Latest in Gear

Image credit:

Ring doorbell flaw lets others watch after password changes (updated)

At one point, the camera was exposed for months.
Jon Fingas, @jonfingas
May 12, 2018
Share
Tweet
Share

Sponsored Links

Ring

You'd expect a smart doorbell to instantly boot out everyone the moment you change your password, but that isn't necessarily the case. The Information has learned that the app for Ring's video doorbell wasn't forcing users to sign-in after password changes, regardless of how much time had elapsed -- in one case, an ex-partner had been watching the camera for months. Ring said it started kicking people out in January, after receiving word of the incident, but that window of opportunity still lasted several hours in an Information test.

The issue, as you might guess, is that the window exists in the first place. Someone with a still-valid login could not only spy on whatever's happening, but download videos. The same incident that prompted the change also included phantom rings in the middle of the night.

The flaw provides something of a headache for Amazon, which only acquired Ring in February. If it's going to use Ring's doorbells as part of delivery solutions like Amazon Key, it needs to know that the devices are reasonably secure against exploits like this. This is also a reminder that smart home security needs to be particularly tight -- a loose policy can easily lead to privacy violations.

Update: Ring has issued a statement promising both additional improvements and reminding users to avoid sharing login details when possible. You can read it in full below.

"Ring values the trust our neighbors place in us and we are committed to the highest level of customer information and data security.

"We strongly recommend that customers never share their username or password. Instead, they should add family members and other users to their devices through Ring's "Shared Users" feature. This way, owners maintain control over who has access to their devices and can immediately remove users.

"Our team is taking additional steps to further improve the password change experience."

All products recommended by Engadget are selected by our editorial team, independent of our parent company. Some of our stories include affiliate links. If you buy something through one of these links, we may earn an affiliate commission.
Comment
Comments
Share
Tweet
Share

Popular on Engadget

The Morning After: Amazon Echo (2020) review

The Morning After: Amazon Echo (2020) review

View
What we bought: Our favorite USB-C chargers

What we bought: Our favorite USB-C chargers

View
A massive spam attack is ruining public 'Among Us' games

A massive spam attack is ruining public 'Among Us' games

View
Custom PS5 covers are already a thing

Custom PS5 covers are already a thing

View
NASA works to secure the OSIRIS-REx asteroid sample

NASA works to secure the OSIRIS-REx asteroid sample

View

From around the web

Page 1Page 1ear iconeye iconFill 23text filevr