A vulnerability in the Amazon Ring doorbells could have exposed homes’ WiFi username and password to hackers.
Discovered earlier this year by Romanian cybersecurity firm Bitdefender, the issue caused users’ WiFi credentials to be transmitted unencrypted while they were setting up the internet-connected device.
“When entering configuration mode, the device receives the user’s network credentials from the smartphone app,” Bitdefender notes. “Data exchange is performed through plain HTTP, which means that the credentials are exposed to any nearby eavesdroppers.”
This means a hacker would either have to be close to the doorbell or already on a user’s WiFi network to grab their credentials.
To make matters worse, a hacker could still obtain a username and password even after the Ring device has been set up.
A hacker could make the doorbell to reenter the configuration mode by flooding the device with de-authentication messages, forcing it to disconnect from the WiFi network. A user would then be asked by Ring’s mobile app to reconfigure their device.
After obtaining a user’s WiFi login information, a hacker could then start attacking other devices connected to that network.
Bitdefender says the issue, which affected Amazon’s Ring Video Doorbell Pro model, has since been fixed.
After alerting Amazon to the discovery, the company issued a security fix as part of an automatic update.
News of the vulnerability comes as Ring faces scrutiny over its practices and involvement with law enforcement.
In a recent blog post, Ring revealed just how much data it gathers after it admitted to recording millions of children trick-or-treating on Halloween. The company, which says its doorbells were rung 15.8 million times that evening, even showed footage of different children.
According to its terms of service, the company reserves the right to use any video shared by its customers.
READ MORE:
- Ring thought surveillance videos of trick-or-treaters were a good PR opportunity
- What is the Amazon Echo Show, and how does it work?
- Amazon Alexa is the home assistant you never knew you needed
H/T CyberScoop