Amazon Fixes Ring Video Doorbell Flaw That Leaked Wi-Fi Credentials

[silversurfer]

Content source

https://threatpost.com/amazon-fixes-ring-video-doorbell-flaw-that-leaked-wi-fi-credentials/150029/

Amazon has patched a vulnerability in its Ring smart doorbell device that could allow attackers to access the owner’s Wi-Fi network credentials and potentially reconfigure the device to launch an attack on the home network, researchers have found.

Researchers discovered the problem in Amazon’s Ring Video Doorbell Pro IoT device, a smart doorbell that combines security cameras with motion-detection to help protect people’s homes against intrusion.

If exploited, the problem, outlined in a whitepaper published online, would allow an attacker physically near the device to intercept Wi-Fi network credentials, according to Bitdefender that discovered the flaw.

The security firm informed Amazon Ring of the flaw in June. After several months of back-and-forth communication, Amazon issued a patch for the device earlier this week.

 

[Threadripper]

Amazon sent credentials over HTTP? One part of me isn't surprised, the other wants to know how they're spending that money of theirs...

Interesting how Bitdefender found this, their Box 2 router claims to block passwords and other credentials being sent over HTTP, I wonder if this is how.