333
submitted 11 months ago by otter@lemmy.ca to c/technology@lemmy.world

Here is an article where you can read more: https://foundation.mozilla.org/en/blog/mozilla-publishes-ring-doorbell-vulnerability-following-amazons-apathy/

Quoted a portion:

(SAN FRANCISCO, CA | TUESDAY, JUNE 6, 2023) -- Today, Mozilla is publicizing a security vulnerability in Amazon’s Ring Wireless Video Doorbell. Mozilla shared the vulnerability with Amazon over 90 days ago, but Amazon has yet to address the issue. Now, per industry standards, Mozilla is sharing its findings publicly to alert Ring Doorbell users and to further pressure Amazon to take action.

Following a penetration test of the Ring Doorbell conducted in October-November 2022, Mozilla and collaborator Cure53 determined that the device is vulnerable to Wi-Fi deauthentication attacks. Bad actors can leverage these weaknesses to disconnect the device from the internet using easily-accessible tools.

As a result, those bad actors could take the doorbell offline and then have their activities go unrecorded — undermining the product’s core purpose. Even after the doorbell is reconnected to the internet, a user will receive no alert about the attack.

Mozilla’s disclosure comes just days after Ring’s $5.8 million settlement with the Federal Trade Commission (FTC) over other serious privacy and security issues. The FTC found that “Ring’s poor privacy and lax security let employees spy on customers through their cameras, including those in their bedrooms or bathrooms, and made customers' videos, including videos of kids, vulnerable to online attackers.”

you are viewing a single comment's thread
view the rest of the comments
[-] GreatAlbatross@feddit.uk 8 points 11 months ago

Is there a fix for de-auth nowadays?

I haven't looked at it for years, but didn't it use to be that devices would listen for a de-auth from any source, meaning that a bad actor could poison any wlan in range?

From my understanding, that's how hotels did it to encourage paying for wifi: If Joe starts a hotspot called JoePhone, their systems would automatically start spamming de-auth for JoePhone.

Unless it got fixed in a 2.4/5GHz revision?

[-] dannym@lemmy.escapebigtech.info 8 points 11 months ago

deauth attacks are still a thing, however this is changing with wpa3.

If your router has a setting called "Protected Management Frames" you should enable it ASAP, it's basically encrypted and signed communication for every packet of data, so that your computer basically refuses to trust any deauth signal that doesn't actually originate from the router (massively simplifying here).

[-] terminhell@lemmy.dbzer0.com 2 points 11 months ago

Just double checked mine. Abbreviated as PMF, and it's a toggle to turn OFF. Also have been using wpa3 for a while now.

this post was submitted on 05 Oct 2023
333 points (98.5% liked)

Technology

58144 readers
4351 users here now

This is a most excellent place for technology news and articles.


Our Rules


  1. Follow the lemmy.world rules.
  2. Only tech related content.
  3. Be excellent to each another!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, to ask if your bot can be added please contact us.
  9. Check for duplicates before posting, duplicates may be removed

Approved Bots


founded 1 year ago
MODERATORS