Thread by @fs0c131y

<Thread> Few days ago, @Gizmodo published an awesome investigation about the Neighbors app by @ring. The article is doing an excellent job but no technical details are given. So I decided to give a look at the crime-alert app made by Amazon 1/ gizmodo.com/ring-s-hidden-…

@Gizmodo @ring In the article, @dellcam explained that by examining the network traffic of the Neighbors app, we can get the geographic coordinates of a camera. 2/

@Gizmodo @ring @dellcam So I installed the app on a phone, intercepted the traffic and used all the possible features of the app 3/ play.google.com/store/apps/det…

@Gizmodo @ring @dellcam Bingo! When the app retrieves the details of an alert, the geographic details of the camera is in the response. 4/

@Gizmodo @ring @dellcam This is what an alert looks like in the app. The location of the camera is not given, only "X miles away". This a clear leak of personal information from @ring 5/

@Gizmodo @ring @dellcam In his article @Gizmodo mentionned the work of Dan Calacci, a PhD student at the Massachusetts Institute of Technology’s (MIT) Media Lab. He managed to enumerate the location of all the @ring cameras in the US. How did he do it? 6/

@Gizmodo @ring @dellcam This is quite easy. In the "get alert details" request you just have to change the alert id: /api/alerts/<alert_id> 7/

https://twitter.com/fs0c131y/status/1208013052924354560?s=20

@Gizmodo @ring @dellcam As a result, you will have the location of the @ring cameras who shared an alert at least once in the past. 8/

@Gizmodo @ring @dellcam In another article, @josephfcox from @VICE mentionned that some hackers are able to crack @ring accounts. How they are doing that? 9/ vice.com/en_us/article/…

@Gizmodo @ring @dellcam @josephfcox @VICE Unfortunately, this is quite easy. An attacker has two choices:
- use a list of already compromised combinations from other services
- If you know the victim's email you can bruteforce the password. There is no rate limitation on the server side... 10/

@Gizmodo @ring @dellcam @josephfcox @VICE I successfully bruteforce my own account... 11/

@Gizmodo @ring @dellcam @josephfcox @VICE Also, there is no authentication to access the videos of alerts shared by @ring users. 12/ nhshare.ring.com/17148411/00059…

@Gizmodo @ring @dellcam @josephfcox @VICE No authentication to access the photos too... 13/ nhshare.ring.com/7707699/000581…

@Gizmodo @ring @dellcam @josephfcox @VICE Don't tell anyone, but if you want to have fun the api and the staging env urls are available in the app. 14/

@Gizmodo @ring @dellcam @josephfcox @VICE That's the end. Don't buy a product with such lousy security 15/15