For most of December 2019, a database full of Wyze customer records sat open to anyone who knew where to look. From Dec. 4 through Dec. 26, nobody needed a password to read it.
Wyze, the US company known for cheap security cameras and smart door locks, confirmed the exposure on a Friday, after the security firm Twelve Security raised the alarm. Twelve Security put the number of affected customers at more than 2.4 million. That is a lot of living rooms, nurseries and front doors watched by one brand.
What was sitting in the open
Wyze said the exposed material included email addresses, Wi-Fi network IDs and what it called body metrics. It stressed that no passwords and no financial details were in the database. Co-founder Dongsheng Song made the same point in a forum post.
Twelve Security described a longer list. Its researchers said the data also covered a list of the cameras in each home, API tokens and health figures such as height, weight, gender, bone density, bone mass and protein intake. Wyze pushed back on several of those items. It denied that API tokens, bone density or protein intake were leaked, and said the body metrics belonged to a small group of beta testers, about 140 people who were trying out new hardware. Their height, weight, gender and other health details were visible.
The security researcher Bob Diachenko, who posted about the case on 28 December 2019, said the Elasticsearch cluster held 1,807,201,457 records of log data, API requests and events.
A copied table, a removed lock
Song’s explanation was ordinary, which is partly what makes it uncomfortable. Wyze was growing fast and wanted to measure things like device activations and failed connections. So the team copied some records off its main production servers into a new database that was simpler to search. That new table started out protected. Then, on Dec. 4, an employee made a mistake while working in it, and the earlier security settings came off.
Song said the database was not a production system, though it did hold user data. “We are still looking into this event to figure out why and how this happened,” he wrote.
The picture got slightly worse over the weekend. In an update on Sunday, Song said the investigation had turned up a second unprotected database. Wyze did not say what it contained, only that passwords and personal financial data were not in it.
What customers were told to expect
Wyze said it had no evidence that login tokens were exposed, but it signed every user out anyway so that new tokens would be generated. Customers were also told their cameras would reboot automatically over the following days. The company planned to notify affected customers by email.
The Twelve Security researcher was blunt about the stakes. “If this was intentional espionage or gross negligence, it remains a malicious action that must be answered in the form of a decisive, external, and fast investigation by US authorities,” the researcher wrote.
Wyze’s own verdict on itself was gentler but still stark. “This is a clear signal that we need to totally revisit all Wyze security guidelines in all aspects, better communicate those protocols to Wyze employees, and bump up priority for user-requested security features beyond 2-factor authentication,” the company said. CNET reported that Wyze did not answer its request for further comment.
For families who bought a camera because it cost little and set up in minutes, the lesson is a plain one. The cost of that convenience is paid in trust, and Wyze spent most of December 2019 with that trust unlocked.
Sources
- Wyze data leak may have exposed personal data of millions of users – CNET
- IoT maker Wyze suffers data leak, exposes personal data of 2.4 million customers – TechSpot
Sources
- Wyze data leak may have exposed personal data of millions of… – CNET
- IoT maker Wyze suffers data leak, exposes personal data… | TechSpot
