Security Camera Startup Wyze Leaked Data on Millions of Customers (cnet.com) 36
An anonymous reader quotes CNET:
Security camera startup Wyze has confirmed it suffered a data leak earlier this month that left the personal information for millions of its customers exposed on the internet. No passwords or financial information was exposed, but email addresses, Wi-Fi network IDs and body metrics for 2.4 million customers were left unprotected from Dec. 4 through Dec. 26, the company said Friday.
The data was accidentally left exposed when it was transferred to a new database to make the data easier to query, but a company employee failed to maintain previous security protocols during the process, Wyze co-founder Dongsheng Song wrote in a forum post. "We are still looking into this event to figure out why and how this happened," he wrote...
Among the data exposed in the Wyze leak was the height, weight, gender and other health information for about 140 beta users participating in testing of new hardware, Wyze said.
The data was accidentally left exposed when it was transferred to a new database to make the data easier to query, but a company employee failed to maintain previous security protocols during the process, Wyze co-founder Dongsheng Song wrote in a forum post. "We are still looking into this event to figure out why and how this happened," he wrote...
Among the data exposed in the Wyze leak was the height, weight, gender and other health information for about 140 beta users participating in testing of new hardware, Wyze said.
What is the BEST security camera? (Score:2)
My investigations have shown that Wyze is the best. But maybe Slashdot readers will have a better understanding.
Re: (Score:2, Offtopic)
Re: (Score:3)
Try this [wikipedia.org]
According to many movies I've seen, those greatly increase your chances of getting shot in the eye (which will result in its own form of data leakage).
Re: (Score:2)
What is the BEST security camera?
A very hungry and angry 70 pound Rottweiler. He'll see an intruder coming from a mile away.
Re: (Score:2)
These come with a very good AI
https://media.wired.com/photos... [wired.com]
Re:What is the BEST security camera? (Score:4, Informative)
A system you set up yourself, that's hardwired to a monitor, and is air gapped from any storage or access outside your own purview.
There are many inexpensive quality cameras out there. Choose a unit rated for outdoor use that has weather resistance and good quality night vision.
Sometimes a camera that doesn't look like a camera is helpful, depending on your individual security needs.
Re: (Score:2)
Re: What is the BEST security camera? (Score:2)
The Best?
The best system is hard-wired to a recording system air-gapped to the internet with a warrant examined by your attorney prior to the release of any information. High-rez cameras shielded from electronic emmissions, recording system in a TEMPEST certified room with double redundency power supplies with the main power supply on a surge protected SOLA transformer. Having the whole system enclosed in a biometrically monitored Faraday cage is a good start. Multiple, strategically placed cameras ( some obvious, s
Re: (Score:2)
I've worked in physical security (key cards, cameras, alarms, etc.) 14 years, the best IP cameras come from Axis and Pelco, the best analog cameras from Pelco. Hands-down. Their hardware is top-notch, their support is outstanding, their return policies are great, their management tools are the best of their type, and their integration into other products such as access control systems, traffic monitoring systems, factory floor automation, and the like, is second to none.
Yes, they're more expensive, but if
"millions of its customers"? (Score:2)
Not too wise.
Lemme guess... MongoDB? (Score:3)
From TFBP:
"We copied some data from our main production servers and put it into a more flexible database that is easier to query."
and
"We created this subset of user information in order to perform queries (e.g., number of connected devices, connectivity errors, etc.). Queries such as these are expensive in terms of computer resources and they would have impacted your product experience significantly. For that reason, we created a separate database specifically for processing those heavier requests."
How much you wanna bet this was another MongoDB screw-up?
Re:Lemme guess... MongoDB? (Score:4, Informative)
Re: Lemme guess... MongoDB? (Score:1)
It's always Elasticsearch.
Re: (Score:3)
The root of the problem is that the company was too cheap to buy the servers and the bandwidth necessary to do things securely and fast.
It's not a MongoDB screw-up, it's a classic "security is too expensive" issue.
Re: (Score:3)
This is a strategy that goes back decades. I remember in the 70s and 80s there was a lot of hype about how relational databases would allow organizations to create unified databases they ran *everything* from. While they did enable developers to tackle more complex problems, nobody ever succeeded, and by the 90s people figured out that the reason was that the idea wasn't very good one to start with.
So since the 90s it's been the norm to manage pots of data that support operations from pots of data that su
Why? (Score:4, Interesting)
Re: (Score:2)
It was part of the "human vs not-human" motion detection software built into the camera. It's supposed to cut down on false alerts by being able to differentiate a human from a dog or blowing leaves or whatever.
Re: (Score:2)
Yeah, my immediate question was why anyone would give health data to a security camera company. That's just extra exposure you don't need.
Re: (Score:2)
They're beta testing a "smart" scale.
They always say companies suffer security leaks (Score:4, Interesting)
Manufacturers of shite products suffer nothing at all. Their customers do. The manufacturers ultimately don't give a shit as long as it doesn't become public and hurt their bottom line. Somehow that simple fact always gets glossed over.
Then again, it's the onus of the customers to quit buying cloudy IoT devices and/or provide personal information if they want to avoid being victims. Who the hell with more than 2 working neurons provides their height, weight and health information to beta-test a fucking security camera? Seriously...
Re: (Score:2)
The businesses do suffer just not enough to change how they operate. Customers are weak and will continue to do business with companies that fuck them over... so why should the companies change what they are doing?
If people will not boycott trash then the economy becomes filled up with trash.
Wifi? (Score:2)
Re: Wifi? (Score:2)
Blaming an employee (Score:2)
... "which neither the employee, nor his immediate manager even knew existed", — is what he forgot to add...
Processes are boring — and often suffocatingly restrictive. Because computer-security professionals are rarely programmers themselves (some are, actually, former policemen!)..
I have a few Wyze camera. They're fairly nice. (Score:2)
That being said, I don't see anything about SSIDs with passwords. S'ok though: if someone were to "break into" my cameras I'd blind their eyes with my shiny untanned naked skin, and then scar their minds with the rest of the image
I call Bullshit on this (Score:2)
"The data was accidentally left exposed when it was transferred to a new database to make the data easier to query, but a company employee failed to maintain previous security protocols during the process,"
This was no accident. I have seen it too many fucking damn times to know better. There could be a number of reasons for why this was "intentionally" left insecure.
Management is to blame... 100%. They just did not give a fuck because their jobs are never on the line for letting this bullshit happen. L
Re: (Score:2)
Far too often this is the only config possible when management is too lazy or incompetent to jump through the hoops necessary to get to secure data. There are a lot of S3 buckets out there exposed to the whole world because some manager wanted to create a Power Point presentation using that data and were too stupid to be able to access it securely.
it's you're own a$$ (Score:2)
"Random" email addresses for these services (Score:2)
I'm beginning to think that a distinct password for each of these services is not enough anymore. Time for distinct/random email alias addresses too. Wasn't Apple supposed to start doing this in iOS?
Re: "Random" email addresses for these services (Score:2)
Wall them off... (Score:2)
This is why my Wyze cameras are on their own SSID, over a dedicated VLAN, running the RTSP-only firmware, and generally cut off from Wyze. And the Chinese P2P library that connects the cameras and the app.
A bit more of a bother to set up, but reasonably secure. I can do the motion detection/feature recognition on my own systems, without dumping the streams all over the "cloud". But for $20, they're not bad for fill-in cameras, or experimenting.
So when is the class action? (Score:1)