Thanks to a reader of this blog, I’ve been alerted to a problem with whatever back end service that runs access to Belkin’s WEMO NetCam products. After digging in to confirm what the user told me, I can say that the following is going on. Users of these cameras are unable to log in via their smartphones to view their camera(s) or change settings. And they sometimes get this error when they try to log in:
Other times the app seems to hang. I was able to reproduce this myself and I validated that the ports that are referenced in the error message are open. Deleting and reinstalling the NetCam app does not resolve this.
Based on this thread on the Belkin forums, this started on May 12th and the moderator on the forum claims to have escalated the issue. It seems to be restricted to iOS devices at this time, and users can still log into the web portal at netcam.belkin.com assuming that they are using a browser with Flash installed. So users aren’t totally dead in the water, but this is far from ideal.
The reason why this reader reached out to me is due to the fact that he feels that disclosing this to the media is the only way to get Belkin’s attention. He has that perception because of my coverage of the Linksys WRT32X issues from last year and earlier this year. I am not sure if I truly accelerated a fix for that, but the fact that this reader feels that way is a problem for Belkin as that shows that people don’t entirely trust them. Thus I hope a fix for this comes quickly to restore the confidence of their customers.
Watch this space for updates.
UPDATE: A second thread on this topic with some not so happy Belkin NetCam users is also present on their forums. There’s also the suggestion that there is a “major” outage with WeMo products in general. But I cannot find any evidence that supports this.
UPDATE #2: There is some speculation on the Belkin forums that iOS 11.3.1 is responsible for this as people who have earlier versions of iOS appear to be fine. But using that logic, this problem should have appeared on April 25th or thereabouts when iOS 11.3.1 was released. But as far as anyone can tell, this issue appeared this past weekend.
UPDATE #3: Reports are coming in via the Belkin forums that WEMO Netcam users are able to log in now. I have confirmed this as well. I will continue to monitor this, but it appears that this issue is coming to an end. Likely via a back end fix.
UPDATE 4: Consider this issue to be resolved.
However, some points for Belkin on this that they should consider. Belkin has a Twitter handle called @WEMOCares which references another Twitter handle called @WEMOOutages. Neither have been updated in years. Which is bizarre because the former is referenced here. But to be fair, there’s a link that says @WEMOCares that goes to @BelkinCares and one that goes to @WEMOCares. Belkin should clean that up.
The reason why this matters is that I was looking to see if Belkin had posted any info on whatever happened to the WEMO NetCam and found nothing on any of their Twitter handles. And to find two of them that haven’t been used in years is very disappointing as it gives the impression that the WEMO line of products isn’t one that they care about. Not only that, but there was very little in the way of much communication from Belkin other than to say that the issue was escalated. That really isn’t a winning strategy in this day and age where transparency and communication wins the day 100% of the time. Belkin should take a good hard look at how they communicate to customers. I say that because the person who reached out to me did so because he thought that because I would publish this (which I did) it would get the issue resolved faster as it had been an issue for days apparently. There’s something wrong with the universe when a user of a product has to do that as it highlights that perhaps a company not only should be communicating better to its customers, but they also need to restore some trust as well.
Some food for thought for Belkin.
If You Care About Security On Your Home Network, Turn Off UPnP
Posted in Commentary with tags Security on May 16, 2018 by itnerdUPnP stands for Universal Plug And Play. The idea behind this technology is that networked devices such as personal computers, printers, Internet gateways, Wi-Fi access points and mobile devices to seamlessly discover each other’s presence on the network and establish functional network services for data sharing. It sounds great because it takes some of the complexity setting up devices on your home network.
It’s also a great vehicle for hackers to enlist your devices to pwn others. And has been for years. And when I say years, I mean that security issues have been found in UPnP going back into the previous decade.
Researchers at cyber security firm Imperva have posted a paper that describes how UPnP can be used to enlist UPnP enabled routers that may be badly secured to execute a pretty crafty distributed denial of service attack. I say crafty because the attack that the researchers describe can evade some defense mechanisms to mitigate at distributed denial of service attack. What’s concerning about this is that the researchers found 1.3 million devices that on the surface could be exploited for such an attack. That’s kind of scary.
My advice? If you have a router which supports UPnP, disable the protocol immediately. I haven’t yet stumbled upon a router which does not permit disabling UPnP, so as far as I am concerned, that should be a no brainer to help you to avoid having your router enlisted for mass pwnage.
5 Comments »