Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A podcast that hacks Ring camera owners live

vice.com

Post reply on HN
Print view View original

61–70 of 283 posts

Re: A podcast that hacks Ring camera owners live

#61

Post by heavyset_go »

ActorNightly wrote: post #59
heavyset_go wrote: post #50

Earlier quoted context omitted.

> Police do not have access to the cameras, only the server stored footage, which is both optional to share Ring lets police know that potential video evidence exists, and with that knowledge, they can then get a warrant to obtain the potential evidence from Ring if you choose not to share it.

Thats why I said both are optional. You can choose to never upload the footage in the first place.

Do the cameras talk to a Ring backend even if you choose not to upload footage? The knowledge that a camera exists near the scene of a crime can be enough information to get a warrant for your privately stored footage.

Most people purchase Ring cameras for the cloud integration aspect, anyway.

Re: A podcast that hacks Ring camera owners live

#62

Post by throwaway_tech »

heavyset_go wrote: post #48
_ea1k wrote: post #20

Earlier quoted context omitted.

No, but my camera watching what happens outside of my house is also not the same as a police camera. I didn't have such a camera at my old house, but if I did, there were several happenings that would have been reported to police.

Ring lets law enforcement know that potential video evidence exists, and with that knowledge, they can go to a judge and get a warrant for it. Law enforcement can do this without ever letting the user who recorded the video know. For that reason, it's essentially a police camera. The police can ask nicely for the video footage, and if you don't cooperate, they can easily get a warrant to obtain the potential evidence…

>The police can ask nicely for the video footage, and if you don't cooperate, they can easily get a warrant to obtain the potential evidence from Ring.

Or they could get the warrant to obtain the video directly from you....they just have 1 more option when a 3rd party vendor is involved that has a copy.

It doesn't matter if it is Ring or CCTV, so I'm not sure the practical difference that you would classify 1 as a police camera and the other not, no matter what if your camera captures a crime the police will likely be able to get a warrant for it whether you have to turn it over or Ring does. I think most people would rather a vendor like ring have to deal with warrants on their behalf.

Re: A podcast that hacks Ring camera owners live

#63

Post by jrockway »

Someone1234 wrote: post #24
boatswain wrote: post #22

> The software churns through previously compromised email addresses and passwords to break into Ring cameras at scale. Given the sensitive nature of cameras in homes, I think Ring should require 2FA.

I agree. Even "bad" 2FA (e.g. SMS) is better than nothing in this case. However, I suspect some would complain about needing to give a telephone number to use their new camera.

I think it would be completely reasonable to bundle one of those Bluetooth-based U2F tokens and to require that to be around when you want to access the camera remotely.

To add new tokens to your account, you would have to place them on top of the camera, or something.

This makes the attack described in the article basically impossible, and lets the camera vendor sell you tokens if you have multiple family members that want to log in. A win-win!

Re: A podcast that hacks Ring camera owners live

#64

Post by trevyn »

fpgaminer wrote: post #51
kick wrote: post #2

It's obviously bad to hack into a citizen's systems without consent, but there's some kind of value that might be created here. Ring cameras are basically being used as a gigantic police-partnered dragnet: Amazon’s Ring Planned Neighborhood “Watch Lists” Built on Facial Recognition https://theintercept.com/2019/11/26/amazon-ring-home-securit... If this provides a disincentivize to an average user buying Ring cameras,…

As someone who tends to fall on the side of privacy more often than not, I'm actually not sure how I feel about facial recog+home security cameras. I'm completely against any fully automated system where the police can have access to the camera's data. But on the other hand, what if the system was implemented completely locally, and all with the owner's control and permission? So your Ring app pops up and says "Hey,…

How do you know the request is connected to violation of a law you agree with?

Re: A podcast that hacks Ring camera owners live

#65

Post by jacquesm »

hannasanarion wrote: post #32
throwaway_tech wrote: post #21

Earlier quoted context omitted.

Neither cameras watching gas stations nor cameras watching your front door are "police cameras". They are privately owned cameras, but feel free to expand on what makes these cameras different in your opinion.

Police can get footage from Nest cameras, indoor and outdoor, without owner permission by applying directly to Amazon, and users can't opt out of Amazon's "Rekognition" tool that is always on and alerts police when a face on their wanted list is recognized on a camera.

That tool had better not have a false positive rate that can be measured or Jeff Bezos will have some blood on his hands. The response to a 'wanted' criminal being spotted can easily cause that wanted person to end up dead and if it turns out to be the wrong person afterwards that would be more than just a little bit problematic.

Re: A podcast that hacks Ring camera owners live

#66

Post by just_myles »

ActorNightly wrote: post #37
boatswain wrote: post #22

> The software churns through previously compromised email addresses and passwords to break into Ring cameras at scale. Given the sensitive nature of cameras in homes, I think Ring should require 2FA.

Or just have a min password length requirement that is at least a 5 word sentence. Easier to remember, and more secure.

You know, I hadn't thought about that.

Re: A podcast that hacks Ring camera owners live

#67

Post by __jal »

ActorNightly wrote: post #43
__jal wrote: post #42

Earlier quoted context omitted.

This is a red-herring. Nobody cares about physical access to essentially disposable cameras. The stored footage is the whole game.

Yes, and stored footage is completely optional with Ring cameras.

Can you point to a page where Ring says this? I cannot find any indication that these work with anything other than their cloud service.

Re: A podcast that hacks Ring camera owners live

#68

Post by mikepurvis »

trevyn wrote: post #64
fpgaminer wrote: post #51

Earlier quoted context omitted.

As someone who tends to fall on the side of privacy more often than not, I'm actually not sure how I feel about facial recog+home security cameras. I'm completely against any fully automated system where the police can have access to the camera's data. But on the other hand, what if the system was implemented completely locally, and all with the owner's control and permission? So your Ring app pops up and says "Hey,…

How do you know the request is connected to violation of a law you agree with?

If nothing else, you could review the footage yourself before deciding to share. If they person the system thinks it recognized looks like they're minding their own business, bury it.

Re: A podcast that hacks Ring camera owners live

#69

Post by jrockway »

ActorNightly wrote: post #57
SirYandi wrote: post #52

Earlier quoted context omitted.

Although password security makes no difference to how these devices were hacked, by password leaks.

Method wise, you are correct. However, forcing all the users to adopt a new password creation paradigm will statistically make this a very small issue.

I kind of doubt it. People will use the same password on every website, and if you require it to be 4 words, they'll just make it "my password is password" or something. Password requirements don't improve password security. Reuse and phishing are always going to be the main problem.

(Of course, bad passwords are bad. One time I exposed a mysql database I use for local unit tests to the Internet with the credentials root:test. It was hacked in hours, with a message saying where to send bitcoins to get the database back. Slightly stronger passwords do help with that sort of thing.)

Re: A podcast that hacks Ring camera owners live

#70

Post by heavyset_go »

throwaway_tech wrote: post #62
heavyset_go wrote: post #48

Earlier quoted context omitted.

Ring lets law enforcement know that potential video evidence exists, and with that knowledge, they can go to a judge and get a warrant for it. Law enforcement can do this without ever letting the user who recorded the video know. For that reason, it's essentially a police camera. The police can ask nicely for the video footage, and if you don't cooperate, they can easily get a warrant to obtain the potential evidence…

>The police can ask nicely for the video footage, and if you don't cooperate, they can easily get a warrant to obtain the potential evidence from Ring. Or they could get the warrant to obtain the video directly from you....they just have 1 more option when a 3rd party vendor is involved that has a copy. It doesn't matter if it is Ring or CCTV, so I'm not sure the practical difference that you would classify 1 as a po…

> Or they could get the warrant to obtain the video directly from you....

They'd need knowledge that your cameras even exist. Ring provides an easy to use map of their surveillance network.

Post reply on HN