A report in GovTech caught my eye this morning as it had news that Amazon is working with police to provide access to video from the popular Ring doorbells simply by having the cops ask for it:
What has raised eyebrows, however, is the company’s push for partnerships with law enforcement agencies across the country, a fact that some feel has allowed police to create informal surveillance networks in hundreds of neighborhoods.
Under Ring partnerships, police are provided with a special portal that allows them to communicate with and request video from community residents.
Amazon offers these partnerships for free, in exchange for the signing of a memo of understanding that has also caused controversy. Critics allege these memos allow Amazon the unprecedented ability to ghostwrite a majority of law enforcement’s press releases about the product, leading to accusations that “Ring is using local police as a de facto advertising firm.”
“What we’re talking about is a private company trying to disrupt the public safety infrastructure of this country in the same way that companies have gone into other parts of our society,” said Dave Maass, senior investigative researcher with the Electronic Frontier Foundation.
Among other things, Maass sees the product as problematic for both consumer privacy and cybersecurity.
“Information is being collected on people who are just going about their lives. Not necessarily doing anything nefarious, yet they’re having information collected on them anyway,” he said. “By deploying tens of thousands of these cameras in any given community, you’re also creating a very wide surface area for attack [for hackers],” he went on. “We’ve seen over the years that IoT devices — specifically web cameras and CCTV cameras — have proven very rich targets for malicious actors.”
However, here’s the other side of this:
However, he [Tony Botti, public information officer for the Fresno County Sheriff’s Office] noted, there is a workaround if a resident happens to reject a police request. If the community member doesn’t want to supply a Ring video that seems vital to a local law enforcement investigation, police can contact Amazon, which will then essentially “subpoena” the video.
“If we ask within 60 days of the recording and as long as it’s been uploaded to the cloud, then Ring can take it out of the cloud and send it to us legally so that we can use it as part of our investigation,” he said
There’s a whole number of ways that this isn’t good. Privacy for example is at the top of the list. Unauthorized access is second on that list as I would be concerned at someone trolling through videos that a Ring Doorbell records for giggles. But on the other hand, you could make an arrangement that this shouldn’t be an issue because if you have video that could help the cops, any good citizen should want to hand it over. Thus eliminating the need for the cops to troll through your video. In other words, this is a complex issue that likely needs debating in public and Amazon answering some pointed questions before this goes away.
Check Point Security Report Says That Amazon Alexa Were Subject To Extensive Levels Of Pwnage
Posted in Commentary with tags Amazon, Security on August 17, 2020 by itnerdA report from Check Point Security researchers paints a pretty scary picture of how secure smart home devices are. Specifically Amazon Alexa products:
Our findings show that certain Amazon/Alexa subdomains were vulnerable to Cross-Origin Resource Sharing (CORS) misconfiguration and Cross Site Scripting. Using the XSS we were able to get the CSRF token and perform actions on the victim’s behalf.
These vulnerabilities would have allowed an attacker to:
In effect, these exploits could have allowed an attacker to remove/install skills on the targeted victim’s Alexa account, access their voice history and acquire personal information through skill interaction when the user invokes the installed skill.
Successful exploitation would have required just one click on an Amazon link that has been specially crafted by the attacker.
Now all of those issues have been fixed. But it really makes one think twice about having these devices in their homes as it seems really wrong that a third party company is doing the sort of due diligence that the makers of this gear should be doing. The thing is that companies who create these devices have to have security as the top priority if these companies want consumers to buy their gear. Thus the best way for you to get the most secure smart home gear is to demand and expect better from these companies.
2 Comments »