Earlier today, I was viewing my Wyze Pan cam using the iOS app (V2.0.21). Suddenly, a female voice emerged from the iPhone’s speaker: “Hello”, she said.
This is exceedingly odd. The Sound for the camera was turned off. The camera is upstairs, and there was no one in the house who could have said ‘hello’ to it.
There are two plausible scenarios that I can think of:
somebody with a Wyze cam was using their Wyze app to connect to their Wyze camera. They tapped the Speak button to activate their smartphone’s microphone, and said “hello”. Instead of routing the digitized audio stream to their Wyze cam’s loudspeaker, the Wyze server mistakenly routed the audio “Hello” to my app.
somebody with a Wyze cam was using their Wyze app to connect to their Wyze cam. They tapped the Sound button to activate their Wyze cam’s microphone. They (or another person near the camera) said “Hello”. The Wyze cam’s microphone captured that utterance, sent it to the Wyze server, which then mistakenly transmitted the digitized audio to the Wyze app on my phone.
A third scenario is that hackers or NSA snoopers have accessed the Wyze server complex, and are sending random hellos to Wyze apps across the internet.
Whatever caused this audio to emerge from my Wyze app, it is deeply disturbing, and indicative of potential privacy and security breaches. If other people’s audio streams can be mistakenly transmitted to random Wyze customers, the same thing might happen to video. Caveat emptor.
Hi, did you mean the sound was off like in the picture and your heard ‘Hello’ voice? That is really odd.
If the sound is off, it should not output sound at all. I can’t think of a way except a bug for sound to come out when sound is off. So far I haven’t heard about a bug about it.
Our connection is P2P between your camera and phone. It is hard to ‘inject’ any sound in between. Also the timing is too accurate for it to come out.
Do you have an SD card on your camera? Did it happen to record video for the specific moment? If you have the video, I suggest you check the video first to see what was recorded.
Do you think you have a strong Wyze account password? If someones gets your account password he can view your cameras. Even with that I can’t think of a way in the app to say ‘Hello’ to your phone. It is a puzzle.
Anyhow, I suggest you change your password to make sure you are the only one with the password. If you hear any strange sound again. Please let us know and send us an app log. At least we can check if the sound is turned on or not. Thanks!
Yes, the sound was OFF. There was an X next to the loudspeaker icon. I never use sound.
“Also the timing is too accurate for it to come out”. I don’t understand what you mean. All I can tell you is that a female voice saying “Hello” came out of the iPhone speaker spontaneously, while I was viewing the Wyze cam.
There is no SD card in the camera.
My Wyze password was reasonably strong. I practice good password hygiene. I keep all my passwords in LastPass (which has an extremely long password protecting it). I don’t re-use any passwords. I had not shared my Wyze credentials with anyone. Regardless, I’ve now changed my Wyze password, so it is even stronger than before.
On the topic of passwords, how do you store them in your system? Are they first salted and then hashed? Are you using SHA-256 for the hashing?
And even if my account credentials had been compromised, how do you suggest that they could inject audio into the app? If someone obtained access to my Wyze account, they could view the video from the camera. They could turn on Sound and listen to audio picked up by the camera’s microphone. I don’t understand how they might send audio to your app. What is the use case that you are proposing would have been used by such an intruder??
The sound that came out of the Wyze app while I was viewing my pan camera was very clear and distinct: a female voice saying “Hello”. My wife heard it, and came over to ask me who I was talking to.
The quality of the “hello” was quite decent. It was not reverberant, as it would usually be if it had been picked up by a Wyzecam microphone (far-field). It sounded more as if it was captured near-field (i.e., the talker speaking into a smartphone microphone at arm’s length).
It wasn’t the voice of Siri. I know her well!
I thought that maybe the “hello” was an iPhone bug. Perhaps an incoming cellular phone call had been connected (without any ringtone, and without me answering the call), and the caller was saying “Hello”. However, there is no record of any incoming calls in the iPhone’s call log, so I don’t think this event can be blamed on iOS:-(
No doubt you’re aware of the recently reported bug with group FaceTime. Everything I read about that defect was that an intruder could gain access to the iPhone’s microphone and eavesdrop. I read nothing suggesting that a remote intruder could inject FaceTime audio into the iPhone’s loudspeaker.
It is indeed a puzzle, which is why I report it here.
As I understand it, the iOS FaceTime bug created a 2-way audio call. You could listen in on their audio, but they could also hear you. The nature of the bug was that it created a “regular” audio call whilst leaving the display in a “ringing” state.
I wonder if someone may have called you, but somehow the Wyze app blocked display of the ringing state.
In any case, the FaceTime bug has been patched, so if that was it, should not be an issue going forward as long as you updated iOS.
Other than that, it sure seems more likely to me that it was some other app possibly running in the background that produced the audio.
Yes, each user’s password is salted and hashed. Wyze can’t see your password. Nor could others.
My comment about ‘accurate timing’ was regarding the ‘Hello’ word came out right at the time you are watching live view. If that is true, someone (or some machine) needs to monitor your connections.
I can’t think of a way that someone can ‘inject’ sound to your live stream. My hacking knowledge is very limited since I have never been into a hacker’s world myself. The only possibility for Wyze app is a bug which allows sound coming out. But that should only be the sound from camera microphone. No injected sound!
@WyzeTao
I have another puzzle piece for you to consider.
Prior to getting the pan cam, I bought a V2. After getting it, like any new user I downloaded the app, created a Wyze account, and activated the V2 (this was nearly a year ago).
Last week, I gave the V2 to my son. I deleted the V2 from the Product list in the iOS app on my iPhone. It has since been registered to a new account, on a new instance of the app, on an Android phone, in a different city, on a different WiFi network.
It occurs to me that even though I deleted the V2 from my app, there might still be some remnants of its identity remaining in the app. Perhaps its identity info (its MAC?, its unique Wyze ID?) is cached somewhere, either in the app or in your server. Perhaps its ‘slot’ in the list of my Products isn’t really erased when I deleted it. As you well know, when one ‘deletes’ a file on Windows, the contents of the file aren’t really erased. A pointer in the directory table gets changed and the block allocation table gets updated, but all the file contents (and most of the file metadata) remain on the hard drive. Perhaps you doing something similar when you ‘delete’ a camera from the app.
If that’s the case, is there any possibility that my Wyze app might have reached out to my old V2 camera and been able to obtain a snippet of audio from it, even though the camera is now registered with a different account (on a different network, in a different city)??
As you can see, I am grasping at straws, but this scenario might be plausible. Stranger things have happened with software. The female voice that I heard might have been my son’s girlfriend saying “Hello” to what is now his camera.
Let me know what you think. Does it help with the puzzle?
I will defer to whatever Tao has to say, but I think this very unlikely because:
When the camera is set up on a new account, the link to the old account is completely severed on the server side, and
Even if there were audio coming from another camera you still owned, while viewing a different camera, there should be no way for the audio from camera#2 to be played on the app. Audio is one camera at a time.
I agree it’s unlikely, but software is never free of defects. By design, there ‘should’ be no way for audio coming from the other camera to be played on my app. But if the old device links had not been completely severed on the server and/or deleted on the app, it’s plausible that the virtual wires got crossed. I wanted to share the existence of my old camera with Tao so he will be able to do a little outside-the-box thinking. It may be a red herring; it might help uncover what would be an insidious bug lurking in the Wyze architecture.
We have handled the case for transferring devices. Once your device is setup by another account you will not be able to connect to the device for live view, playback, and event info. Our cloud owns the device-user association which will guarantee the logic. We haven’t heard about a case about it,
On your phone, there is a possibility of some local files or cache files exist there. For example, all the pictures & videos taking from you in the past should still exist. There could be cache files on your phone for some device thumbnails. However the cache files will be not shown anywhere in our app.
It is highly unlikely the ‘Hello’ voice comes from your previous v2 device. I can’t think of a way that will connect the two devices together. If you think it could be your son’s girlfriend the easiest is to ask if she ever did that at the specific time. I would be super surprised if that were true. If we know a case that we may mix up devices, we will deal with the issue immediately. Thanks!
@WyzeTao
I have contacted my son. At the time of the incursion, both he and his girlfriend were at work. Neither were using the Wyze app to connect to the camera, and there was no one at home in earshot of the Wyzecam’s microphone. So my hypothesis that perhaps my old cam was still somehow linked to my account and/or my Wyze app was not well founded.
The root cause of this privacy/security breach remains unknown.
I’ve had some very odd issues with my Pan Cam that I’ve sent in questions about too. My first incidents were that I would set the Pan Cam to view a particular area and I would check on it a few days later and it had set itself back to the home position. This happens frequently and randomly, the cam has never been unplugged and there isn’t anything ticked or unticked in the app that would cause this.
I also had a problem with having turned the camera off, I could still hear the night vision LED’s clicking on and off when the camera was supposed to be turned off.
My third problem has been that even though the camera has been turned off and the app says it’s off and there is nothing showing in the view of the camera, if I go to my TinyCam Pro app in my FireTV and open that cam, it’s showing a real time video stream from that camera. That is an awful lot of unnerving incidents, that to this day Wyze support has failed to answer.
Same here, only(?) for my Pan Cam, not the 2 stationary ones. I’ll check it a few times per day and often, if i"m home and had turned it off via the WyzeCam app, it’s back on OR if it’s off there, I can still view it in TinyCam (Android)… so calling it “off” is a bit misleading to say the least.
Other issue with the Pan Cam… audio come in as phone audio, not normal media audio. It turns audio from other apps into low bandwidth mono sound, so EVERYHTING sounds crappy not just the camera mic. The v2 stationary cams do not do this, they use normal media sound in Android.
I have definitely hit issues on my (Android) phone where a browser ad or a buggy native app (e.g. the NPR One player) will randomly play a snippet of audio suddenly while in the background. I wouldn’t be at all surprised if that was what happened on your phone, rather than a problem with the Wyze app…
I don’t have an Android device. In many years of using iPhones, I’ve never encountered a instance where an app in the background played out unintended audio to the speaker. There are a few apps that are permitted to access the speaker when in the background, but most get muted by iOS when relegated to background. I’ve done a lot of testing since the intrusion I reported and haven’t identified any culprits. I didn’t have any podcast, radio, or similar apps running. Nor Safari pages open that might have said “Hello”. Nor any messaging apps.
It’s certainly possible that a bad app, coupled with an iOS bug, was responsible. But given the inherent functionality of the Wyze app (audio input, audio output, push-to-talk, remote connectivity across the internet to audio I/O devices), it seems to me that it’s more likely to be a Wyze issue. Unless it happens again, and I can capture some network traces, I’ll probably never know.
It has been discussed in another thread(s) that Wyze Pan handles two-way audio by initiating a fake phone call. Usually this phone call is identified with your own number, i.e. Wyze app is trying to call yourself. This is very obvious if phone is connected to a car head unit through Bluetooth, and then initiate a live view.
I think, maybe it is possible somehow, the fake phone call actually become dialing another number. And the call got answered by another person.
Wyze has promised to fix this problem 8 months ago. But problem is still there.
Several notes:
The v2 stationary cams do not do this, they use normal media sound in Android.