to a young girl in her bedroom, accessed via her family's Ring camera, has been shared on social media.
This follows earlier reports via U.S. network NBC-2 concerning hackers who targeted a Florida family in a similar way, this time shouting racial abuse through the device.
To look into this issue further, Digital Journal caught up with Will LaSala, Director of Security Solutions, Security Evangelist at OneSpan.

In terms of current and future security, LaSala says that: "IoT vendors still have a long way to go to protect their devices. Often, they try to make quick fixes, such as by adding SMS authentication to their platforms. [...] Customers should look to their IoT vendors and ask the difficult questions surrounding how they plan to protect their users and what the timelines are."
Click to expand...

In terms of the future state, LaSala predicts: "I expect that we will continue to see massive breaches over the next year, as well as new security technologies being built directly into the IoT vendors’ platforms and even into third-party home routers and networking equipment to really start to reduce these breaches."
Click to expand...

guest · Dec 16, 2019

Ring Camera Hack Sold Online for Just a Few Dollars
Camera hacking tools available on the dark web
December 16, 2019
https://news.softpedia.com/news/ring-camera-hack-sold-online-for-just-a-few-dollars-528608.shtml

Now a report from Motherboard reveals that hacking Ring cameras is something that many hackers can do with just a few dollars, as dedicated software that can be used specifically for this purpose is sold online for as low as $8.

More specifically, a tool called “Ring Video Doorbell Config” advertised on a hacking forum guarantees what is called a “high CPM,” also referred to as high check per minute, which means it can try a wide variety of usernames and passwords to attempt to break into Ring’s video doorbell. Similar tools, such as a Ring.com checker, is available for just $6 on the same forum, according to the cited source.
Ring: No security breach
Demand for such hacking software is believed to be rather high, with one member of the forum posting that one purpose for such a tool could be “planning to break into the persons [sic] house.”
The company says the Tennessee incident isn’t the result of a breach and an investigation is still under way.
Click to expand...

Motherboard / Vice: How Hackers Are Breaking Into Ring Cameras

guest · Dec 18, 2019

Consumer groups issue product warning for Amazon Ring after latest video hack
This is only the latest controversy for the video doorbell company
December 17, 2019
https://www.vox.com/recode/2019/12/17/21026381/amazon-ring-hack-product-warning-fight-for-future

Following a string of highly publicized hacks on Amazon Ring devices, a number of consumer and privacy groups, led by nonprofit advocacy group Fight for the Future, issued a product warning for Ring cameras on Tuesday.
The joint warning by groups including the Electronic Privacy Information Center and Mijente asserts that Ring devices are not secure, that they expose personal information like device locations and wifi passwords, and that they’re “easier than ever” to hack and share video without your permission.

Ring did not immediately respond to Vox’s request for comment. The company previously told the Washington Post that the Mississippi incident was “in no way related to a breach or compromise of Ring’s security.”
In a statement, Fight for the Future’s Ken Mickles, the organization’s chief technology officer, wrote:

"Amazon is not taking the steps necessary to protect their users. Amazon knew users’ wifi passwords had been leaked and were compromised. [...]"
The groups recommend against buying Ring products.
Click to expand...

Fight for the Future: Product warning issued for Amazon Ring Cameras following slew of hackers break ins

guest · Dec 19, 2019

Over 1,500 Ring passwords have been found on the dark web
December 19, 2019
https://techcrunch.com/2019/12/19/ring-doorbell-passwords-exposed/

A security researcher has found on the dark web 1,562 unique email addresses and passwords associated with Ring doorbell passwords.

The list of passwords was uploaded on Tuesday to an anonymous dark web text-sharing site, commonly used to share stolen passwords and illicit materials. A security researcher found the cache of email addresses and passwords, which can be used to log in to and access the cameras, as well as their time zone and the doorbell’s location, such as “driveway” or “front door.”
At the time of writing, the dark web listing is still accessible.

Nearly all of the passwords we reviewed were relatively simple and potentially easy to guess.

Ring spokesperson Yassi Shahmiri did not respond to a request for comment prior to publication but said in an email after we posted: “We’ve notified customers whose accounts we have identified as exposed and have reset their passwords. [...]”
However, of those we spoke to none had been contacted by Ring — contrary to the company’s claim.
Click to expand...

guest · Dec 19, 2019

Ring Throws Customers Under the Bus After Data Breach
December 19, 2019
https://www.eff.org/deeplinks/2019/12/ring-throws-customers-under-bus-after-data-breach

Just a week after hackers broke into a Ring camera in a child’s bedroom, taunting the child and sparking serious concerns about the company’s security practices, Buzzfeed News is reporting that over 3,600 Ring owners’ email addresses, passwords, camera locations, and camera names were dumped online. This includes cameras recording private spaces inside homes.

Ring has claimed that this attack was the result of credential stuffing, a technique where attackers gather usernames and passwords compromised in another data breach and try them on other websites.
Ring is attempting to place the blame squarely at the feet of their customers for reusing passwords, using weak passwords, and not turning on two-factor authentication.

We don’t currently know how the Ring account data was acquired but for the moment let’s take Ring at their word that this was a credential stuffing attack. That implies that an attacker tried tens or even hundreds of thousands of username and password combinations on Ring’s website, and Ring didn’t even notice until they were alerted by security researchers.
Ring has demonstrated a pattern of being negligent in enforcing even basic web application security controls. As late as February they sent video feeds to their cloud providers completely unencrypted.
Click to expand...

Motherboard / Vice: We Tested Ring’s Security. It’s Awful

guest · Dec 27, 2019

Amazon's Ring faces lawsuit over hacking resulting from 'lax security standards'
December 27, 2019
https://thehill.com/policy/technolo...suit-over-hacking-resulting-from-lax-security

Amazon and its home security subsidiary Ring are facing a federal lawsuit in California over allegations that its "lax security standards" led to a series of invasive and frightening hacks over the past year.

The plaintiff, John Baker Orange, is claiming in federal court that his Ring security camera was hacked while his children were playing basketball outside.

"An unknown person engaged with Mr. orange’s children, commenting on their basketball play and encouraging them to get closer to the camera."
It's only the latest in a series of similar allegations after that a hacker was able to speak to an 8-year-old girl in Mississippi by using a Ring camera installed in her bedroom.

Orange is claiming that Ring has not taken proper steps to protect the privacy of its users and the security of its devices.

"Ring promises its customers ‘peace of mind’ with its Wi-Fi enabled smart security systems," the lawsuit reads. "Unfortunately, Ring’s cameras fail to deliver one its most basic promise. Lax security standards and protocols render its camera systems vulnerable to cyber-attack."
Click to expand...

guest · Jan 30, 2020

Family whose Ring camera was hacked is now suing the company
A Mississippi mother says her family's Ring security camera being hacked has been a "terrifying" experience
January 30, 2020
https://www.today.com/money/family-whose-ring-camera-was-hacked-now-suing-company-t172787

A Mississippi family has filed a lawsuit against home security company Ring after saying someone taunted their 8-year-old daughter last month by hacking a camera set up in their children's bedroom.

The LeMay family, as well as Texas couple Todd Craig and Tania Amador, are claiming in the lawsuit that similar incidents have occurred across the country and that the company isn't doing enough to protect consumers.

"It was the most terrifying experience in my life,'' Ashley LeMay told Gabe Gutierrez on TODAY Thursday.
The lawsuit claims that similar incidents have occurred in at least five states.

The plaintiffs' attorney says Ring is wrongly trying to blame consumers.
Click to expand...

guest · Dec 24, 2020

Dozens sue Amazon's Ring after camera hack leads to threats and racial slurs
Class action claims weak security allowed hackers to take over the smart cameras
December 23, 2020
https://www.theguardian.com/technology/2020/dec/23/amazon-ring-camera-hack-lawsuit-threats

Dozens of people who say they were subjected to death threats, racial slurs, and blackmail after their in-home Ring smart cameras were hacked are suing the company over “horrific” invasions of privacy.

A new class action lawsuit, which combines a number of cases filed in recent years, alleges that lax security measures at Ring, which is owned by Amazon, allowed hackers to take over their devices. Ring provides home security in the form of smart cameras that are often installed on doorbells or inside people’s homes.
The suit against Ring builds on previous cases, joining together complaints filed by more than 30 people in 15 families who say their devices were hacked and used to harass them.

In response to these attacks, Ring “blamed the victims, and offered inadequate responses and spurious explanations”, the suit alleges.
Click to expand...

Repeatedly, Ring blamed victims for not using sufficiently strong passwords, the suit claims. It says Ring should have required users to establish complicated passwords when setting up the devices and implement two-factor authentication, which adds a second layer of security using a second form of identification, such as a phone number.
Click to expand...

guest · Dec 31, 2020

FBI Warn Hackers are Using Hijacked Home Security Devices for ‘Swatting’
Stolen email credentials are being used to hijack home surveillance devices
December 30, 2020
https://threatpost.com/fbi-warn-home-security-devices-swatting/162678/

Stolen email passwords are being used to hijack smart home security systems to “swat” unsuspecting users, the Federal Bureau of Investigation warned this week. The announcement comes after concerned device manufacturers alerted law enforcement about the issue.

Swatting is a dangerous prank where police are called to a home with a fake emergency.

“Swatting may be motivated by revenge, used as a form of harassment, or used as a prank, but it is a serious crime that may have potentially deadly consequences,” the FBI statement said.
The FBI’s public service announcement read. “To gain access to the smart devices, offenders are likely taking advantage of customers who re-use their email passwords for their smart device. The offenders use stolen email passwords to log into the smart device and hijack features, including the live-stream camera and device speakers.”
Click to expand...

Live Streaming Swatting Attacks
Live streaming swat attacks isn’t new. Last December, the publication Vice reported on a podcast called “NulledCast” which live streamed to the content sharing platform Discord an incident where criminal actors hijacked a Nest and Ring smart home video and audio to harass them in all sorts of creepy ways.

Vice also reported finding posts on hacker forums offering simple Ring credential stuffing software for as little as $6.
Click to expand...

Log in or Sign up

Attackers Terrify Homeowners After Hacking Ring Devices

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Attackers Terrify Homeowners After Hacking Ring Devices

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches