Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Wyze security incident update

forums.wyze.com

Post reply on HN
Print view View original

61–70 of 161 posts

Re: Wyze security incident update

#61

Post by BuildTheRobots »

Shadowmist wrote: post #55
matrix_overload wrote: post #54

Wyze cameras can actually be used very securely, as long as you bother to jump through some hoops. First of all, google "Wyze RTSP firmware". It's the official firmware from the vendor that enables the RTSP protocol. Now you can enable RTSP via the app and give the camera a fixed IP address in your DHCP server. RTSP is a pretty standard protocol, so you can now view the feed via VNC player, record it 24/7 via ffmpeg,…

https://forums.wyze.com/t/how-to-download-wyze-rtsp-files-th...

> Wyze Update 04/05/2022: RTSP was considered a beta feature and we are currently assessing the path forward as the firmware versions have aged quite a bit. Wyze has removed the firmware files for these versions for now and will update the pages when plans are finalized. Please note that firmware files take a while to work on and test so you may not see an update in the near future. Wyze apologizes for the inconvenience.

Re: Wyze security incident update

#63

Post by matthewcford »

quatrefoil wrote: post #59
twisteriffic wrote: post #33

Earlier quoted context omitted.

> Do you think the issue was something else? No, I'm not questioning whether or not it was a caching issue. I'm taking exception to the lack of accountability. They chose the library. They (probably) chose to ignore a documented or common failure mode of caching systems through either poor choice of key or lack of synchronization. They've obviously designed their infrastructure in a way that isn't resilient to its cu…

It's not even that: the quoted language doesn't even blame the library - it appears to blame increased load. "As a result of increased demand, it mixed up device ID" - no, it mixed up IDs as a result of some sort of a concurrency bug. I don't understand the point of deflecting this far.

Likely to be a multi-threading issue; my bet is the cache client wasn't thread-safe. I've seen this in some apps before and the solution was to turn off multi-threading while we debug the library that was causing the issue.

Re: Wyze security incident update

#64

Post by RandomRandy »

beala wrote: post #58
woodrowbarlow wrote: post #53

Earlier quoted context omitted.

sounds like a hashing function with insufficient entropy. "increased demand" would lead to a higher likelihood of hash collisions.

Not sure I follow. Hash functions don't require entropy, and a hash collision in a hash map shouldn't cause incorrect data to be returned (it just makes them less efficient).

I think that they are saying that the output space, i.e. the list of all possible hashes, is too small. Thus, IDs 1234 and 5678 lead to the same hash.

The collision is not in the insertion into the hash map but rather in the look up.

Re: Wyze security incident update

#65

Post by sgerenser »

matrix_overload wrote: post #54

Wyze cameras can actually be used very securely, as long as you bother to jump through some hoops. First of all, google "Wyze RTSP firmware". It's the official firmware from the vendor that enables the RTSP protocol. Now you can enable RTSP via the app and give the camera a fixed IP address in your DHCP server. RTSP is a pretty standard protocol, so you can now view the feed via VNC player, record it 24/7 via ffmpeg,…

Instead of patching, you can also just use PoE cameras that are designed for this use case (local RTSP) and are only a little more expensive than Wyze. I’ve installed an Amcrest doorbell that works well with Scrypted and HomeKit, and plan on adding some Amcrest cameras like these soon: https://www.amazon.com/dp/B083G9KT4C

Re: Wyze security incident update

#66

Post by jt2190 »

lopkeny12ko wrote: post #52
prmoustache wrote: post #48

Earlier quoted context omitted.

Why would your insurance require a proof of the theft? That is not how insurances work usually.

Of course you need to provide proof of theft. I can't simply go to my insurance, file a claim for a high-value item, and expect them to not ask any more questions. This would be rife with fraud (read: not a reasonable business model) otherwise.

> Of course you need to provide proof of theft.

Generally filing a police report will suffice, if I’m not mistaken. Could you lie? Of course, but (1) it’s generally not in your best interest because the insurer might raise your rates and/or discontinue coverage, and (2) you’d be making a decision to make false statements to the police for purpose of fraud, which most reasonable people won’t do.

Other than perhaps using cameras as a means to deter thieves, I’m not sure that low-value (under USD 5000) items like bicycles are worth the time and effort for insurers to launch full investigations over.

Re: Wyze security incident update

#67

Post by t8sr »

vel0city wrote: post #41
t8sr wrote: post #30

A little off topic, but how is it possible that a tech startup named itself “Wyze” and didn’t get sued by Google over the “Waze” trademark? In some accents it sounds exactly the same, and they’re sort of in an adjacent product space.

Trademarks are about confusing names in a similar product market. Just having a similar-ish sounding name doesn't mean it violates the trademark. Self-driving cars are pretty different market to home security cameras.

You're thinking of Waymo :) Waze is a crowdsourced traffic & maps thing. It's vaguely, if you squint, adjacent. I don't think it would be completely crazy, for example, for Waze to introduce a line of dash cams.

Re: Wyze security incident update

#69

Post by Cheer2171 »

prmoustache wrote: post #48
sponaugle wrote: post #46

Earlier quoted context omitted.

The primary use case for a camera watching something that might get stolen is to provide proof of theft for insurance. In some cases it can provide clear evidence of what exactly was stolen, and in some cases information about who stole it. Unless the camera has lasers, it isn't very good at stopping said theft. ;)

Why would your insurance require a proof of the theft? That is not how insurances work usually.

My home insurance requires proof of theft.

Often you use a police report. My local police department is on an unofficial slowdown strike because they don't feel appreciated post-BLM. Possibly also because if they "forget" to file police reports or they "get lost in the system" then the official crime rate goes down. It took me over a month to get a police report I could send to insurance for a simple break in, and spent more of my labor by hourly wage trying to get that report than the cost insurance reimbursed.

Re: Wyze security incident update

#70

Post by yjftsjthsd-h »

jabart wrote: post #56
darkwater wrote: post #21

Earlier quoted context omitted.

Yes but either the library is seriously bugged (like, expecting writes to be ordered and screwing up things if it gets too many writes for different objects at the same time) or there was some serious bug in their implementation. Anyway the attitude and the message passed in the communication seems like handwashing to me. I might be too cynic, though.

How else would you say a 3rd party library had a bug under heavy load? 1. You don't want a defamation lawsuit your way. 2. If it was vendor code, you have a contract that may be under a NDA. 3. If it was a vendor, lawyers, lots and lots of lawyers, they likely had to say the minimal amount. The fact they sent out communications for each type of incident in such a short time was great.

The problem is how much they're pointing fingers at the library in the first place.
Post reply on HN