Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Wyze security incident update

forums.wyze.com

Post reply on HN
Print view View original

151–160 of 161 posts

Re: Wyze security incident update

#151

Post by fullstop »

dns_snek wrote: post #149
fullstop wrote: post #136

Earlier quoted context omitted.

Where do you charge your cell phone? I totally agree with you, but then I put my phone on a qi charger on my nightstand and go to sleep. It's a device with both quality cameras and microphones, so I feel a little hypocritical given that there is a non-zero chance that someone could be listening or watching through my phone.

That's a possibility, but that would require an exploit and smartphones are far more secure and actively updated. I just keep on top of security patches and hope that's enough. With IoT there often aren't any security patches and your audio & video are just being live streamed to the OEM's cloud waiting for someone to listen in, it doesn't even require a security exploit. It's easily abused by employees, it even happ…

So your issue is with the quality of the firmware on the devices and not the fact that it is a camera in a private place which is connected to the internet?

I agree with everything you're saying, but you may be overstating security patches. Until recently, most Android phones only had a few years of security updates.

I guess what I'm getting at is that if I truly believed in keeping Internet connected cameras outside of private areas I wouldn't have a smart phone at all.

The problem with Teslas wasn't the firmware on the cameras, but rather the infrastructure behind it. Ideally the data would be encrypted on servers and decrypted locally when needed. This doesn't pair nicely with services that perform analytics on video streams, of course, but it's a better option for privacy.

At the end of the day I share your concerns, and I want only devices which are controlled locally. I have been making efforts to make this a reality.

Re: Wyze security incident update

#152

Post by kevinsync »

kevinsync wrote: post #49
firefalcon222 wrote: post #35

Not my project but I have had great success with https://github.com/gtxaspec/wz_mini_hacks & V3 model. The V3 models need to be downgraded to a specific firmware first and patching it exposes RSTP streams using https://github.com/AlexxIT/go2rtc . Everything doable without ever installing Wyze app on an environment air gapped environment with no internet.

I'm having great success with half a dozen v3's in tandem -- for $30 a camera, the quality is really unbeatable -- setup / notes below. 1. all cameras (firmware v4.36.9.139) have 64gb+ micro SD cards and record to local storage -- many people seem to have issues with anything greater than 32gb in v3's but I've found that this Verbatim tool [0] formats FAT32 at high capacity with no problems 2. all cameras have wz_min…

Something else I forgot to mention -- when you add the cameras to your network, give them a static DHCP lease by MAC address in your router (separate ones, for both wifi and ethernet if applicable)

If you don't and IP addresses cycle, your RTSP stream URLs will change and your recording software will just consider the camera disconnected. The Wyze app sometimes will get confused too (with ethernet in particular, if IP addresses change), and rebooting the cameras sometimes means physically cycling power if you don't know where it's at in your network. Better to just reserve a specific IP up front, write it down, and never think about it again.

I also use a lot of these types of crappy smart plugs [0] throughout the house (as well as starting to replace some with actual wifi outlets [1] for aesthetics) and it's actually really useful to be able to force a power cycle on certain things from my phone.

Links:

0. https://www.amazon.com/gp/product/B09LXGHR5X

1. https://www.amazon.com/KP200-Outlet-Required-Control-Certifi...

Re: Wyze security incident update

#153

Post by dotBen »

ClumsyPilot wrote: post #138
voakbasda wrote: post #75

Another in a long line of reasons to avoid low price, off-the-shelf, unauditable, cloud-enabled cameras. I continue to be amazed that there is not a reasonably priced, open source, audited, local-first solution, which doesn’t require a significant personal investment of time to install and maintain.

NAS companies like synology have an offering too. The main problem is that they still live in 2012 when it comes to cpu power and sell vastly underpowered boxes

Price. I don't need CPUs to do rendering on my NAS, and wouldn't pay the premium for it.

The margins on these devices are already pretty high because they're enterprise and business focused - I "buy once cry once"'d when I bought my * drive for the home. I would have bought a different vendor if I was forced to pay an additional premium for a render capable CPU.

(* - I'm probably tin foil hating here, but realized from a security posture perspective I don't want to publicly state the vendors I use in my network.)

Re: Wyze security incident update

#154

Post by syntaxing »

iAMkenough wrote: post #130
syntaxing wrote: post #19

This is one of the things Apple does right. HomeKit working local is a pretty great setup and just works. I put my HomeKit cameras on a VLAN without internet and device isolation and they still work seamlessly. The hard part is getting cameras that are wireless. I use scrypted but even then, getting ONVIF or RTSP isn’t as straight forward nowadays. I also have a local frigate backup which works great too. You can pip…

I'm looking forward to the day HomeKit supports 2K and/or 4K video recordings.

Scrypted does this. I actually have no clue how it works but you get 2K streaming and recording.

Re: Wyze security incident update

#155

Post by dns_snek »

fullstop wrote: post #151
dns_snek wrote: post #149

Earlier quoted context omitted.

That's a possibility, but that would require an exploit and smartphones are far more secure and actively updated. I just keep on top of security patches and hope that's enough. With IoT there often aren't any security patches and your audio & video are just being live streamed to the OEM's cloud waiting for someone to listen in, it doesn't even require a security exploit. It's easily abused by employees, it even happ…

So your issue is with the quality of the firmware on the devices and not the fact that it is a camera in a private place which is connected to the internet? I agree with everything you're saying, but you may be overstating security patches. Until recently, most Android phones only had a few years of security updates. I guess what I'm getting at is that if I truly believed in keeping Internet connected cameras outside…

> So your issue is with the quality of the firmware on the devices and not the fact that it is a camera in a private place which is connected to the internet?

I'm just making a distinction between "connected to the internet" and "streaming private data to the cloud 24/7".

Most of us use a smartphone under the assumption that nobody else has access to it, and that it's not going to send all of our data to some cloud. If someone gains that kind of access to my device, I'll have bigger problems to worry about than someone listening to my conversations, like locking down bank accounts, investment accounts and changing dozens of passwords.

> Until recently, most Android phones only had a few years of security updates.

Tell me about it, I begrudgingly buy a new device when the old one runs out of security updates. I'm not a fan of Samsung or Pixel line (which now offer longer support) so I was planning to switch to an iPhone after my current Android device is made obsolete, but I changed my mind with Apple's latest EU meltdown.

Post reply on HN