{"id":26392,"date":"2022-12-29T00:02:54","date_gmt":"2022-12-29T00:02:54","guid":{"rendered":"https:\/\/mailinvest.blog\/index.php\/2022\/12\/29\/ring-doorbell-cams-hijacked-by-assholes-to-provide-live-streams-of-swattings\/"},"modified":"2022-12-29T00:02:54","modified_gmt":"2022-12-29T00:02:54","slug":"ring-doorbell-cams-hijacked-by-assholes-to-provide-live-streams-of-swattings","status":"publish","type":"post","link":"https:\/\/mailinvest.blog\/index.php\/2022\/12\/29\/ring-doorbell-cams-hijacked-by-assholes-to-provide-live-streams-of-swattings\/","title":{"rendered":"Ring Doorbell Cams Hijacked By Assholes To Provide Live Streams Of SWATtings"},"content":{"rendered":"

<\/a>\n
<\/p>\n

\n

from the another-PR-coup-for-Ring<\/i> dept<\/h3>\n

Amazon\u2019s home security tech acquisition, Ring<\/a>, has become a dominant player in this industry sector. Some of that is due to Amazon\u2019s backing. A lot of this is due to extremely inappropriate<\/a> relationships with law enforcement<\/a>, which convert cops to Ring proselytizers<\/a> whose public statements are subject to review by the company\u2019s PR wing. <\/p>\n

Ubiquity is great for Ring\u2019s bottom line. But being everywhere means you\u2019re a prime target<\/a> for malicious behavior, especially when market expansion is prioritized<\/a> over securing devices used by millions of customers. <\/p>\n

Easily exploited credentials led to horror stories from Ring users. Hackings were livestreamed, with hackers yelling verbal abuse and racist slurs at unsuspecting camera owners. In some cases, cameras in children\u2019s bedrooms were targeted, subjecting kids to abuse shouted by hateful idiots whose oxygen allowance is greatly in need of severe reduction.<\/p>\n

Ring responded to its complete lack of security requirements by implementing a few tepid changes<\/a> to the \u201cdo nothing\u201d baseline. While this may have nudged more people towards 2FA by making it the new default, it appears there are plenty of unsecured devices still online, sharing data and recordings with Ring while being attack vectors for malicious hackers.<\/p>\n

The latest news for Ring and its internet-of-mostly-unsecured-devices? Becoming the mute witness to SWATtings perpetrated for the amusement of hideous internet denizens. Brian Krebs has more details at his site<\/a>:<\/p>\n

\n

Two U.S. men have been charged with hacking into the Ring home security cameras of a dozen random people and then \u201cswatting\u201d them \u2014 falsely reporting a violent incident at the target\u2019s address to trick local police into responding with force. Prosecutors say the duo used the compromised Ring devices to stream live video footage on social media of police raiding their targets\u2019 homes, and to taunt authorities when they arrived.<\/em><\/p>\n

Prosecutors in Los Angeles allege 20-year-old\u00a0James Thomas Andrew McCarty<\/strong>, a.k.a. \u201cAspertaine,\u201d of Charlotte, N.C., and\u00a0Kya Christian Nelson<\/strong>, a.k.a. \u201cChumLul,\u201d 22, of Racine, Wisc., conspired to hack into\u00a0Yahoo<\/strong>\u00a0email accounts belonging to victims in the United States. From there, the two allegedly would check how many of those Yahoo accounts were associated with Ring accounts, and then target people who used the same password for both accounts.<\/em><\/p>\n

An indictment unsealed this week says that in the span of just one week in November 2020, McCarty and Nelson identified and swatted at least a dozen different victims across the country.<\/em><\/p>\n<\/blockquote>\n

Note that 12 of these livestreamed attacks took place in November 2020, a full eight months after<\/em> Ring rolled out new security measures meant to make it more difficult for people to gain access to customers\u2019 cameras. The by-default 2FA only affected new users. And Ring appeared to add nothing that shoved existing users to better security, meaning there\u2019s plenty of exploitable cameras still out there, thanks to Ring\u2019s tireless marketing efforts and extremely tired approach to device security.<\/p>\n

Old logins tied to older logins were the attack vector, says the DOJ:<\/p>\n

\n

According to the indictment returned Friday afternoon by a federal grand jury in Los Angeles, from November 7, 2020, to November 13, 2020, Nelson and McCarty gained access to home security door cameras sold by Ring LLC, a home security technology company. Nelson and McCarty allegedly acquired without authorization the username and password information for Yahoo email accounts belonging to victims throughout the United States<\/em>.<\/p>\n

Then, they allegedly determined whether the owner of each compromised Yahoo account also had a Ring account using the same email address and password that could control associated internet-connected Ring doorbell camera devices. Using that information, they identified and gathered additional information about their victims, according to the indictment<\/em>.<\/p>\n<\/blockquote>\n

Easy enough to do. And even easier to weaponize. It appears the indicted hackers believed they were pretty much untouchable. Not only did they interact with responding law enforcement, their SWATting campaign spanned the nation.<\/p>\n

\n

Nelson allegedly accessed without authorization a Ring doorbell camera, located at the residence of the victim\u2019s parents and linked to the victim\u2019s Ring account, and used it to verbally threaten and taunt West Covina Police officers who responded to the reported incident.<\/em><\/p>\n

The indictment alleges other similar Ring-related swatting incidents occurred in Flat Rock, Michigan; Redding, California; Billings, Montana; Decatur, Georgia; Chesapeake, Virginia; Rosenberg, Texas; Oxnard, California; Darien, Illinois; Huntsville, Alabama; North Port, Florida; and Katy, Texas.<\/em><\/p>\n<\/blockquote>\n

Is this Ring\u2019s fault? No. Not directly. Just because something could be used for nefarious ends doesn\u2019t mean it should be. All culpability for the harms perpetrated in these cases rests with the perpetrators. But if Ring had valued customer security over market expansion earlier, at the very least these horrible human beings would have been deprived of the vicarious thrill of watching their victims be victimized in real time. And that lack of visual thrill might have been enough to reduce the number of attacks, limiting the damage allegedly done by this pair. <\/p>\n

\nFiled Under: live streams<\/a>, ring<\/a>, ring doorbell<\/a>, swatting<\/a>
\n
Companies: amazon<\/a>\n<\/p>\n<\/div>\n