A podcast that hacks Ring camera owners live

Re:A podcast that hacks Ring camera owners live by michaeloder on Thursday December 12, 2019 @04:08PM (#21776482)

Why is Ring allowing brute forcing? Individual cameras should be set to only allow logins at least a few seconds apart increasing up to several minutes and perhaps blocking IP addresses with excessive volume. If they're brute forcing Ring's servers an application firewall would catch and block this.

[ Parent | on HN ]

Re:A podcast that hacks Ring camera owners live by goles on Thursday December 12, 2019 @05:21PM (#21777200)

The term for this type of attack is credential stuffing.

https://www.owasp.org/index.php/Credential_stuffing

[ Parent | on HN ]

Re:A podcast that hacks Ring camera owners live by grimmfang on Friday December 13, 2019 @02:23AM (#21779762)

This comment shouldn't be downvoted. This is the correct term.

[ Parent | on HN ]

Re:A podcast that hacks Ring camera owners live by pgoggijr on Thursday December 12, 2019 @04:12PM (#21776530)

I don't think that the above comment means brute-forcing in the "try a million different passwords in a short time-period" sense, it's referring to finding a list of known password and email combinations and trying just those. I would expect that a few attempts wouldn't trip any brute-force alarms.

[ Parent | on HN ]

Re:A podcast that hacks Ring camera owners live by g4k on Thursday December 12, 2019 @05:38PM (#21777355)

Especially if you use a few thousand proxies.

[ Parent | on HN ]

Re:A podcast that hacks Ring camera owners live by SirYandi on Thursday December 12, 2019 @04:24PM (#21776645)

Not actually brute forcing individual ring accounts. They are just using previously leaked combinations

[ Parent | on HN ]