0

I recently put up a Wyze Cam, a brand of Wi-Fi security camera, and I am curious as to how (in)secure it is. I heard that the Wyze company servers got breached once before. How easily could an attacker gain access to my account? Also, if the attacker was connected to the same Wi-Fi network, could he intercept the images directly, or is it encrypted between the camera and the Wyze company's servers?

2
  • 1
    It's more or less impossible to answer a question like this. There's no scale of "security units", so an answer needs to describe in detail every possible vector of attack and the difficulty in exploiting it; and even if someone could gather all of this information, it's bound to change as the product changes, so it will inevitably be out of date. Apr 22 at 19:45
  • What we can talk about are the general security considerations of wifi cameras, or how to protect yourself when using them (maybe - that might be too broad as well). Apr 22 at 19:46

1 Answer 1

1

You can find specifics on the security disclosures with a little bit of research, but Wyze products running the latest firmware currently have no known, disclosed vulnerabilities since the previous issues were patched in January 2022. The reason Wyze's reputation has come under scrutiny recently is due to the time (3 years) between the company (Wyze) becoming aware of the issues in 2019 and the patching of those issues in 2022 as well as the severity of the issues themselves (see below) and the relative difficulty of patching firmware on many already-deployed devices.

Three years is a very long time for the vulnerabilities to be actively exploited, and exploitation of the vulnerabilities could mean live camera access (spying) as well as access to recorded videos. For a physical security product, it should go without saying that this is extremely bad.

From a write-up on the disclosure whitepaper (BitDefender):

While Wyze finished patching the vulnerabilities in January 2022, both Bitdefender and Wyze have been criticized for their handling of the findings, as Bitdefender initially alerted Wyze to the vulnerabilities three years ago in March 2019. In addition to making security software, Bitdefender has a research arm that tests products for vulnerabilities.

The first vulnerability allows hackers to bypass the account log-in process and access users’ cameras. The second allows hackers to run their own software code on exposed cameras. And the third allows hackers to access saved footage on cameras that use an SD card. (Wyze also offers cloud video storage.)

Not the answer you're looking for? Browse other questions tagged or ask your own question.