Huge Vulnerability Discovered in the Ring Doorbell
Five months since the Mirai attack and we still haven’t fixed the IoT security problem.
Last October, a botnet comprised of ~100,000 Internet of Things (IoT) devices, driven by a virus called Mirai, launched a DDOS attack against Dyn DNS. This attack disrupted service to several major websites including Amazon, PayPal, Twitter, Reddit, and Github.
This attack brought the Mirai Botnet into public light, and with it came very real questions about security in the IoT space. Mirai was able to grow so large so quickly by exploiting default admin passwords on common IoT devices, predominantly video cameras.
A quick look at Google Trends shows that around the time of the Dyn DNS attacks (Oct 21), interest in IoT security registered a huge spike. Since then, talk of IoT security has intensified, not just in how to prevent future botnets, but also in respect to how user data can be protected. However, talk about IoT security only does so much.
Security Problems Continue to Persist in IoT
So what are we doing in response? In regard to the main component of the Mirai botnet, networked cameras, the concerning answer is that very little has been done. In fact, just this week, it was discovered that the Ring Doorbell, a popular connected camera and security product, is sending data to China.
Why? According to Ring, if the Ring device loses connectivity unexpectedly at the end of a transmission, it sends the final video/audio packets to an un-routable address, essentially throwing them away. Unfortunately for Ring, that isn’t what the device actually does, instead it routes packets to an IP address in China owned by Baidu, a Chinese search engine.
Besides raising serious privacy concerns about what exactly is being sent in the end-of-call packets and who may be receiving them, this behavior creates a potential back-door into the Ring device by opening a hole in the Wi-Fi network the Ring is on, such that data coming back from China can get through a router to the device.
In fact, because the device uses UDP, anyone willing to spoof the Chinese IP Address would be able to return traffic to a Ring Device if they could find it. This could, depending on the firmware of the Ring’s camera, leave it open to command-and-control protocols similar to what happened with the Mirai botnet.
Everyone Needs to Care About IoT Security
This kind of behavior probably isn’t isolated to just Ring, as most well-known IoT camera devices aren’t actually manufactured by the company selling them. In most cases these devices are actually manufactured overseas by companies like Dahua, Acti, and Hikvision.
This mean that the firmware on the camera often isn’t maintained by the manufacturer. So while consumers may be willing to trust Ring, by using the Ring Doorbell consumers are also unknowingly choosing to trust the manufacturer of the camera.
To further aggravate the problem, Ring might not be able to do anything to address this vulnerability. As mentioned, in all likelihood Ring doesn’t write the firmware on the camera.
In order for the Internet of Things to be secure, every stakeholder from the hardware manufacturer to the service creator has to take security seriously. As we’ve just seen with Ring, even if the customer-facing company cares deeply about security, if the firmware provider doesn’t then it doesn’t matter.
Until everyone takes IoT security seriously, instances like the Mirai Dyn DNS attacks will keep happening with the potential for much darker consequences. Delayed service to websites is one thing, but when the Internet of Things increasingly includes things like medical devices and transportation, the stakes become much higher.
Originally published at iotforall.com
Want all the latest advances and tech news sent directly to your inbox?
