Wyze says one of its employees switched off the protection on a database, and for about three weeks in December the data sat open to anyone who found it. Security firm Twelve Security put the number of affected customers at more than 2.4 million.
The company announced on December 26 that it had been told of a leak. Dongsheng Song, a Wyze co-founder and its chief product officer, traced it to an internal project to measure basic business figures such as device activations and failed connection rates. “We copied some data from our main production servers and put it into a more flexible database that is easier to query,” he wrote. The new table was protected when it was created. “However, a mistake was made by a Wyze employee on December 4th,” Song said, and the earlier security protocols were removed.
CNET reported the exposure ran from December 4 through December 26.
What was exposed
Twelve Security’s list was long. It covered user names and emails of people who had connected cameras, emails of anyone they had shared access with, camera nicknames, models and firmware, Wi-Fi network names, and API tokens that let a phone reach an account. It also named Alexa tokens for 24,000 users. Wyze quoted the list in its own post.
A smaller set was more personal: height, weight, gender and other health details. Wyze said that group was 140 external beta testers. It disputed part of the list, saying it does not collect bone density or daily protein intake data, even in products still in beta.
No passwords or financial information were exposed, the company said. After a further review it reported a second unprotected database, and said that one also held no passwords or financial data.
The response
Wyze logged every user out as a precaution and asked people to relink integrations with Google Assistant, Alexa and IFTTT. It said it had no evidence login tokens were exposed, and that customers should expect their cameras to reboot automatically in the coming days.
GeekWire’s reviewer gave the company credit for speed and detail, though not for everything. Wyze did not force password resets. The reviewer called that a missed chance, since people often reuse passwords on connected devices, and noted that two-factor authentication offers no protection against a leak of this kind. Camera nicknames could be a particular problem: a name such as “Betty’s Room” tells a burglar where a child sleeps.
Wyze, founded in 2017 by a group of Amazon veterans and based in Kirkland, Washington, sells low-priced cameras, plugs and bulbs. It has raised $20 million in venture capital. GeekWire noted that the company moved to address rapid growth quickly, and that the same speed produced the mistake.
The company rejected a separate claim that it sends user data to Alibaba’s cloud in China. “Wyze does not use Alibaba Cloud,” it said, and the claim was false. It added that it does not share user data with any government agencies in China or any other country.
In its post, Wyze said the incident was “a clear signal that we need to totally revisit all Wyze security guidelines in all aspects”, and promised to give more priority to security features users have asked for beyond two-factor authentication.
Sources
- Wyze data leak: Key takeaways from server mistake that exposed information from 2.4M customers
- Wyze data leak may have exposed personal data of millions of users – CNET
