Live data from Hacker News

Amazon Ring cameras used in nationwide ‘swatting’ spree, US Justice Dept. says

bloomberg.com

181–190 of 275 posts

Re: Amazon Ring cameras used in nationwide ‘swatting’ spree, US Justice Dept. says

#181
post #23

> conduct regular scans for Ring passwords compromised in non-Ring breaches Does this mean that Ring stores plaintext passwords?

What you do is: you get someone's password from a hacked website that did store passwords in plaintext. Then you try using that same username/password combo to log into Ring.

Sure. But how many passwords do you check? Any how many users does Ring have? Multiply those 2 numbers, then multiply that by how slow the password hash is. That's a lot of CPU usage.

Re: Amazon Ring cameras used in nationwide ‘swatting’ spree, US Justice Dept. says

#182

Earlier quoted context omitted.

There's an old saying in Tennessee — I know it's in Texas, probably in Tennessee — that says, "The only way to stop a bad guy from swatting you is a good guy with his own personal SWAT team."

Own a musket for home defense, since that's what the founding fathers intended. Four ruffians break into my house. "What the devil?" As I grab my powdered wig and Kentucky rifle. Blow a golf ball sized hole through the first man, he's dead on the spot. Draw my pistol on the second man, miss him entirely because it's smoothbore and nails the neighbors dog. I have to resort to the cannon mounted at the top of the stair…

And yet those same people you mock, using only the tools you described, threw off the yoke of the largest world power at the time.

Amongst the reasons they did, were situations eerily similar to what we call "swatting" (and no-knock warrants), which were some motivations behind the fourth amendment.

An amendment that we have, through twisted legal interpretations and arguments for expediency, managed to largely de-fang (civil forfeiture, I'm looking at you).

Re: Amazon Ring cameras used in nationwide ‘swatting’ spree, US Justice Dept. says

#183
post #23

> conduct regular scans for Ring passwords compromised in non-Ring breaches Does this mean that Ring stores plaintext passwords?

More likely shared passwords, I think

Yes. But how does Ring perform the scan? It'll take quite a lot of CPU.

Re: Amazon Ring cameras used in nationwide ‘swatting’ spree, US Justice Dept. says

#184
post #23

> conduct regular scans for Ring passwords compromised in non-Ring breaches Does this mean that Ring stores plaintext passwords?

No. They use rainbow tables: https://en.wikipedia.org/wiki/Rainbow_table

Rainbow tables only work if there aren't per-user salts. I assume Ring uses per-user salts, meaning rainbow tables won't work.

Re: Amazon Ring cameras used in nationwide ‘swatting’ spree, US Justice Dept. says

#185
post #23

> conduct regular scans for Ring passwords compromised in non-Ring breaches Does this mean that Ring stores plaintext passwords?

No, it means that they hash the breached passwords and compare those hashes to the stored hashes of customer passwords.

If Ring has per-user salts, which I assume they do, they'll have to hash each breached password individually for each Ring user. So multiply the number of breached passwords by the number of Ring users by the time a hash takes (slower is better) and you get a huge amount of CPU cost.

Re: Amazon Ring cameras used in nationwide ‘swatting’ spree, US Justice Dept. says

#186
post #171

Earlier quoted context omitted.

"Swatting" isn't a significant problem in other parts of the world because the result is super boring: The police knock on the door, ask some questions, and then leave. It is only a problem in the US because the response itself is terrifying and often dangerous. Multiple people have died from "swatting" in the US[0]. "Swatting" should carry a jail term for sure. But police reform is a large component in solving the p…

There are estimated to be thousands of swatting incidents in a given year, so the "super boring" result evidently happens the vast majority of the time in the US too. It's also not always that boring in other countries. Here is an example that involved more than some questions and leaving: https://www.wjhl.com/news/local/18-year-old-arrested-in-cana...

Canada isn't that different from the US.

Outside of North America, you don't have to worry about police violence too much in developed nations.

Re: Amazon Ring cameras used in nationwide ‘swatting’ spree, US Justice Dept. says

#187

Earlier quoted context omitted.

> Stopping the swatter doesn't do much, and still allows for people to be swatted. A record of high profile cases where swatters get caught and incarcerated would be a great deterrent.

Sure but the ultimate perpetrator of the violence in these cases is the police. We can solve the swatting problem and other serious problems simultaneously by stopping the police from bursting in to peoples homes with guns blazing and other unnecessary behaviors. Specifically police need to learn about time, distance, and cover. Arrive on the scene and take cover a safe distance away from the perceived threat. Take t…

[deleted]

Re: Amazon Ring cameras used in nationwide ‘swatting’ spree, US Justice Dept. says

#188

Earlier quoted context omitted.

But you're screwed if you need to print something :(

Like what? Everyone should be paperless these days. What exactly do you still need to print?

Shipping labels. Print & play board/card games. Photographs and other art for decorating physical space. Proxy/playtest cards for trading card games. Sewing & craft patterns. Table tents for events. Flyers & brochures for local clubs. Packing slips for items sold online. Study materials for use in proctored open-book tests.

Re: Amazon Ring cameras used in nationwide ‘swatting’ spree, US Justice Dept. says

#189
post #34

Earlier quoted context omitted.

No. If I drive to a random house and start shooting at it, I don’t get to call that reckless endangerment. If I kill someone I sure as hell don’t get to call it an accident. It does not matter if you think how is police operate is unreasonable, what matters is that what they do is well known and established, and the outcome is foreseeable. Also, if your best defense is “this isn’t attempted murder, it’s just terroris…

Your analogy doesn’t hold because it’s a very different crime with very different intent and culpability. I’m simply pointing to the most similar Federal crimes and pointing out that the sentences are proportional. For comparison, Federal attempted murder-to-hire is only 10 years and that’s clearly a much worse crime. Tragically there’s now over 1000 cases of swatting per year. Only one person (Andrew Finch) has been…

>It’s not comparable to murder because it’s much more likely that someone would be killed by you offering them a ride in your car than by swatting them.

My car rides don't come with a 0.1% chance of death. I'm not that bad of a driver.

Re: Amazon Ring cameras used in nationwide ‘swatting’ spree, US Justice Dept. says

#190
post #34

Earlier quoted context omitted.

No. If I drive to a random house and start shooting at it, I don’t get to call that reckless endangerment. If I kill someone I sure as hell don’t get to call it an accident. It does not matter if you think how is police operate is unreasonable, what matters is that what they do is well known and established, and the outcome is foreseeable. Also, if your best defense is “this isn’t attempted murder, it’s just terroris…

Surely if the caller is getting charged with attempt to murder, then the SWAT doing the swatting should be charged with the same crime? How can the caller be more culpable than the one actually commiting the crime? This literally never happens in the history of crime.

>Surely if the caller is getting charged with attempt to murder, then the SWAT doing the swatting should be charged with the same crime?

The SWAT team didn't intend to hurt innocent people. They thought they were saving innocent people. The swatter was intentionally terrorizing innocent people.

Post reply on HN