Ring Throws Customers Under the Bus After Data Breach

By Cooper Quintin and Bill Budington

Just a week after hackers broke into a Ring camera in a child’s bedroom, taunting the child and sparking serious concerns about the company’s security practices, Buzzfeed News is reporting that over 3,600 Ring owners’ email addresses, passwords, camera locations, and camera names were dumped online. This includes cameras recording private spaces inside homes.

This stunning new leak could potentially provide criminals and stalkers with access to view live video feeds from inside and around thousands of Ring customers’ homes, see archived videos, and get the precise location of all Ring devices attached to the compromised account by studying the orientation of the footage and location information attached to each camera.

Ring has claimed that this attack was the result of credential stuffing, a technique where attackers gather usernames and passwords compromised in another data breach and try them on other websites. Ring claims that the incident is “in no way related to a breach or compromise of Ring’s security.” Ring is attempting to place the blame squarely at the feet of their customers for reusing passwords, using weak passwords, and not turning on two-factor authentication. The truth is that Ring itself deserves the largest share of blame for every attack that their users have suffered.

An email sent to Ring users notifying them of the breach.

We don’t currently know how the Ring account data was acquired but for the moment let’s take Ring at their word that this was a credential stuffing attack. That implies that an attacker tried tens or even hundreds of thousands of username and password combinations on Ring’s website, and Ring didn’t even notice until they were alerted by security researchers. Best practices in website security provide a few basic guidelines. First, numerous subsequent failed attempts on an account should result in extra scrutiny for logging in to that account. This may include limiting the number of attempts or locking the account until the owner can be contacted. Second, when a password is chosen for an account, this should go through some form of scrutiny: checking whether it is in a list of known compromised passwords and ensuring that it is sufficiently complex. Third, account holders should be able to see (and audit) the list of devices that have logged in to their account. And fourth, companies should encourage users to enable two-factor authentication (2FA) in their account settings.

Ring cameras have extremely sensitive data—live footage adjacent to and often within the home—at their disposal.  This means that Ring should be extra careful with account information, not just employing basic account protections.  And although Ring has 2FA available for accounts, they rarely encourage its use to protect user accounts, with the exception of the email above.  Furthermore, they appear to have not even followed any of the other best practices listed above. And instead of giving users clear channels of remediation, they’re placing the blame for the data breach on their own users.

Ring has demonstrated a pattern of being negligent in enforcing even basic web application security controls. As late as February they sent video feeds to their cloud providers completely unencrypted. Ring has done too little to prevent account breaches, instead opting to blame their customers for any security breaches. Ring claims its primary business is the security of their customers. Yet they’ve failed to follow even basic data security best practices, opting instead to put the burden on their customers.

Cooper is a security researcher and Senior Staff Technologist at EFF. He has worked on projects such as Privacy Badger, Canary Watch, and analysis of state sponsored malware. He has also performed security trainings for activists, non profit workers and ordinary folks around the world. He previously worked building websites for non-profits, such as Greenpeace, Adbusters, and the Chelsea Manning Support Network. He also was a co-founder of the Hackbloc hacktivist collective. In his spare time he enjoys playing music and participating in street protests.

Bill is a long time activist, programmer, and cryptography enthusiast. He works on EFF’s Tech Projects team as a security engineer and technologist, and is the lead developer for HTTPS Everywhere and Panopticlick. He has also contributed to projects such as Let’s Encrypt and SecureDrop. Bill can be found talking to crowds of people on soap boxes and stages in far off places, or doing digital security trainings for organizations. He loves hacker spaces and getting together with other techies to tinker, code, share, and build the technological commons. Er spricht auch gern Deutsch!

This article was sourced from EFF.org

Subscribe to Activist Post for truth, peace, and freedom news. Become an Activist Post Patron for as little as $1 per month at Patreon. Follow us on SoMee, Flote, Minds, Twitter, and Steemit.

Provide, Protect and Profit from what’s coming! Get a free issue of Counter Markets today.