My Live Web View is SOMEONE ELSES HOUSE!

[carverofchoice]

@pdannolfo

2022 Wyze Cam security flaw gave hackers access to video for 3 yrs - 9to5Mac

FYI, This article is misleading and false on many levels. That issue did NOT allow “hackers” to remotely view the camera. Video could only be accessed by someone who was logged on to the local network (Router/WiFi). So there was actually little to no risk of anything and a lot sites were misrepresenting the truth because clickbait sells. I was actually extremely disappointed that Wyze “Fixed” this issue, because it has always been one of the most popular requests people have been asking Wyze to do ON PURPOSE for years now…then we suddenly found out it was possible and taken away from us in one fell swoop. My reaction to this “vulnerability” was as follows:

@carverofchoice

I’m devastated to learn recently from recent articles and an announcement from Wyze that this 8th most requested wishlist item/feature has been possible for the last several years, and has only recently been disabled on all but the V1 cam now.

For the last several years there has actually been a way to access our camera SD card files on our secure networks. None of us knew this existed, and recent complaints made this feature get disabled on all but the V1 cams now.

A few quick points: It could only be accessed on your private secure network, so no outside hackers or strangers could ever access it. It was only accessible by anyone with permission to be on the secure network, and you could browse and download the files from the SD card exactly like we’ve all been requesting for YEARS now.

I wish Wyze hadn’t “fixed” that feature. Now I want some V1 cams if they still have this feature enabled.

With all the dishonest fearmongering going on about this for sensationalism clickbait and ratings, I expect Wyze will be weary about looking into activating this again any time soon now, and I can’t say I blame them…thanks a lot to the media for their lies about the non-risk. Why couldn’t the media have been honest that only people with access to the secure network could ever access anything anyway, just like we’ve been asking for.

The only problem with this issue was that Wyze didn’t tell people for a long time and then “fixed” it. I personally wish it was never “fixed” and was just treated as a Network drive. Nobody gets on my WiFi without permission anyway, and I have a guest network with Device isolation anyway to keep guests out of anything important.

Point is, the second “issue” shouldn’t actually be considered a security issue IMO since it didn’t actually allow any remote access as sites falsely kept misrepresenting for clickbait purposes. Some of them even made corrections later, but 9-5Mac is obviously not one of them.

So far I’d say Wyze’s major issues are:

• Data security breach
• Taking a long time to tell us about the local SD card access (not really an issue that it existed though)
• Caching issue that leaked cache thumbnails, etc for 10 customers. Thankfully nothing compromising for any of them as far as I’ve seen so far, but still something that should’ve never happened. I think Wyze’s response was fairly reasonable (they shut it down within 30 minutes, fixed the global caching issue and explained what the problem was.

Steam had a very similar caching mistake, though they are bigger and theirs lasted for 90 min. So props to Wyze for responding in 1/3 of the time. I am not totally sure which was worse though…Steam leaked payment information for TONS of customers, and Wyze leaked some thumbnails for 10 customers. I think Wyze lucked out that none of the images were compromising.
Hopefully people think twice about where they allow internet cameras from ANY COMPANY to be (avoid bedrooms, or privacy critical areas). and hopefully companies figure out how to make sure their website caches never accidentally switch to “Global” caching again.