UPDATE YOUR FIRMWARE - Wyze Cam flaw lets hackers remotely access your saved videos ( * if they can gain access to your local network/WiFi )

[udon]

I too am done with WYZE.
So many posts here regarding issues and Wyze says nothing 99% of the time but this one is a HUGE deal breaker.
They are complicit in their silence.
1st they start taking away original included selling points to their cameras & locking it behind a paywall and now this?
F em…

[peepeep]

@mike21

Part of the problem is when general publication “news” entities convert CVEs to English, using words like “huge” vulnerability. If the average user saw what a daily security log looked like, they’d unplug everything in their house and wear a tinfoil hat.

@mike21

Now, I’m confused some by bitdefenders mitigation; “Home users should keep a close eye on IoT devices and isolate them as much as possible from the local or guest network…” Huh?, that solves the issue how?

@mike21

The problem with these “huge” vulnerability CVEs is they cause panic; look at some of the responses to this. In reality, I could craft a wonderful email, phish it out to just 100 typical users and probably have access to a half dozen home networks in a matter of minutes, without leaving my chair. This camera attack assumes having the keys to the kingdom. The cams are the least of your problems…

It’s nearly impossible for someone who’s not a competent pro to determine if the flaw presented here was/is significant enough to qualify as a THREAT.

It’s just multiple layers of partial comprehension. Nothing.

So you’re left hoping you know a pro you can trust.

They exist and are active on this forum.

So good.

[themdg]

So much “fear itself” going on in here. Remember that those “tech websites” are looking for your clicks. They’d lose money if they reported “Obscure Wyze vulnerability took a long time to fix, but affected pretty much no one, and we couldn’t reproduce the hack.” Instead they put a bunch of “should have” and “hackers may have been able to…” and “all your logs are belong to us” and “rEm0Te hACkeRs!!!” and “didn’t fix within 90 days” (as if that’s some law or something). I don’t think you’ll hurt any feelings if you need to change companies, but don’t think that every single tech company doesn’t look at their backlog of bugs, features, risks, etc, and set priorities based on their own business criteria. That’s azackly what is (and should be) going on at Wyze, at Ring, at Nest, at everywhere.

[stickman]

People are upset because there are privacy and security implications. There is also the possibility that breach and responsible disclosure laws may have been violated depending on where you live.

[peepeep]

@themdg

I don’t think you’ll hurt any feelings if you need to change companies, but don’t think that every single tech company doesn’t look at their backlog of bugs, features, risks, etc, and set priorities based on their own business criteria. That’s azackly what is (and should be) going on at Wyze, at Ring, at Nest, at everywhere.

@themdg

the perfect place for ragethreats and ragequits.

Did you coin these? Gotta love 'em.

[udon]

Got to love people complaining about other people complaining.
Irony sometimes writes itself

[Baldeagle69]

We’ll said, sir!

[peepeep]

Does turtles all the way down work here? Prob’ly not.

[kboggs1]

https://9to5mac.com/2022/03/31/wyze-cam-security-flaw/
Wow! Amazing how long it took Wyze to patch this.

[peepeep]

IMPORTANT: Terms of Service and Security Updates - 1/6/22

You know, Wyze execs, if you had actually answered these questions when I posed them in January, you could have saved yourselves all the current bad press you’re getting about the patched (and almost entirely benign!) SD card web server security flaw. It’s not the crime; it’s the coverup.

[emonte4]

I’m done with Wyze

This article is scary to read. Should I just turn to Ring??

[Antonius]

We don’t care

[stickman]

Well, it happens a lot more than you think and in some much more damaging circumstances. There’s no 90 day rule or anything.

Actually, depending on where you live, there are actually breach notification and responsible disclosure laws. For example, in California, you have to notify if access “was acquired, or reasonably believed to have been acquired”. Most of these notification laws do have time windows.

[Known1]

This article is the most thorough one I’ve read yet when it comes to this matter.

https://www.reviewgeek.com/113800/wyze-left-some-security-cameras-vulnerable-to-hackers-but-its-complicated/

[HoZr]

For all the “Security Pros” saying it’s not a big deal correct; it’s not from a tech standpoint. It’s a HUGE F’ing deal from an ethics standpoint. When you trust your safety and security (Home Monitoring, indoor cameras) to a company you expect and deserve to have them act ethically.

WYZE did not. Not by a long shot. Heads should roll.

I’ll wait for the $3 class action check in 5 years.

[quard]

Wyze continued to sell these cameras and do nothing to fix the security hole in ** 3 YEARS ** on a security product. And they still left the v1 cams vulnerable.

This means Wyze is clearly NOT a company to trust with ANYTHING let alone security cameras in your home or businesses.

There’s beyond no excuse for this reprehensible behavior - they’re toast in my eyes and I will NOT support in any way this company with my money. I have 1 v1 and 2 V2 cams - the v1’s I will wait to see if they ever recall them and refund us but I WILL NOT trust any of these cams for my security needs. The V2’s I have I will apply the webcam firmware and use them as backup webcams for my videos while I go with another company for security cams, one with a better reputation than Wyze (which isn’t hard they have no reputation now).

[peepeep]

Wow, you’ve been around since the company’s inception. Were you satisfied up 'til now?

[Known1]

@quard

Wyze continued to sell these cameras and do nothing to fix the security hole in ** 3 YEARS ** on a security product. And they still left the v1 cams vulnerable.

Hmm, I became a customer in mid to late 2018 and the v1’s were not available at that time. It would be VERY bad for WYZE if they were still selling v1’s this entire time while knowing of these vulnerabilities and the end-of-life date. However, from what I can tell that is not the case.

I am extremely concerned with how WYZE handled this situation. As mentioned in a previous post, I’m now most concerned with the potential that other vulnerabilities were reported to WYZE by Bitdefender, but since they haven’t been patched nobody is reporting on those vulnerabilities.

There is plenty to be concerned about without making things up or exaggerating reality. Maybe I am wrong and the v1’s were being sold up until the end-of-life announcement?

[Rareapple3]

I think Wyze should release a statement on their media platforms other than what they said in the news articles. The issue was not as bad as a lot of people think it was. That said I would like to know why they took so long to at least acknowledge it. It seems that they might have favored getting new products launched then patching them.

[chriswkbrd]

I agree that they should release a statement, and that it’s not as bad as it appears. What I have an issue with is the three yrs it took to patch v2 & v3, yet v1 just reached EOL last month, but no patch.