A reader tipped me off to this Reddit thread where Wyze has had some sort of issue has broadcasted private camera streams randomly to others. That’s one hell of a privacy issue. But not the company’s first one. I wrote about another privacy issue with Wyze back in 2019. Thus I am not shocked by this. The Verge confirms that this was happening on Friday along with additional Reddit threads illustrating that this issue was widely seen by uses, and they also report the following:
After we published this story, Wyze spokesperson Dave Crosby shared a statement explaining what happened. Although Crosby says the issue is resolved and that view.wyze.com is “back up and running,” the status page still says view.wyze.com is under maintenance as of Saturday morning. (Crosby says the company will update the status page “shortly.”)
Here is Crosby’s statement:
This was a web caching issue and is now resolved. For about 30 minutes this afternoon, a small number of users who used a web browser to log in to their camera on view.wyze.com may have seen cameras of other users who also may have logged in through view.wyze.com during that time frame. The issue DID NOT affect the Wyze app or users that did not log in to view.wyze.com during that time period.
Once we identified the issue we shut down view.wyze.com for about an hour to investigate and fix the issue.
This experience does not reflect our commitment to users or the investments we’ve made over the last few years to enhance security. We are continuing to investigate this issue and will make efforts to ensure it doesn’t happen again. We’re also working to identify affected users.
That’s nice. But again, I’ll point out that this is not the first time that Wyze has run into a privacy issue. Besides what I mentioned above, there was this:
In March 2022, Wyze revealed that it had been aware of a security vulnerability for three years that could have let bad actors access WyzeCam v1 cameras, but quietly discontinued the camera rather than telling customers about it.
My take home message is that nobody should buy Wyze cameras. They may be cheap on Amazon. But they’re clearly insecure and the company cannot be trusted.
The Apple Software Updates From Earlier This Week Were Intended To Patch Two Zero Days Used By Pegasus Spyware
Posted in Commentary with tags Apple on September 9, 2023 by itnerdEarlier this week, Apple released updates to watchOS, iOS, and macOS. It was weird because I was expecting Apple to be releasing nothing as new versions of those operating systems are inbound in the next couple of weeks. However looking at the security information gave us the first hint that Apple might have been forced to release this as the words “Apple is aware of a report that this issue may have been actively exploited” were used in the security information. And now we know the reason why they were released. These updates patch flaws that were used by the infamous Pegasus spyware that is sold by the equally infamous NSO Group:
Citizen Lab, an internet watchdog group that investigates government malware, published a short blog post explaining that last week they found a zero-click vulnerability — meaning that the hackers’ target doesn’t have to tap or click anything, such as an attachment — used to target victims with malware. The researchers said the vulnerability was used as part of an exploit chain designed to deliver NSO Group’s malware, known as Pegasus.
“The exploit chain was capable of compromising iPhones running the latest version of iOS (16.6) without any interaction from the victim,” Citizen Lab wrote.
Once they found the vulnerability, the researchers reported it to Apple, which released a patch on Thursday, thanking Citizen Lab for reporting them.
Based on what Citizen Lab wrote in the blog post, and the fact that Apple also patched another vulnerability and attributed its finding to the company itself, it appears Apple may have found the second vulnerability while investigating the first.
Ken Westin, Field CISO, Panther Labs had this comment:
“While this exploit initially appears to have been utilized by the NSO Group with their Pegasus spyware, the vulnerability has been identified, and differences between the software versions have been documented. This suggests that exploits targeting this vulnerability are likely to become more widespread and may extend beyond commercial spyware use.
The initial exploit employed by the NSO Group for their Pegasus spyware may have been somewhat targeted. However, the NSO Group has not been transparent about the targets of these exploits. In many cases, they have claimed a lack of visibility regarding their use. Regrettably, this software has been used to target innocent individuals, including journalists and dissidents, by authoritarian regimes. While Pegasus exhibits some level of targeting in its usage, the primary concern now, with the patch being published, is the identification of the vulnerability. As a result, it is likely that exploits will become more widespread.”
While Pegasus is a highly targeted form of spyware, that should not stop you from immediately updating your Apple Watch, iPad, iPhone, or MacBook ASAP to make sure that you are secure as possible. The reason being is that other threat actors might try to leverage this flaw agains those who have not updated.
Leave a comment »