Wyze Cam Security Flaw Gave Hackers Access To Video; Went Unfixed For Almost Three Years (9to5mac.com) 24
An anonymous reader quotes a report from 9to5Mac: A major Wyze Cam security flaw easily allowed hackers to access stored video, and it went unfixed for almost three years after the company was alerted to it, says a new report today. Additionally, it appears that Wyze Cam v1 -- which went on sale back in 2017 -- will never be patched, so it will remain vulnerable for as long as it is used.
Bleeping Computer reports: "A Wyze Cam internet camera vulnerability allows unauthenticated, remote access to videos and images stored on local memory cards and has remained unfixed for almost three years. The bug, which has not been assigned a CVE ID, allowed remote users to access the contents of the SD card in the camera via a webserver listening on port 80 without requiring authentication. Upon inserting an SD card on the Wyze Cam IoT, a symlink to it is automatically created in the www directory, which is served by the webserver but without any access restrictions."
And as if that weren't bad enough, it gets worse. Many people re-use existing SD cards they have laying around, some of which still have private data on them, especially photos. The flaw gave access to all data on the card, not just files created by the camera. Finally, the AES encryption key is also stored on the card, potentially giving an attacker live access to the camera feed. Altogether, Bitdefender security researchers advised the company of three vulnerabilities. It took Wyze six months to fix one, 21 months to fix another, and just under two years to patch the SD card flaw. The v1 camera still hasn't been patched, and as the company announced last year that it has reached end-of-life status, so it appears it never will.
Bleeping Computer reports: "A Wyze Cam internet camera vulnerability allows unauthenticated, remote access to videos and images stored on local memory cards and has remained unfixed for almost three years. The bug, which has not been assigned a CVE ID, allowed remote users to access the contents of the SD card in the camera via a webserver listening on port 80 without requiring authentication. Upon inserting an SD card on the Wyze Cam IoT, a symlink to it is automatically created in the www directory, which is served by the webserver but without any access restrictions."
And as if that weren't bad enough, it gets worse. Many people re-use existing SD cards they have laying around, some of which still have private data on them, especially photos. The flaw gave access to all data on the card, not just files created by the camera. Finally, the AES encryption key is also stored on the card, potentially giving an attacker live access to the camera feed. Altogether, Bitdefender security researchers advised the company of three vulnerabilities. It took Wyze six months to fix one, 21 months to fix another, and just under two years to patch the SD card flaw. The v1 camera still hasn't been patched, and as the company announced last year that it has reached end-of-life status, so it appears it never will.
Maybe time to reconsider (Score:3)
In any case I don't think I want to put things like this on my main network. I think my TP Link gateway router might let me set up a separate LAN or VLAN and keep it and any other IOT stuff separate and put a separate WIFI access device on that segment. Not sure, since things have changed a lot since I retired 15 years ago!
Re: (Score:2)
It is a great, cheap outdoor RTSP camera! (Score:4, Interesting)
On the other hand I recently bought a Wyze cam v3 solely for use with RTSP and Open Broadcast Studio (OBS) [obsproject.com], so nothing is saved to any SD-card, (and the source of this particular security error if I understand correctly). For this specific purpose, I am amazed with the quality of the cheap outdoor streaming camera, day and night, in color, using default settings only so far. Seriously it is fun to play with!
To further clarify my purpose: In the recent past, my webcam meeting/interview setup was abysmal and the engineer in me realized to make changes, so I bought a roll-down green screen and am still busy trying to absorb this fun YouTube channel [youtube.com]. To tweak the natural fisheye distortion of the wide angle Wyze cam v3 lens, a search engine told me to install the OBS fisheye shader filter and input a slightly negative value and it works well!
Wyze makes an identical version of their software available with RTSP [wyze.com], although it is not open-source, and of course you have to install it yourself using an SD-card to upload the firmware. If you are using RTSP it would be resource-redundant to also be using the cloud services Wyze otherwise wants to sell you a subscription for.
For my purposes, the camera is an amazing tool, especially for the price, but I have it outside pointing at a busy, interesting city scene which I 'project' as a background layer, so no real security concerns. The layer over that is a photo-shopped image of my actual house indoors with a paned window behind me. In real-life, my desk arrangement does *not* place me in front of the same window in any practical way. And I sit in front of a green screen with an adjustable studio light. My loft is tiny, but tweaked via photoshop (GIMP actually) & OBS I make something awkward look studio-quality nice for online meetings. Also because I'm (hopefully) done with having to relocate just to keep working.
One big thing I learned from this engineering project that I had no clue about going in, was about all the interchangeable photo-studio mounting parts available, along with their interconnection fittings. That's been a rabbit-hole I went down! For example this cheap, useful item [amazon.com] as a starting point.
I'd replace Wyze's firmware with something open-source if I knew of something better to use.
Re: (Score:3)
TP Link cameras are decent. For the router, OpenWRT or pfSense are good and let you create a separate isolated network with no internet access.
It's worth getting cameras that have open source firmware available. Hikvision ones are popular because they have good optics, but many of the cheaper ones can be reflashed too.
Looks like nobody cares (Score:2)
Most/all of these cams will not have interesting footage of any kind on storage anyways. Cameras are basically "feel good" anyways. They do not really offer any security benefits except if they are monitored 24/7. Almost nobody can afford that and hackers will not have the time or motivation to look through weeks of boring footage either.
Re: (Score:1)
Re: (Score:1)
The attacker could then use identified nude videos of people for blackmail.
What year do you think we're living in? Nobody actually cares about any of that anymore. You could probably include a link to your OnlyFans on a resume these days and still get the job.
It's far more profitable for hackers these days to just run ransomware schemes and cryptocurrency scams/heists.
Re: (Score:2)
Indeed. Unless it is a known CEO and some wired unusual fetish thing is shown, nobody cares. And even in that case, it is not assured anybody will care. That is one of the positive effects of "the Internet is for porn". Also, in many countries it is actually illegal to show footage like that or pictures from it, so even that CEO may be safe because the press cannot make much from it. Well maybe not if, for example, he is known to be violently anti-gay and the footage shows him getting it on with a man. That
Re: (Score:1)
Most/all of these cams will not have interesting footage of any kind on storage anyways.
I honestly have to wonder what the hell people are doing with these things if they're worried about privacy issues. I have two cameras at my home, one's a Ring doorbell, and the other is a cheap outdoor Tuya camera which utilizes servers in China. Both of them show the same sort of view that neighbors can see when looking outside.
There's absolutely nothing titillating that goes on outside. If someone hacks my shit because they really want to watch cars passing by and grass growing in realtime, that's on
Re: (Score:2)
Exactly.
Re: (Score:2)
Cameras can be useful when paired with other security devices, like silent alarms. The police generally won't attend an alarm going off unless the owner also has a camera and can see the people who broke in.
Re: (Score:2)
Soo, you will give the police access to your cameras?
Re: (Score:3)
No need, you just have to tell them that you have a camera and can see the criminals. Of course if you lie you will be in trouble when they ask for the video or notice that you don't really have cameras at that location.
Re: (Score:2)
Ah, so this is a person alerting the police. Yes, that would work.
Any local only options? (Score:2)
These things keep happening. Maybe it's time to go for a camera that doesn't leave the local network at all.
Does anyone make home grade cameras without any internet connectivity?
Re: (Score:3)
Re: (Score:3)
Re: (Score:2)
Eufy cameras can store to local storage and be accessible on the local network. No cloud or internet service required, no subscription fees, etc. Network is required to access it, of course.
But if you set it up yourself, you can view the contents of the video offsite.
Just cancelled my Wyze "Cam Plus" subscription... (Score:3)
.
I was actually paying Wyze a small amount each month for their "Cam Plus" (formerly "Person Detection") service. Just cancelled that with their support chat folks (easy - points in their favor there) and I'll be putting my remaining Wyze camera on Craigslist later tonight.
Ignoring gaping security holes - and a corporate culture that allows that to happen - has consequences.
So what? Misleading headline. (Score:2)
Re: (Score:2)
For these folks, an internal SD-card must also be purchased and installed. The device records locally and streams up to the cloud upon API calls (like motion detection, which is a paid-for service). It's a camera on the LAN connecting to a cloud somewhere, unless you are a nerd using it with RTSP. The firmware bug discusse
As we suspected (Score:2)
We users of Wyze webcams knew for a while that they were phoning home to China, and Wyze never fixed it or even made a public statement about it to my knowledge. (I think there was a binary blob in the firmware that even they couldn't modify.) So we all had to assume the worst.
I used mine for an exterior security camera for a while, and I still think it's fine for that purpose, especially if it's firewalled from the rest of the network. Just don't point it inside your walls. But I would never point any webc