Huge Vulnerability Discovered in the Ring Doorbell

<!-- wp:paragraph --> <p>Besides raising serious privacy concerns about what exactly is being sent in the end-of-call packets and who may be receiving them, this behavior creates a potential back-door into the Ring device by opening a hole in the Wi-Fi network the Ring is on, such that data coming back from China can get through a router to to the device.</p> <!-- /wp:paragraph -->

<!-- wp:paragraph --> <p>In fact, because the device uses UDP, anyone willing to spoof the Chinese IP Address would be able to return traffic to a Ring Device if they could find it. This could, depending on the firmware of the Ring’s camera, leave it open to command-and-control protocols similar to what happened with the Mirai botnet.</p> <!-- /wp:paragraph -->

<!-- wp:heading --> <h2 id=" />Everyone Needs to Care About IoT Security

This kind of behavior probably isn’t isolated to just Ring, as most well-known IoT camera devices aren’t actually manufactured by the company selling them. In most cases these devices are actually manufactured overseas by companies like Dahua, Acti, and Hikvision.

This mean that the firmware on the camera often isn’t maintained by the manufacturer. So while consumers may be willing to trust Ring, by using the Ring Doorbell consumers are also unknowingly choosing to trust the manufacturer of the camera.

To further aggravate the problem, Ring might not be able to do anything to address this vulnerability. As mentioned, in all likelihood Ring doesn’t write the firmware on the camera.

In order for the Internet of Things to be secure, every stakeholder from the hardware manufacturer to the service creator has to take security seriously. As we’ve just seen with Ring, even if the customer-facing company cares deeply about security, if the firmware provider doesn’t then it doesn’t matter.

Until everyone takes IoT security seriously, instances like the Mirai Dyn DNS attacks will keep happening with the potential for much darker consequences. Delayed service to websites is one thing, but when the Internet of Things increasingly includes things like medical devices and transportation, the stakes become much higher.

Update: IoT For All spoke with a Ring representative January 31, 2019 who gave the following statement: "As a security company on a mission to reduce crime in neighborhoods, security is at Ring’s core and drives everything we do. This was not a security threat to Ring customers, however, we did change the protocol via a firmware update immediately. Ring dedicates significant time and money to product and network security. We have an in-house team that is constantly working to ensure Ring products are secure; we also work with several outside firms to do intrusion testing on all devices."