# Wyze in the news today, and it’s not good **URL:** \ **Category:** Watercooler\ **Tags:** bug\ **Created:** [March 31, 2022, 11:08am UTC](https://forums.wyze.com/t/wyze-in-the-news-today-and-it-s-not-good/223757 "2022-03-31T11:08:35Z")\ **Posts on this page:** 20\ **Page:** 2
**Author:** ![timothynott](https://sea2.discourse-cdn.com/wyze/user_avatar/forums.wyze.com/timothynott/32/27086_2.png) [@timothynott](https://forums.wyze.com/u/timothynott)\ **Post date:** [March 31, 2022, 5:43pm UTC](https://forums.wyze.com/t/wyze-in-the-news-today-and-it-s-not-good/223757/22 "2022-03-31T17:43:50Z")
Also, NAT is a zero-security solution. Get a router with a firewall or assume you are going to be hacked. > **[The Myth of Network Address Translation as Security](https://www.f5.com/services/resources/white-papers/the-myth-of-network-address-translation-as-security)** > > The myth that network address translation provides security has been dispelled by the security community many times but persists in some service provider technical communities. Beyond that, any device on the network that is compromised can be used to connect to other devices on the network. The assumption that one can be careless because a device will be in a safe space is not a valid approach to security. ---
**Author:** ![peepeep](https://sea2.discourse-cdn.com/wyze/user_avatar/forums.wyze.com/peepeep/32/107148_2.png) [@peepeep](https://forums.wyze.com/u/peepeep)\ **Post date:** [March 31, 2022, 5:49pm UTC](https://forums.wyze.com/t/wyze-in-the-news-today-and-it-s-not-good/223757/23 "2022-03-31T17:49:29Z")
> [@timothynott](#): > > > **Why would the logs, UID and ENR be stored on SD card?** > > I can only offer conjecture. You would have to ask Wyze why they decided to do it for a specific answer. Understood. Just to explain… From my intermediate-knowledge-lay-user-of-the-cams POV… the SD card is **optional** , not all cams have 'em. In that case, why would important security stuff be stored on 'em? > [@UPDATE YOUR FIRMWARE - Wyze Cam flaw lets hackers remotely access your saved videos ( \* if they can gain access to your local network/WiFi )](https://forums.wyze.com/t/update-your-firmware-wyze-cam-flaw-lets-hackers-remotely-access-your-saved-videos-if-they-can-gain-access-to-your-local-network-wifi/223550/12): > > Great question, which also makes me question the accuracy of the assertion. ---
**Author:** ![leebruner](https://sea2.discourse-cdn.com/wyze/user_avatar/forums.wyze.com/leebruner/32/6646_2.png) [@leebruner](https://forums.wyze.com/u/leebruner)\ **Post date:** [March 31, 2022, 5:53pm UTC](https://forums.wyze.com/t/wyze-in-the-news-today-and-it-s-not-good/223757/24 "2022-03-31T17:53:07Z")
bdragule, I worked in a children’s psychiatric facility for a few years. I realize you were advised to do so, but personally, I wouldn’t violate a child’s privacy that way. I get that you were protecting them, but for me, that feels like a lack of trust. We had cameras in the facility, but only in public areas, and in outside areas. No bedrooms, bathrooms, locker rooms, etc. But again, you were following advice and that is the right way to do it. ---
**Author:** ![peepeep](https://sea2.discourse-cdn.com/wyze/user_avatar/forums.wyze.com/peepeep/32/107148_2.png) [@peepeep](https://forums.wyze.com/u/peepeep)\ **Post date:** [March 31, 2022, 6:09pm UTC](https://forums.wyze.com/t/wyze-in-the-news-today-and-it-s-not-good/223757/25 "2022-03-31T18:09:55Z")
> [@timothynott](#): > > Also, NAT is a zero-security solution. **Get a router with a firewall** or assume you are going to be hacked. Would this be sufficient do you think? > **Intrusion Prevention System:** > > Protects your system and applications from external attacks and eliminates vulnerabilities. This is accomplished by detecting and preventing network attacks from known, unknown, and zero day exploits that infect other networks throughout the world. > > **Infected Device Quarantine:** > > Prevents infected devices from sending sensitive information or security threats to clients outside your network. Also, protects your internal network from being further infected while you get the infected system cleaned. > > **History:** > > Records the devices that have been successfully protected by the Antivirus software as well the source and classification of the attack. > **[Using the HomeCare Antivirus features on your TP-Link Router using the...](https://www.tp-link.com/us/support/faq/1773/)** > > Using the HomeCare Antivirus features on your TP-Link Router using the TP-Link Tether App I’m skeptical because it was initially provided for a few years free w/router purchase (thereafter pay) then they changed course, tossed it in gratis ‘forever’… 🤔 ---
**Author:** ![bdragule](https://sea2.discourse-cdn.com/wyze/user_avatar/forums.wyze.com/bdragule/32/17827_2.png) [@bdragule](https://forums.wyze.com/u/bdragule)\ **Post date:** [March 31, 2022, 6:26pm UTC](https://forums.wyze.com/t/wyze-in-the-news-today-and-it-s-not-good/223757/26 "2022-03-31T18:26:44Z")
I hear you, and I agree. Didn’t have a choice in my case. ---
**Author:** ![timothynott](https://sea2.discourse-cdn.com/wyze/user_avatar/forums.wyze.com/timothynott/32/27086_2.png) [@timothynott](https://forums.wyze.com/u/timothynott)\ **Post date:** [March 31, 2022, 7:02pm UTC](https://forums.wyze.com/t/wyze-in-the-news-today-and-it-s-not-good/223757/27 "2022-03-31T19:02:52Z")
Agreed – I don’t think it was a matter of “have to.” The problem does not describe saving vital information to SD instead of inside the cam. The description reads to me that the information was being written out to log files along with other information the camera wanted to log. This would probably have been done in error, not as a necessary feature. ---
**Author:** ![timothynott](https://sea2.discourse-cdn.com/wyze/user_avatar/forums.wyze.com/timothynott/32/27086_2.png) [@timothynott](https://forums.wyze.com/u/timothynott)\ **Post date:** [March 31, 2022, 7:05pm UTC](https://forums.wyze.com/t/wyze-in-the-news-today-and-it-s-not-good/223757/28 "2022-03-31T19:05:47Z")
I’m no expert in the specifics of how firewalls are implemented on all brands of routers. But, intrusion detection and antivirus are features that go above and beyond a mere firewall. Certainly not a bad thing. ---
**Author:** ![spiesrj](https://avatars.discourse-cdn.com/v4/letter/s/278dde/32.png) [@spiesrj](https://forums.wyze.com/u/spiesrj)\ **Post date:** [March 31, 2022, 7:21pm UTC](https://forums.wyze.com/t/wyze-in-the-news-today-and-it-s-not-good/223757/29 "2022-03-31T19:21:46Z")
Really fing disappointing. Have had wyze in my house for years watching my children. Disgusting to think they knew of a vulnerability and didn’t do anything about it. ---
**Author:** ![peepeep](https://sea2.discourse-cdn.com/wyze/user_avatar/forums.wyze.com/peepeep/32/107148_2.png) [@peepeep](https://forums.wyze.com/u/peepeep)\ **Post date:** [March 31, 2022, 7:23pm UTC](https://forums.wyze.com/t/wyze-in-the-news-today-and-it-s-not-good/223757/30 "2022-03-31T19:23:04Z")
Yeah, I’d like to think so. 🙂 It’s never notified of anything of any kind so I guess that’s… good? If the protection is legitimate. 🤷‍♂️ ---
**Author:** ![Schmoof](https://avatars.discourse-cdn.com/v4/letter/s/aeb1de/32.png) [@Schmoof](https://forums.wyze.com/u/Schmoof)\ **Post date:** [March 31, 2022, 8:29pm UTC](https://forums.wyze.com/t/wyze-in-the-news-today-and-it-s-not-good/223757/31 "2022-03-31T20:29:46Z")
If you are really worried or need peace of mind… from your network you can use this site to do a remote port scan - [GRC | ShieldsUP! — Internet Vulnerability Profiling  ](https://www.grc.com/shieldsup) - and use the “Common Ports” option. Anyway… the real issue here is a total lack of transparency… a few months maybe a bad decision but THREE YEARS and they said nothing nor actually patched it? That is horrifying. ---
**Author:** ![Known1](https://sea2.discourse-cdn.com/wyze/user_avatar/forums.wyze.com/known1/32/32230_2.png) [@Known1](https://forums.wyze.com/u/Known1)\ **Post date:** [March 31, 2022, 9:54pm UTC](https://forums.wyze.com/t/wyze-in-the-news-today-and-it-s-not-good/223757/32 "2022-03-31T21:54:19Z")
> [@mark6437](#): > > I still have a V1 inside my house. I use a typical AT&T provided WIFI router. With no settings changed. Am I still good? No. As it stands today all V1’s will remain vulnerable until the end of time. ---
**Author:** ![Customer](https://avatars.discourse-cdn.com/v4/letter/c/e19b73/32.png) [@Customer](https://forums.wyze.com/u/Customer)\ **Post date:** [March 31, 2022, 11:04pm UTC](https://forums.wyze.com/t/wyze-in-the-news-today-and-it-s-not-good/223757/33 "2022-03-31T23:04:37Z")
> [@timothynott](#): > > Also, NAT is a zero-security solution. Get a router with a firewall or assume you are going to be hacked. Nonsense. Home NAT routers are completely secure from this kind of threat and have been for at least 20 years. Your article is inapplicable. ---
**Author:** ![alvaros](https://sea2.discourse-cdn.com/wyze/user_avatar/forums.wyze.com/alvaros/32/27735_2.png) [@alvaros](https://forums.wyze.com/u/alvaros)\ **Post date:** [April 1, 2022, 12:04am UTC](https://forums.wyze.com/t/wyze-in-the-news-today-and-it-s-not-good/223757/34 "2022-04-01T00:04:40Z")
> [@jbluefish](#): > > This is the number one way they tell you to evaluate a company’s security - how they disclose and protect their users of breaches, regardless of how it makes them look in the moment. In fact, when a software/firmware vulnerability is discovered “internally”, companies first correct it, then deploy the security patch, and only then they make it public. Because if they first make the vulnerability public, now hackers are aware of it and can exploit it, and you can not do anything about it, because there is no fix. This is what Microsoft does, for example, when they or a specialized company discovers a vulnerability on Windows. ---
**Author:** ![RoboNaught](https://avatars.discourse-cdn.com/v4/letter/r/77aa72/32.png) [@RoboNaught](https://forums.wyze.com/u/RoboNaught)\ **Post date:** [April 1, 2022, 1:11am UTC](https://forums.wyze.com/t/wyze-in-the-news-today-and-it-s-not-good/223757/35 "2022-04-01T01:11:18Z")
To be clear, you are still protected by your router. I’ve **never** heard of a home modem/router that doesn’t use NAT by default. So if you’ve never put a MiniSD card in your V1, as I read the threat report, you are completely safe. If you have and activated the SD card issue then **anyone** who gains access to your local network and is malicious will be able to access that camera [a sophisticated attacker would probably be able to access the live feed]. They first have to get access your local network, either using (a) a flaw in the router/modem or (b) a flaw or exploit in some other device on your network or (c) actually hacking the wifi network locally (or you give them access). Placing your V1 on it’s own subnet would be one way to increase your security but I would rate this threat pretty low because if a hacker has local access to your network you’re already in big trouble. ---
**Author:** ![jbluefish](https://sea2.discourse-cdn.com/wyze/user_avatar/forums.wyze.com/jbluefish/32/57555_2.png) [@jbluefish](https://forums.wyze.com/u/jbluefish)\ **Post date:** [April 1, 2022, 4:59pm UTC](https://forums.wyze.com/t/wyze-in-the-news-today-and-it-s-not-good/223757/36 "2022-04-01T16:59:46Z")
Yea and if this was any reasonable scale of time, I would agree. They could have fixed it first before disclosing, and I prefer that (obviously). But there must come a time, where a known vulnerability needs to be disclosed. One option they had would be to disable SD cards on v1 cameras until they fixed it. Maybe unpopular, but not as unpopular as potentially leaking data. Every company has different policies on grace periods for vulnerabilities, but saying that it could go three years being “a priority” seems absurd. ---
**Author:** ![Biodegradable](https://avatars.discourse-cdn.com/v4/letter/b/f17d59/32.png) [@Biodegradable](https://forums.wyze.com/u/Biodegradable)\ **Post date:** [April 1, 2022, 4:41pm UTC](https://forums.wyze.com/t/wyze-in-the-news-today-and-it-s-not-good/223757/37 "2022-04-01T16:41:14Z")
3 years and WYZE was too busy adding new crud to fix known cam security flaws. Latest news is not reassuring to say the least. **[Mod Note]:** _Your topic was merged for consistency in grouping similar posts._ ---
**Author:** ![PCHearn](https://avatars.discourse-cdn.com/v4/letter/p/dec6dc/32.png) [@PCHearn](https://forums.wyze.com/u/PCHearn)\ **Post date:** [April 2, 2022, 3:37am UTC](https://forums.wyze.com/t/wyze-in-the-news-today-and-it-s-not-good/223757/38 "2022-04-02T03:37:06Z")
Please look at the details of the “security flaw” and see if it could have in any way impacted you. Unless you gave your personal wifi userid and password out to strangers and fiddled with your router ports, it probably could not have possibly impacted you. That doesn’t make what they did right, but knowing the details of what the real risk was puts the risk in perspective. Just sayin’. ---
**Author:** ![calvinnbs](https://avatars.discourse-cdn.com/v4/letter/c/f05b48/32.png) [@calvinnbs](https://forums.wyze.com/u/calvinnbs)\ **Post date:** [April 2, 2022, 12:10am UTC](https://forums.wyze.com/t/wyze-in-the-news-today-and-it-s-not-good/223757/39 "2022-04-02T00:10:25Z")
> **[I’m done with Wyze](https://www.theverge.com/23003418/wyze-cam-v1-vulnerability-no-patch-bitdefender-responsible-disclosure)** > > Why are we only hearing about a huge security flaw now? After years of frustration and now outright dishonesty, The Verge sums up my feelings very well. ---
**Author:** ![hero11763](https://avatars.discourse-cdn.com/v4/letter/h/9d8465/32.png) [@hero11763](https://forums.wyze.com/u/hero11763)\ **Post date:** [April 1, 2022, 12:54pm UTC](https://forums.wyze.com/t/wyze-in-the-news-today-and-it-s-not-good/223757/40 "2022-04-01T12:54:50Z")
> **[I’m done with Wyze](https://www.theverge.com/23003418/wyze-cam-v1-vulnerability-no-patch-bitdefender-responsible-disclosure?fbclid=IwAR3SseWCnVk_lmcwok8oXtTqEP95VMFBOJcnOPgU0ENJfIta2wM0PXDG_VE)** > > Why are we only hearing about a huge security flaw now? ---
**Author:** ![thebmrust](https://avatars.discourse-cdn.com/v4/letter/t/9de0a6/32.png) [@thebmrust](https://forums.wyze.com/u/thebmrust)\ **Post date:** [April 3, 2022, 3:14pm UTC](https://forums.wyze.com/t/wyze-in-the-news-today-and-it-s-not-good/223757/41 "2022-04-03T15:14:32Z")
9to5mac has an article about Wyze security. Wyze knew about the security problem and they did nothing about it. > **[Wyze Cam security flaw gave hackers access to video; went unfixed for almost...](https://9to5mac.com/2022/03/31/wyze-cam-security-flaw/)** > > A major Wyze Cam security flaw easily allowed hackers to access stored video, and went unfixed for almost three years after the company ... It makes sense that Wyze developers can’t figure out how to rotate the app either. Then again, the Amazon app didn’t work in portrait mode on iPads until recently and still won’t work in share screen. Wyze is the perpetual joke of the day. Except we have egg on our face by holding onto hope they will become what we want them to be; “functional.” …sigh… [Previous page](https://forums.wyze.com/t/wyze-in-the-news-today-and-it-s-not-good/223757.md?page=1) [Next page](https://forums.wyze.com/t/wyze-in-the-news-today-and-it-s-not-good/223757.md?page=3)