Wyze Acknowledges Security Breach Letting Users View Thumbnails of Others’ Homes

Recent reports have revealed a significant security incident involving the Wyze camcorder systems. Users of this system found themselves able to view the interiors of other people’s homes, all of whom also had these devices installed. This alarming breach in security was attributed to a misassignment of the device and user identifier that occurred in response to the service outage that took place on Friday.

Wyze’s cloud services provider, Amazon Web Service (AWS), experienced a temporary disconnection on Friday, which affected Wyze’s cameras and home video surveillance system. This disruption in service was highlighted by Wyze themselves.

Unfortunately, this drop in service led to a security breach. Several users reported this breach on various social networks and forums, including Reddit, stating that they were able to view inside the homes of other Wyze camera users.

The technology company acknowledged this issue in a statement they shared on their own forum. They clarified that the live broadcast was not affected, nor was access to the videos granted. The security breach specifically affected the event notification system and only displayed a thumbnail of a camera that did not belong to the user.

Wyze co-founder David Crosby has assured that immediate action was taken upon discovering these events. The events tab was disabled, and an additional layer of verification was added for each user before they could view the thumbnails. This security measure was accompanied by a mandatory logout from the Wyze app to “reset the tokens.”

On Monday, Crosby affirmed that they had communicated with Wyze users based on the impact the security flaw had on them. He acknowledged that around 13,000 users viewed thumbnails that were not their own in their Wyze accounts, and 1,504 users clicked on them, primarily to enlarge them. However, he assures that “no event videos were touched or viewed.”

“The incident was triggered by a third-party caching client library that was recently incorporated into our system. This client library was subjected to unprecedented load conditions caused by devices coming back online simultaneously. As a result of the surge in demand, the system mixed up device and user ID mapping and connected some data to the wrong accounts,” explains Crosby.