Hackers Hijack Ring Cameras by Cracking Passwords | News & Opinion

If you own a Ring camera, watch out: Hackers have been hijacking the devices to spy on and harass families in the US.

The hackers have been taking over the home security cameras by cracking the passwords on customer accounts via Ring.com. In the past week, the culprits have victimized at least three families by using the camera's voice function to hurl racial insults and conduct pranks.

In one incident in Tennessee, the hackers pretended to be Santa Claus while speaking to an 8-year-old girl in her room, according to WMC5. Another family in Texas was targeted when their Ring camera's alarm suddenly went off in the night; a voice from the device then demanded 50 bitcoins.

"Very scary to hear a threat shouted over the camera for a ransom," the Ring owner Tania Amador told broadcaster WFAA. "The fact that the person was watching and we don't know for how long is even scarier."

Ring, which is owned by Amazon, told PCMag the company itself has not been compromised. Instead, it's blaming hackers who've been exploiting leaked passwords from past data breaches to help them guess the login credentials to break into Ring customer accounts.

"Recently, we were made aware of an incident where malicious actors obtained some Ring users' account credentials (e.g., username and password) from a separate, external, non-Ring service and reused them to log in to some Ring accounts," the company said. "Unfortunately, when the same username and password is reused on multiple services, it's possible for bad actors to gain access to many accounts."

As Motherboard points out, the hijackings appear to originate from a hacking forum that's been circulating a "Ring Video Doorbell Config" file, which likely contains a list of email addresses and passwords hacking tools can use to automatically log into Ring.com accounts. The hackers went as far to even host a live podcast recording themselves harassing and pranking their victims.

However, the growing media attention around the hijackings has prompted the group to try and cover their tracks. The forum the hackers were using to communicate has now deleted all mention of the Ring Config file, along with the podcast, although archived pages remain online.

To avoid getting hacked, Ring owners (and smart camera owners in general) should consider activating the two-factor authentication on their accounts. This will require anyone logging in to provide both the password and a special one-time passcode generated over the owner's smartphone. Owners can also consider changing the existing password to something more complex, and unique. To help you remember it, consider a password manager.

Ring said it's been blocking the hackers from repeated targeting the affected accounts. The company has also been sending out emails to customers, urging them to activate two-factor authentication and make sure their login passwords are unique. However, the company is refraining from making two-factor mandatory.

Comments are closed.