Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Data Leak Exposed the Personal Information of over 3k Ring Users

buzzfeednews.com

Post reply on HN
Print view View original

21–30 of 97 posts

Re: A Data Leak Exposed the Personal Information of over 3k Ring Users

#21

Post by qw3rty01 »

Pfhreak wrote: post #19
qw3rty01 wrote: post #13

Earlier quoted context omitted.

After reading the article, it's pretty clear that it was credential stuffing and that the writer didn't take the time to understand how it worked. Not sure what security experts they talked to, but credential stuffing absolutely can get all the information described, and the whole part about wifi connected devices is completely unrelated.

> Not sure what security experts they talked to https://www.eff.org/about/staff/cooper-quintin

The article implied he wasn't the only one they talked with. There isn't anything he said that was explicitly incorrect (unlike some of the other unnamed security researchers), but he must not have much experience with credential stuffing incidents given his responses.

Re: A Data Leak Exposed the Personal Information of over 3k Ring Users

#22

Post by HenriNext »

qw3rty01 wrote: post #18
HenriNext wrote: post #15

Earlier quoted context omitted.

I'm not making any guesses what actually happened. Just stating that you misrepresented what the article actually said when you wrote "the attack is called credential stuffing". Your sentence gives impression that the article would have said it, but the article made a point for the opposite.

The Amazon spokesperson directly said it was credential stuffing--the article was trying to argue that it was more than that in an extremely misleading way.

You may be totally right and it was credential stuffing and the article may have been wrong, misleading, incompetent and stupid.

Nonetheless, you misrepresented what the article actually said -- the article raised both, the possibility credential stuffing (implied by Amazon spokesperson), and doubt about it (unspecified security expert, WiFi attacks).

Re: A Data Leak Exposed the Personal Information of over 3k Ring Users

#23

Post by roywiggins »

oh_sigh wrote: post #10
kerng wrote: post #6

Amazon's response seems quite defensive. They are typically a bit black box when it comes to security issues.

Maybe it's because literally every password protected service is vulnerable to users reusing passwords on other insecure sites. It would be like a website writing an expose on how ford trucks are killing hundreds of drivers and expecting a response from ford, but when you read the details it's because users are driving their trucks into brick walls, something that literally every car on the market is susceptible to.

Ring doesn't seem to implement basic mitigations like warning users when there's been a login from a new device.

"Ring does not alert users of attempted log-in from an unknown IP address, or tell users how many others are logged into an account at one time. Because of this, there is no obvious way to know whether any bad actors have logged into people’s compromised Ring accounts without their consent."

Re: A Data Leak Exposed the Personal Information of over 3k Ring Users

#24

Post by roywiggins »

This seems important:

"Ring does not alert users of attempted log-in from an unknown IP address, or tell users how many others are logged into an account at one time. Because of this, there is no obvious way to know whether any bad actors have logged into people’s compromised Ring accounts without their consent."

I can understand not having 2FA turned on by default, but a bare minimum for this kind of service would be to alert users when someone successfully logs in from a new device.

Re: A Data Leak Exposed the Personal Information of over 3k Ring Users

#25

Post by spamizbad »

saisundar wrote: post #20

It's fascinating how Ring's business model benefits from local crime prevalence, which in turn might lead people to invest in home security. It is also fascinating how media companies are likely to pounce on the slightest of flaws(some malignant, and some innocuous) with either Nest or Ring, since it feeds on people's sense of security/safety again, and thus are likely to lead to more clicks.

> It is also fascinating how media companies are likely to pounce on the slightest of flaws

I wouldn't characterize these flaws as slight. But I'm biased... I used to work in the security space, and I know culturally the typical engineer are less concerned, and non-technical people in the technology sector being fully deferential to product orgs in that respect.

Re: A Data Leak Exposed the Personal Information of over 3k Ring Users

#26

Post by qw3rty01 »

HenriNext wrote: post #22
qw3rty01 wrote: post #18

Earlier quoted context omitted.

The Amazon spokesperson directly said it was credential stuffing--the article was trying to argue that it was more than that in an extremely misleading way.

You may be totally right and it was credential stuffing and the article may have been wrong, misleading, incompetent and stupid. Nonetheless, you misrepresented what the article actually said -- the article raised both, the possibility credential stuffing (implied by Amazon spokesperson), and doubt about it (unspecified security expert, WiFi attacks).

Calling out an article for being misleading is not the same as misrepresenting it.

Re: A Data Leak Exposed the Personal Information of over 3k Ring Users

#27

Post by spamizbad »

roywiggins wrote: post #24

This seems important: "Ring does not alert users of attempted log-in from an unknown IP address, or tell users how many others are logged into an account at one time. Because of this, there is no obvious way to know whether any bad actors have logged into people’s compromised Ring accounts without their consent." I can understand not having 2FA turned on by default, but a bare minimum for this kind of service would b…

My home security system, which is really... uh... crappy... manages to do this (provide both 2 factor and letting you know when someone logs in + changes the alarm state)

Re: A Data Leak Exposed the Personal Information of over 3k Ring Users

#28

Post by strictnein »

orhmeh09 wrote: post #12
qw3rty01 wrote: post #5

Even if it was the official article title, "Data Leak" is extremely misleading; the attack is called credential stuffing and is unrelated to any sort of breach on Ring's end. Edit: finished reading the article, and the entire text is just as misleading as the title, credential stuffing happens all the time and really isn't newsworthy.

If we read the same article, we’d have been agreeing that it said it was unlikely to be credential stuffing. > Security experts told BuzzFeed News that the format of the leaked data — which includes username, password, camera name, and time zone in a standardized format — suggests it was taken from a company database. They said data obtained via credential stuffing —when previously-compromised emails and passwords ar…

This is a credential stuffing attack.

Why did they add it? Why not? I'm betting when they logged in that info came back as part of the API call.

Re: A Data Leak Exposed the Personal Information of over 3k Ring Users

#29

Post by strictnein »

alpb wrote: post #2

I'm curious if Ring operates a different security engineering team than the rest of Amazon. Because Amazon.com or AWS would not get hacked; not like this.

Ring wasn't hacked.

They didn't properly defend against credential stuffing attacks. The victims here reused passwords.

Post reply on HN