Big security flaw regarding NO "Camera Tampering Detection" or SD card removal/power loss

This is a HUGE flaw regarding the Wyze Camera service, Wyze Cam V3 currently advertises itself as a security camera company, but it does not have the basic redundancy using their premium cloud service, which is a paid service for their cloud integration, not to mention the additional low cost home security system that appears to act like a professional system (at times, it does). However, in this case, it’s far from anything “security based” from my current experience.
On the 14th of April, I had the police at my home over matters not related to me, which did involve a squatting tenant that is now finally gone. During the time the police were there, I had two SD cards that went missing with the rubber cover swiveled to the side where the SD card goes, which leads me to believe that the cops helped themselves to my data and property without a warrant to do so or permission from myself, the landlord… Here in NJ, that’s considered a crime.
I have two cams above the garage overhang? or Eave? Whatever you want to call it, it’s about 8–9 ft from the ground to cover the garage entrance, including an adjacent door next to the garage, for which I had one above the door and the other on the far left, covering THAT door, including steps that lead to the main floors of this 2-family dwelling. All my other cameras are connected to the eave, under the gutters, running the power into crawl spaces and attics, which, of course, are higher up, but do not cover the garage area, as that’s covered by those 2 cameras that I’m talking about as far as the theft of the SD cards goes.
How come there is no redundancy built into the cameras that will alert you IF a camera gets unplugged or if an SD card is to be taken out? Your basic NVR camera systems do have anti-tamper proof tech in them for these reasons, including much more, such as violently trying to rip a camera down, spray painting the lense, among many other software related features for those “oh crap” moments.

If Wyze is advertising themselves as a security service, as I do own their home security kit as stated, sensors, and 7 cameras on the property, including an NVR 2K system that has been out of commission for over 6 months due to NVR issues, I have time to fix it as I placed my faith in the Wyze camera solution, which has failed miserably. I have called Wyze regarding this issue, as I am paying for their extended cloud coverage, but it still has a cool down after every (x) amount of time, rendering itself useless to me. They are telling me that their data “pool” has gone past the time of them being able to access it. which all this happened on April 15th, just last Friday. However, this situation occurred on that Friday afternoon, when Wyze closed their call centers at 4 p.m. central time through the weekend, re-opening on Monday morning, the day I immediately called back to help resolve this matter.

First of all, their cameras and software need to have some sort of anti tampering system put in place. If an SD card gets taken out, I should get a notification immediately. What if it was a burglar? Which brings me to my next question. How is this security? There is no way of pulling any logs yourself that will give you any info regarding if the camera lost power, if the SD card was removed, if the camera was forced out of alignment, or if the lens was painted over. Those are all very serious and necessary matters that need to be addressed, as they are major security flaws that are currently going unnoticed. Yes, it’s a $35 camera, I understand. However, there should be some kind of tamper prevention implemented, especially if you’re paying them to secure your home with hundreds of dollars’ worth of equipment, which includes, once again, the home security system kit, and additional door and window sensors, including motion sensors, not to mention monthly fees that do stack up.

Apparently, wyze is still escalling this issue to which I think nothing will be done about so I’m making others aware of this as this is a major flaw in their system that needs to be resolved. At the very least, they should write a script to notify the user if the SD card has been removed. For god’s sake, you know, the stuff that stores sometimes critical data that is no longer there because someone gave it a “reach around” and took it out. The software engineers need to stop playing [mod edit] while giving themselves “reach arounds” to prevent this type of stuff from happening. I can probably write the necessary script for something as simple as an SD card being removed that would trigger a notification and a log of events. Of course, doing so would infringe on Wyze’s customer agreement, as you’re not allowed to reverse engineer or tamper with their software if you wanted to.

I’m getting my NVR up and running starting today (garbage if it crapped the bed) and re-hooking up my older security system if this issue is not resolved, as I did put a little too much trust in Wyze, which surely proves the saying/theory “if it sounds too good to be true, it normally is.”

MOD NOTE: Post edited to conform to the Community Guidelines.

2 Likes

Expecting a lot from the “Bic Disposable Lighter” of Cameras now aren’t you :thinking:

And as far as Wyze being a security company, I myself would not trust Wyze products for protection of life & property and if you read their Term of Service you will agree.

My property has a “Real” UL approved & listed security system and UL listed monitoring, has dual path communications so if internet fails it connects via cellular.

The Wyze security system is Not UL listed equipment, so it’s basically just a toy.

The cameras are good but have their issues and are good for monitoring an area, but really not true security cameras. My Wyze Cams supplement my other professional system that has several high end cameras in key locations.

Good Luck with your request to Wyze as 90% of most requests fall on deaf (V3) ears.

3 Likes

I think this quote is the gist of your post (besides the overall warning to other people).

I totally agree. Wyze should allow notifications for SD card removal and/or power restoration. [Technical Aside: True power loss notification is difficult because, ya know, the camera lost power and so it can’t send out a call for help. What it can do is maybe record a log of the power loss on its own internal memory and then share that on restoration or it could be setup to save a “Restart” flag if if ordered to power down and send a server ping only when the flag isn’t set]

But as far as security goes it gets even worse: Anyone who obtains a wifi signal jammer could activate the device, approach your cameras, take the microSD cards, unplug the cameras and then engage in whatever illegal or illicit activity they had intended to do so.

These are not very robust security devices, it’s just that simple. Any sophisticated criminal (or cop, in your case) is going to be able to pretty easily defeat the ‘security’ provided by the cameras.

I’m not sure if “Alert on SD Card Removal” is on the Wishlist but it should be. I’m pretty sure power loss is on the wishlist and I really hope they do some sort of implementation. I don’t think it needs to be sophisticated.

In any case, Wyze is a better-than-nothing security solution, imo. It helps with the vast majority of the issues that come up around our property (usually animals or meandering folks) but would not stop, deter or consistently detect a dedicated attacker.

That’s a much harder sell, though, “Buy our cheap cameras for moderately improved security prospects against unmotivated attackers.”

There is currently a Wishlist topic on this subject:

4 Likes

There shouldn’t be a wishlist on the topic, there needs to be a hot fix to the issue or new firmware drop correcting the problem. Either that, or take out the word security off of their equipment as this oversight is critical.
Aside from my situation, imagine if you’re trying to keep an eye on your troubled 16 year old kid. So this kid can simply take out the card, or just kill the power to it without the parent finding out as there is no alert made for this situation. The kid is able to throw a kegger house party for example. You’d never even know the card was removed, or power disrupted to the device let alone leaving you scratching your head on why is there data missing? And that is if you don’t get in trouble for overlooking the party while away and responsible for anything that goes wrong. Parent did take proper precautions in getting an indoor cam to avoid something like this from happening from the beginning and still is on the hook over this major flaw that’s on their wishlist?

That’s just unacceptable.

2 Likes

That is an oddly specific hypothetical situation there. I sort of want to get into that but why? If you know you have a “trouble 16 year old kid” and you need to use a camera to monitor them while on vacation because they are so untrustworthy just take the kid with you.

As for the security issue, this forum appears to be run by non-Wyze employees. If you want to flag the issue for them, I’m pretty sure you have to (a) use the wishlist to vote or (b) go talk to Wyze support.

I agree it is an oversight but it is hardly some sort of critical bug. If someone is willing to do that level of research to figure out how to covertly disable your cameras then you’ve got bigger problems. They’ll just steal the whole camera or find a way to disable your power or spray paint the lens.

Just trying to give you some perspective on the issue and how most of these security systems can be bypassed by a determined attacker (even good ol’ fashioned alarm companies).

1 Like

This isn’t a critical bug. It may lack a feature you’d like to have, but Wyze never advertised that as a capability or feature of these cameras.

If you’re needing something with that specific feature, you’ll likely need to research other cameras and buy ones that will provide that.

4 Likes

Wow, i never really thought about it… you are so right, plus not only paying for the cameras, but also all those subscriptions… yeah thats bad… heck i thought you were talking about the cops in FL… guess they are the same breed no matter where you go… as for bryonhu comment about you expecting too much from a “disposable lighter” of a camera… ignore them… your point wasnt really about the camera, but about the services and its related programming and triggers.
You raise a VERY important topic, something i never thought of. As for them not being able to get your data after that short of a time, i find that very strange… your paid service, i thought your data was held 30 days or more… go back and read the terms on whatever subscription you have, it has to state it there.

I know this is a temp solution, and doesnt address the fact they are already stolen, but maybe a bit of super-glue, yeah if the card goes back you are goign to have to work hard to get it out, but at least thate one less thing to worry about…
if you have the out door cameras, you have the base-station, on the outdoor cameras didnt you enable the “Back up to base station”?? i fyou did, you could pop the sd card out, put it in your computer and check out all the videos… just a thought, and good job on pointing out this important topic…

Where is this Wishlist voting place you speak of? i agree with the other person, it shouldn’t be a wish list, they should be adding features, not only does that make the system better, but its good marketing…
DeVoiD

I thought it was 14-days for Cam Plus?

Loki linked to the wishlist item above. (Thanks for the reminder, I need to vote for this too).

1 Like

Either way RobotNaught, its still way within the time frame… and so if they said they couldn’t retrieve the guys data, that wasnt true… or at least they couldn’t admit there was an issue and they didnt have the data…
something very fishy going on there!

didnt spot the link the first time. thanks.

DeVoiD

1 Like

Or they’ll wear a baseball cap and sunglasses and look right at the camera as they’re vandalizing, stealing, etc.

1 Like

The wishlist can be found here:

https://forums.wyze.com/search?q=%23wishlist%20%20

It can also be found in the menu:

1 Like

Simpler is better, eh? Good point, I’d never cut it as a criminal.

Right but there’s still a cool down between recordings for example, you record I think it’s like 40 seconds for free however with the cam plus crap it goes up to a 1:40 recording I believe And that recording will be held for x amount of time as promised supposedly.
Regardless, they’re still a cool down of when it could record again therefore rendering itself useless.

You’re right when it comes to the “Basic Plan” you just get snapshots. With Cam Plus Lite – you get 12 seconds of recording and then a 5-minute cool-down.

With the full Cam Plus, though, you get “back to back” recording with no cooldown and 14-days of cloud storage. Source

So… ugh, I wish Wyze spelled this all out more clearly on one page.

2 Likes

You could have a SD card in the camera to cover this time with continuous recording. I have high endurance cards in my cameras that are mounted in secure areas.

They have.

2 Likes

To the SD card reply, that’s the problem, I have SD card in most of my cameras,. The problem being is that SD cards were removed without my knowledge (stolen) without any help from the cam plus crap that I’m paying for. However, they need to implement SD card tampering and power loss to the camera as most manufactures have those features that’s called camera tampering detection. Wyze does not have that therefore someone can disconnect your SD card without you knowing, meanwhile it will continue to work just fine. They can cut the power to it and kill your family, cam plus wouldn’t help you, neither would wyze so they’re not as “wise” as they think they are.

1 Like

Not the point, I do have way better cameras however after my NVR started to act up and have been too busy to get it back online, I’ve intrusted wyze and their so called security systems. After all, they do advertise themselves as a security camera system, especially when connected to your wyze home security kit with a hub, keypad not to mention sensors of all kinds. If the company can’t back track the data from just 3-days ago to which they advertise cam plus can hold 14-days continues on events, it’s odd they were not able to narrow down on when the SD cards were removed, it sure as hell didn’t display it when I was watching the footage from that day from the clips as there was large junks missing, and no SD card to fall back on…
Point being, if you’re going to pop in your SD card to protect you in case the plus plan can’t protect you, place a tamper proof alert of some sort to fix that issue, no come up with excuses or simply brush me off to another manufacture as WYZE ADVERTISES AS A SECURITY CAMERA SYSTEM!. Now if they failed to secure my data and stolen property, the word “security” needs to be not mentioned during their point of sale. Plain and simple.

I agree with you and I have voted for the addition of a feature to be notified when the SD Cards have been removed or the cam goes offline for any reason. These are good security features to have within the platform.

However I am confused. If you are paying for CamPlus, as I am, how is there not 14 days of history in your Events Tab? I have CamPlus on every one of my cams recording ALL motion events. I only have notifications set for AI events. I have a full 14 day history of thousands of full length clips of trees blowing, shadows dancing, and cars zipping around. And I have the sensitivity set fairly high. All I have to do is filter the Events tab to see them. If anyone or anything even steps a foot into frame, the full length event clip goes to the cloud before they ever get near the cam.

While the cams do increase the Protective Posture of your property, they are only one layer in the total security plan. They are a first alert layer and a monitoring layer that can record activity. They will not stop anyone from doing harm nor will they call for help unless you are using CamPlus Pro. This is why I have opted for the Home Monitoring System with Professional Monitoring plugged into a UPS along with my ISP Gateway and WiFi for power failure redundancy.

2 Likes