Threat Description: Leaving mobile devices unattended and unlocked for any period of time prevents a serious security and privacy risk. Any individual near the device subsequently has unhindered access, and can perform any malicious act, such as installing backdoors, pairing malicious devices, or gathering data.
BARCELONA, Spain and SAN FRANCISCO, Feb. 27, 2019 /PRNewswire/ -- MOBILE WORLD CONGRESS -- Cybersecurity expert, Yossi Atias, General Manager, IoT Security at Dojo by BullGuard, the market leading IoT security platform for Communication Service Providers (CSPs), took the stage today at Mobile World Congress to demonstrate a live hack of the Amazon Ring video doorbell, exposing a previously unknown vulnerability in the popular IoT device. The hack revealed unencrypted transmission of audio and/or video footage to the Ring application allows for arbitrary surveillance and injection of counterfeit video traffic, effectively compromising home security and putting family members' safety at risk.
Launched in 2012 and acquired in February 2018 by Amazon, the main feature of the Ring video doorbell is two-way communication between the smart video doorbell and the user's mobile app, which acts as a security camera and allows the user to confirm who is ringing their doorbell from anywhere in the world via the internet. Presuming the Ring owner is away from home, they can see who is at their door and then remotely open the door if a supported smart lock is installed to let the housecleaner or babysitter in, for example.
The Ring video doorbell vulnerability lies between the cloud service and the Ring mobile application. In the Ring video doorbell hack, Atias was able to change the video feed so the end user 'believed' they were seeing someone they know and let in previously.
The Ring video doorbell vulnerability was found during the process of routine ethical hacking where the Dojo by BullGuard cyber research team examines various IoT devices to constantly improve the Dojo Intelligent IoT Platform (DIP) capabilities to defend against potential vulnerabilities. Amazon has already released a new version of the Ring mobile app where this vulnerability has been fixed and the device is now safe from this kind of attack.
Dojo by BullGuard is an award-winning intelligent defense system and service that provides the highest level of protection to consumers across all of their connected devices and smart homes. Dojo by BullGuard is the cornerstone of a Smart Home, ensuring a connected world where every consumer in every home, is smart, safe and protected.