Ring fixed a security flaw in its Android app that could have leaked video footage

What you wish to have to grasp

• Amazon has patched a security vulnerability in Ring’s Android app.
• The security flaw could have allowed unhealthy actors to get entry to customers’ video footage via putting in a malicious app at the identical tool.
• Amazon mentioned that it had discovered no proof of the vulnerability being exploited in the wild.

Amazon’s Ring doorbell cameras don’t seem to be precisely probably the most protected house gadgets to be had, and a new file would possibly supply additional proof to strengthen this declare.

Security researchers at Checkmarx discovered a vulnerability (opens in new tab) in Ring’s significant other app for Android telephones after examining it. The instrument security company discovered a number of insects in the app that, when stitched in combination, could grant different apps at the identical tool get entry to to it. In the worst-case state of affairs, those could be malicious packages that trick customers into putting in them.

In flip, it could have allowed unhealthy actors to realize get entry to to customers’ video footage saved in a Ring video doorbell, in line with Checkmarx. Furthermore, person knowledge together with complete title, e-mail deal with, phone quantity, and geolocation could have been uncovered. The app containing the vulnerability has greater than 10 million downloads.

However, Amazon informed the security supplier that the vulnerability “could be extraordinarily tough for someone to take advantage of, as it calls for an not likely and sophisticated set of instances to execute.”

Amazon mentioned that it had rolled out a repair for the problem on May 27 after Checkmarx reported the security flaw. Fortunately, the corporate discovered no proof of purchaser knowledge being uncovered to malicious actors.

The newest vulnerability is the most recent incident in which Ring figured in a security factor. In 2020, it used to be discovered that Amazon staff have been allowed to view video footage, with get entry to ranges that went past what their task required. In July, the corporate additionally admitted to liberating 11 clips to regulation enforcement with out person consent this 12 months.