Massive Wyze data breach may have exposed user data for millions of users

guest · Dec 27, 2019

Report alleges massive Wyze data breach, but many questions remain
December 26, 2019
https://www.slashgear.com/report-al...ta-breach-but-many-questions-remain-26604513/

Budget smart home company Wyze is the subject of a new security report alleging massive user data loss in what is described as a huge security breach.
Wyze has acknowledged the report but has said that it hasn’t yet been able to confirm whether the claims are true. The company was only made aware of the report earlier today from a second party, which claims on its own website that it verified the leak by reviewing ‘the records.’

The initial security breach claim was published by ‘Twelve Security,’ a website that describes itself as a ’boutique consulting firm.’ The report claims that Wyze’s production databases ‘were left entirely open’ for anyone to access, exposing data from 2.4 million users. The report claims the exposed data includes email addresses, lists of cameras with their nicknames, WiFi SSID, API tokens, Alexa tokens, and more.

In a post on its forums this evening, Wyze said that it only learned about the report at 10AM PT / 1PM ET, at which point it ‘mobilized the appropriate developers and executives.’ The company was unable to verify the breach [...]
Click to expand...

guest · Dec 28, 2019

In a post on its forums this evening, Wyze said that it only learned about the report at 10AM PT / 1PM ET, at which point it ‘mobilized the appropriate developers and executives.’ The company was unable to verify the breach [...]
Click to expand...

Breach confirmed:
[Updated 12-27-19] Data leak 12-26-2019

On December 26th at around 10:00 AM, we received a report of a data leak. We immediately restricted database access and began an investigation.
Today, we are confirming that some Wyze user data was not properly secured and left exposed from December 4th to December 26th.

We don’t have all the answers yet, but we wanted to provide an update based on our investigations so far. We will be providing a detailed follow-up once we complete our investigation.
[...]
For now, we’ll say that we are very sorry for this oversight and we promise to learn from this mistake to make improvements going forward. We’ll continue to update you as we make progress.
Click to expand...

ZDNet: IoT vendor Wyze confirms server leak

Details for 2.4 million users were exposed online for 22 days
Click to expand...

guest · Dec 30, 2019

Wyze: [Updated 12-29-19] Data leak 12-26-2019

We wanted to give you all an update on the ongoing investigation into the data leak that was reported on 12/26/19.

We have been auditing all of our servers and databases since then and have discovered an additional database that was left unprotected. This was not a production database and we can confirm that passwords and personal financial data were not included in this database. We are still working through what additional information was leaked as well as the circumstances that caused that leak.
Click to expand...

Wyze data leak: Key takeaways from server mistake that exposed information from 2.4M customers
December 29, 2019
https://www.geekwire.com/2019/wyze-...r-mistake-exposed-information-2-4m-customers/

Seattle-area startup Wyze, a provider of home video cameras and other Internet of Things (IoT) devices, announced on Dec. 26 that it had been informed of a “data leak” that reportedly exposed the personal information of 2.4 million of its customers.
To Wyze’s credit, it has been very detailed in describing what happened, when, why, how, and what the company is doing about it.

In looking over this event, there are ten key security and privacy takeaways. [...]
3) But Wyze is not forcing password resets
Not forcing a password reset is missing an opportunity to be thorough in the response to improve overall customer security.
Click to expand...

5) This shows what IoT data breaches can mean
Looking at the information that’s potentially lost in this breach, we get a more concrete sense of IoT data breaches can mean in real terms.

In particular, Wyze notes that the data loss includes: “List of all cameras in the home, nicknames for each camera, device model and firmware. WiFi SSID, internal subnet layout, last on time for cameras, last login time from app, last logout time from app.”
This data is troubling because it can give very specific information that can be useful for real-world crime.
6) IoT health data is VERY personal
Another piece of the exposed data is this: “Height, Weight, Gender, Bone Density, Bone Mass, Daily Protein Intake, and other health information for a subset of users.”
Wyze goes to some length to point out that this information lost only affects a very small subset of their users, specifically “140 external beta testers.” Yes, that is a very small number of people. But the information that’s was exposed is very sensitive and very personal health information [...]
Click to expand...

guest · Dec 30, 2019

Employee error to blame for massive data leak, Wyze says
December 30, 2019
https://arstechnica.com/tech-policy...mera-company-wyze-confirms-leak-of-user-data/

The database in question was basically a copy of the production database that Wyze created to work with, Song explained.

The company blames an employee for the exposure. "A mistake was made by a Wyze employee on December 4th when they were using this database and the previous security protocols for this data were removed," Song wrote. "We are still looking into this event to figure out why and how this happened."

A pair of essays from a mysterious (and possibly fake) firm called 12Security first brought the leak to light. The firm alleges that data for 2.4 million Wyze users was included in the leak, claiming that the data was sent to the Alibaba cloud and that the breach is tied to China.
Seattle-based Wyze, however, has extremely strong ties to Amazon and strongly denies the allegation that it uses the Alibaba Cloud.

"Wyze does have official Wyze employees and manufacturing partners in China, but Wyze does not share user data with any government agencies in China or any other country," the company said.
Click to expand...

Log in or Sign up

Massive Wyze data breach may have exposed user data for millions of users

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Massive Wyze data breach may have exposed user data for millions of users

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches