02-13-20 update Thank you all for your patience. We have been working diligently to make progress on security improvements. At Wyze, we take data protection, and our customers’ trust in us to protect their data, very seriously. We appreciate your efforts to ensure consumer security and we share your commitment to data privacy and security. Please note the status of these action items we have addressed: Action Item Status Update/Note Initial cyber investigation Completed We have completed the initial investigation on how the leak happened and have taken internal measures to secure our servers and databases. We have confirmed the leak contained no passwords, government-regulated personal, or financial information, or video files. Revisiting security settings for each Wyze server Completed We have completed the investigation on how the leak happened and have taken internal measures to secure our servers and databases. Reviewing our internal security policies and practices Completed We have added operational measures following our initial investigation. This will be an ongoing effort. Improving security processes, data security, tools, and training across Wyze Completed Implemented security processes like Single Sign-On onboarding and additional steps highlighted through our initial security investigations. This will be an ongoing effort. Submission method for vulnerability reports Completed We have added a submission tool for collecting reports of security vulnerabilities through our website at: Report Suspicious Activities. Security assessments and audits by 3rd party security company In-Progress We have completed our internal data security checks and have selected an independent company to conduct the audit for validating our security and privacy environments. Penetration tests by independent security companies In-Progress We have selected an independent company to conduct authorized penetration tests. These tests use simulated cyber attacks to evaluate the effectiveness of our security system. Adding the ability to change account email addresses Completed Feature development is currently in requirements phase, we are working on scoping and development between app and cloud developers and data architects. Other methods for multi-factor authentication besides SMS (including an authenticator app) Completed Feature development is currently in the design phase. We are now implementing the authenticator app method as part of future app release. Multi-factor authentication to Wyze websites Completed Feature development is currently in the design phase. We will implement the authenticator method as part of future web updates. We’ll continue to post updates and keep you informed on progress made. 01-06-20 update Hi everyone, We have completed the initial steps of the internal investigation and are continuing through the process. We wanted to fill you in on what we’re doing in response to the data leak. Data security will be our top priority over the next few months. Because of that, we will be adjusting our previously expected feature and product roadmap. Here are tasks we are working on internally with the goal of completion over the next few months: Independent cyber investigation (investigating how this leak occurred) Security assessments and audits by 3rd party security companies (validating our security and privacy environments) Penetration tests by independent security companies (authorized simulated cyber attacks to evaluate the effectiveness of our security system) Revisiting security settings for each Wyze server Reviewing our internal security policies and practices Improving security processes, tools, and training across Wyze This is the beginning of our checklist that we are going to be accountable for and we are open to feedback for items to add to this list. We are also adding multiple public-facing features that will improve security for our customers in the coming months. We’re in the beginning stages of research for some of these and several will likely take significant changes to our back-end systems. This makes it difficult to give estimated timelines for these high-priority projects. We are continuing to take note of all of the security features you are requesting in the comments and in our Wishlist. Here is the list of features we have prioritized and started researching right now: Adding the ability to change account email addresses Other methods for multi-factor authentication besides SMS (including an authenticator app) Multi-factor authentication to Wyze websites Adding a website that will make learning about Wyze security easier and provide a dedicated channel for reporting any potential issues We welcome further suggestions through the Wishlist. We’ll evaluate this feedback in concert with the recommendations from the security companies we are working with. Our goal is to take steps in the correct order to improve your security. Thank you for all of your comments so far and we’ll add another update when we have more to report. Moderator Note: The #wishlist topics for the first three bullet points above can be found at the following links. Please vote and/or comment there. Ability to Change Email Address Add authenticator app(s) for 2 Factor Authentication (2FA) Two-Factor Authentication (2FA) for Wyze Web Account 12-30-19 update Hello again, We have started sending out the email about the data leak to all customers. If you don’t see it now, it should arrive later due to the batching process. Thank you for your patience while we worked through the logistics of this process. Other things that we are currently working on include enhancing our security processes, improving communication of security guidelines to all Wyze employees, and making more of our user-requested security features our top priority for the coming months. We are also partnering with a third-party cyber security firm to audit and improve our security protocols. We have not yet completed our investigation but would like to take the opportunity to answer some questions we have received from the community. Q&A Updates What data was exposed? Our investigation is still in process but we have confirmed the information contained Wyze nicknames (the optional name change in the Account section of the Wyze app), Wyze device names, user emails, profile photos, WiFi router names, and some Alexa integration tokens. We refreshed the Alexa tokens so please re-link your Alexa skill if you have not done so yet. We also refreshed the tokens for The Google Assistant and IFTTT. The information did not contain passwords, personal financial data, or video files. Who was affected by the breach? All users that created an account prior to December 26th, 2019. Why was there a delay in informing affected customers by email? We wanted to make sure we locked the door before telling everyone it was open. The delay helped reduce the risk of additional parties finding the leak until we locked things down. We waited to send out an email to the entire Wyze community until we could verify exactly how the data was accessed and could say definitively that no more records were exposed. Also, there are also logistic problems involved with sending so many emails at once that we normally do not encounter. Usually, we only send mass emails to a significantly smaller number of newsletter subscribers. Are you using data security professionals to investigate this? Devs and executives don’t count. Yes, we are. How does Wyze protect customer information overseas? Wyze is headquartered in Seattle, Washington. The majority of our developers, engineers, and employees are here. We also have a Beijing office which has a team of developers, hardware quality assurance people, and product managers but we do not do any business with China’s markets or government. Our servers are set up so that the production servers (along with the exposed servers and any server that contains customer information) are set up in US-based AWS servers. In China, our Beijing developers use a separate test server which allows them to help test and develop products. These servers are hosted on AWS servers in China and do not contain customer information. Why did users using two-factor authentication (2FA) receive verification texts from multiple phone numbers? On December 26th, we expanded our 2FA SMS sending line to multiple lines to help accommodate the volume of requests. What are we doing about international customers using two-factor authentication (2FA)? Our 2FA method does not function for many of our international customers due to the differences between phone numbers. We are investigating methods to make this available internationally, but it will require infrastructure changes so we cannot promise an immediate release. 12-29-19 update Hello everyone, We wanted to give you all an update on the ongoing investigation into the data leak that was reported on 12/26/19. We have been auditing all of our servers and databases since then and have discovered an additional database that was left unprotected. This was not a production database and we can confirm that passwords and personal financial data were not included in this database. We are still working through what additional information was leaked as well as the circumstances that caused that leak. We want to thank the Wyze community member who contacted us privately about this shortly after our 12/27 update. Their assistance helped us address this vulnerability quickly that evening. We are working on an email notification to all affected customers and plan to release it in the near future. To balance thoroughness and speed, we will be sending the information that we have on hand and will provide further updates as we continue forward with our investigation. Again, we are deeply sorry for this situation. Thank you for your patience as we work through this process. We have been reading through everyone’s comments and are continuing to work together on methods to improve our security and ensure that similar occurrences never happen again. 12-27-19 update On December 26th at around 10:00 AM, we received a report of a data leak. We immediately restricted database access and began an investigation. Today, we are confirming that some Wyze user data was not properly secured and left exposed from December 4th to December 26th. We don’t have all the answers yet, but we wanted to provide an update based on our investigations so far. We will be providing a detailed follow-up once we complete our investigation. To help manage the extremely fast growth of Wyze, we recently initiated a new internal project to find better ways to measure basic business metrics like device activations, failed connection rates, etc. We copied some data from our main production servers and put it into a more flexible database that is easier to query. This new data table was protected when it was originally created. However, a mistake was made by a Wyze employee on December 4th when they were using this database and the previous security protocols for this data were removed. We are still looking into this event to figure out why and how this happened. The vulnerability started December 4th and did not involve any of our production data tables. While significant, this database only contained a subset of data. It did not contain user passwords or government-regulated personal or financial information. It did contain customer emails along with camera nicknames, WiFi SSIDs, Wyze device information, body metrics for a small number of product beta testers, and limited tokens associated with Alexa integrations. There is no evidence that API tokens for iOS and Android were exposed, but we decided to refresh them as we started our investigation as a precautionary measure. Yesterday evening, we forced all Wyze users to log back into their Wyze account to generate new tokens. We also unlinked all 3rd party integrations which caused users to relink integrations with Alexa, The Google Assistant, and IFTTT to regain functionality of these services. As an additional step, we are taking action to improve camera security which will cause your camera to reboot in the coming days. Several of the things that have been reported are not true. We do not send data to Alibaba Cloud. We don’t collect information about bone density and daily protein intake even from the products that are currently in beta testing. We did not have a similar breach 6 months ago. We’ve often heard people say, “You pay for what you get,” assuming Wyze products are less secure because they are less expensive. This is not true. We’ve always taken security very seriously, and we’re devastated that we let our users down like this. This is a clear signal that we need to totally revisit all Wyze security guidelines in all aspects, better communicate those protocols to Wyze employees, and bump up priority for user-requested security features beyond 2-factor authentication. For now, we’ll say that we are very sorry for this oversight and we promise to learn from this mistake to make improvements going forward. We’ll continue to update you as we make progress. FAQ How does this impact me and what do I do next? A 3rd party may have your email address. Be aware of spam or a phishing attempt. We’ve logged you out of your Wyze account. You will need to log back in and relink your Alexa, Google Assistant, or IFTTT integrations if you use these services and haven’t done so yet. Why did you have a second version of your database? We created this subset of user information in order to perform queries (e.g., number of connected devices, connectivity errors, etc.). Queries such as these are expensive in terms of computer resources and they would have impacted your product experience significantly. For that reason, we created a separate database specifically for processing those heavier requests. What have you done with the exposed database? We locked down the database in question before we were able to verify it was exposed. We did this as a precaution because the published article referenced a database connected to “Elasticsearch”: a search tool that we also used on our query database. It was mentioned that height, weight, gender, bone density, bone mass, daily protein intake, and other health information were leaked. How was this information obtained and who did this affect? Wyze was beta testing new hardware and some of this information was in the database. We had this information for about 140 external beta testers. We have never collected bone density and daily protein intake and we wish our scale was that cool. Did Wyze know about this before the article was published and was there a reasonable effort made to contact Wyze so the Wyze team could fix any issues before anything was published? We were first contacted through a support ticket at 9:21 a.m. on December 26 by a reporter at IPVM.com. The article was published almost immediately after (Published to Twitter at 9:35 a.m.). It was published in conjunction with a blog post from a private security company also published on December 26th. We were made aware of this article at ~10:00 a.m. from a community member who had read the article. As soon as we were aware we took the actions mentioned in our forum post to secure user data. Original 12-26-19 post What happened? Wyze received a support ticket at 9:21 a.m. Pacific from IPVM about an article they posted about a “massive data breach.” Said article was based on another article published by an anonymous author on the Twelve Security blog, a security consulting company in TX. Wyze became aware of the article around 10:00 a.m. Pacific. [image] Wyze Massive Data Leak Wyze has exposed millions of user's data, as reported by Twelve Security, and confirmed by IPVM, who has spoken with Twelve Security and reviewed the records. What data was said to have been exposed? As of yet, we have not been able to confirm a breach of any kind. It is stated by the articles published that the following data was exposed: User name and email of those who purchased cameras and then connected them to their home Email of any user they ever shared camera access with such as a family member List of all cameras in the home, nicknames for each camera, device model and firmware WiFi SSID, internal subnet layout, last on time for cameras, last login time from app, last logout time from app API Token for access to user account from any iOS or Android device Alexa Tokens for 24,000 users who have connected Alexa devices to their Wyze camera Height, Weight, Gender, Bone Density, Bone Mass, Daily Protein Intake, and other health information for a subset of users Password information was not included in the article about the alleged compromise. What is Wyze doing about it? Immediately upon hearing about a potential breach, Wyze mobilized the appropriate developers and executives (CEO and CPO) to address the allegations. Wyze then attempted to verify the breach. After unsuccessfully trying to verify the breach, at 1:29 p.m., Wyze added another level of protection to our system databases (adjusted several permission rules and added a precaution to only allow certain whitelisted IPs access databases). Wyze also pushed a token refresh to all Wyze users. This means that all Wyze user accounts were logged out and forced to log in again (as a precaution in case user tokens were compromised as alleged in the blog post). Users will also need to relink integrations with The Google Assistant, Alexa, and IFTTT. These precautions began implementation at 1:29 p.m. Refreshing tokens for the entire Wyze userbase is a process that takes time but this and the above processes were completed around 4:30 p.m. Pacific. As of 5:00 p.m. Pacific, we received word that our 2FA servers have been overloaded by requests and people may have trouble logging in until later. We are working on resolving this issue now. [Edit to say that this was resolved as of 9:00 p.m. Pacific.] At around 2:30 p.m. Pacific, Wyze attempted to contact the author of the Twelve Security post directly via phone and we received a message that said the number does not accept inbound calls. Wyze then sent an email to Twelve Security at the publicly listed email address. Wyze is continuing to investigate these claims and will post more information at [Updated 02-13-20] Data leak 12-26-2019 as it becomes available. What actions should users take? For now, we have yet to verify a breach. Users can further secure their accounts by changing their passwords and implementing two-factor authentication in the Wyze app (https://support.wyzecam.com/hc/en-us/articles/360024402052-Two-Factor-Authentication). We will post additional information in the Wyze Forum as it becomes available. Please direct any questions to security@wyze.com or comment on the post in the Wyze forum. How did this happen? We are unsure if it did happen. We are taking this very seriously and investigating the claims. Is there validity to the claim that Wyze is sending user data to China? Wyze does not use Alibaba Cloud. The claim made in the article that we do is false. Wyze does have official Wyze employees and manufacturing partners in China, but Wyze does not share user data with any government agencies in China or any other country. Update for the two-factor authentication issue: 12/26/19 9:00 PM PT - We apologize for the delay and appreciate your patience with the difficulty using two-factor authentication. Adjustments to our 2FA service have been made and people running into the invalid phone number error should be able to log into the Wyze app now. If you are still having trouble logging into your app, please contact our customer support team. Wyze Customer Support

What problem are you running into when you try to log in? I believe the 2-factor authentication outage has been fixed now.

Yes my folks only wyze cam that i setup in thier garage so that they can see if they closed the doors, is using the RTSP firmware. They reported that it had no issues all during this event. only the app on thier phone wuld not work. And I also see lots of whining about how how pissed off some users are getting about the inconvenience of being locked out of their app for a while. You realize this is a cheapo $20 cam and free service right? this is NOT some $300+ cam (each) plus expensive monthly could storage fee based device/service. This little cams i do not expect or treat them as proper “security” cams and should not be relied solely on for security if you are away or for any reason as such and have 100% reliability. I have a hardwired Ubiquiti UniFi IP cam setup in my small apartment, and a full on Swann CCTV with local DVR setup and my grandparents home. Local server.storage, with optional remote access that I control locally, no shaddy cloud servers etc. its direct ip to p2p connection. You get some very good value for the cost of these cams and plugs, but, i for one do not subscribe to the idea of getting 100% reliability out of them or the cloud service, for such a low cost device. That being said, for me personally, I have only ever had minor short issues with their products/service. And a reason for a outage or glitch, being a security measure taken in response to a possible security breach, is very much acceptable to me. The email and info i used on such devices are junk emails that i do not use for anything else. It is pretty foolish to use your real email and same password etc for things that are easy to hack/compromise. I still don’t see any updates to as if this breach was actually legit or not.

I got in. All looks normal and working properly. All event-triggered 12 second clip and MicroSD card data are intact. Now I will change my password.

[image] SpeedingCheetah: i for one do not subscribe to the idea of getting 100% reliability Are OK with your plugs not working on Saturdays? Are you OK with your plugs turning on 30 minutes late? It doesn’t really matter whether it costs $20 or $200, they promised those features, so you expect them, sounds fair?

what do you mean by re learn for Google echo? it shows up in Alexa… do I have to delete and re add? ur kidding right

Yes and that is why they are cheap. To properly do rtsp and not rely on the cloud they need to run a small web server. That was kinda the point of the parts you omitted from the quote.

And you didn’t get my response. The cameras are already streaming videos now. What do you think is happening when you view the livestreams? No web server needed.

Sure if you are ok with having to stream to the cloud. Sharing your login with the company and having to deal with data breaches. That’s the point of wanting rtsp to get streams direct from the camera without relying on the cloud. The current rtsp solution has no security at all. And apparently still requires cloud access. I didnt even try it once I saw it lacked any kind of security. To do it with security you need the small web server. Which they likely dont have as they are so cheap…

When you view a livestream, it’s a point-to-point connection – no cloud involved. Are you equating servers with webservers? They are not the same. As for security, everything is supposedly local, no access from outside the LAN, except maybe via VPN, That’s secure enough.

[Updated 02-13-20] Data leak 12-26-2019

Wyze News

nerdland December 27, 2019, 7:29am 218

If you had Wyze connected to Alexa or Google Home, you will need to reconnect it. It sounds like you’re using Alexa, right? If so, follow the directions here.

Topic		Replies	Views
What is up with the data breach? Sensors not-platform-specific	125	15093	January 1, 2020
Update on Investigation of 2/16/24 Security Issue Wyze News important , update	180	33075	March 11, 2024
Wyze 2FA Implementation Wyze News	80	2286	June 13, 2024
2 Factor Authentication (2FA) Information Wyze News important	130	8181	November 9, 2022
Two Factor Authentication Requirement Watercooler	276	8758	November 1, 2022

[Updated 02-13-20] Data leak 12-26-2019

Related topics