Wyze suffers yet another security camera breach—so who’s watching the watchers?
This latest breach is just another in a long line of issues for the smart home manufacturer
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
The new security breach to hit Wyze and its cameras is just the latest in a long—and we do mean long—line of privacy screw ups which have plagued the home security market since the category arrived on the scene. The breach, where 13,000 users received thumbnail images from stranger’s cameras, has been a clear disaster for a company which has garnered something of a tarnished reputation because of its attitude to its customers in the past.
The breach was heralded by a large service outage for the smart home brand thatsevered the connection between Wyze’s app and its camerason February 16, leaving users to flood the internet with complaints that their cameras weren’t working. Issues ranged from cameras going offline, to being unable to connect their camera to the internet, to one user even claiming that they could view a video feed that wasn’t theirs. Wyze blamed the issue onAmazonWeb Services (AWS), citing a problem with “device connection [that] caused login difficulties”. It was on February 21 that the true extent of the breach was discovered—namely that 13,000 users had images of their homes displayed on other users' apps.
The earliest security alarm systems were probably squawking geese in 300 BC, but it wasn’t until sophisticated file compression, Wi-Fi and more powerful microprocessors opened the floodgates in 1997 that the wholehome securityindustry really took flight. The market is nowpredicted to be worth $84 billion by 2027, a credible number since we’re now at some180 million security cameras, video door bells and other assorted tools installed in homes across the globe.
But this huge adoption curve has brought with it a slew of problems from the industry failing to adequately protect the privacy of its customers.
Way back in 2012, a hacking blog called Console Cowboysexposed a method by which anyone could hack into a $70 camerafrom a company called Trendnet, and watch people in their houses day or night. The exploit was available because of unpatched firmware, which unsuspecting users didn’t know they had to update.
Links to thousands of private home camera feeds were posted online, and the uproar reverberated around the forums and message boards of the Internet at the time. The company got lucky, and received just a slap on the wrist from the FTC, presumably because the breach was only counted in the thousands.
This was just the first in a long line of abuses. By 2018 over 21 million cameras were in use, and one of the big players, Swann, reachedthe front page of the BBC websitewith a breach story of its own. The OzVision software they used let strangers access remote Swann cameras at will. Another camera brand, Flir, also suffered the same software problem.
Get the best Black Friday deals direct to your inbox, plus news, reviews, and more.
Sign up to be the first to know about unmissable Black Friday deals on top tech, plus get all your favorite TechRadar content.
In 2019 stolen passwords were used to terrorize a California couple bybroadcasting a fake emergency missile attack warningthrough their Nest camera. Nest ownerGooglereset all Nest accounts to solve the problem. A mere year later another tech giant,Amazon, found itself on the wrong end of a class action lawsuitfiled by more than 30 families who suffered a breach of their Ring doorbell camera systems. Hackers screamed obscenities, demanded money and threatened the home owners, again using the camera’s speaker system. As with many of these stories, however, the cases seemed to quietly disappear after the initial media attention, either through settlement or abandonment.
To return to Wyze, it is no stranger to security breaches. In 2019, the company was warned aboutthree vulnerabilities with its home security camera systems. The problems were not fixed in a timely manner, and probably remain an issue in discontinued products. In this case, the impact was not too widespread, but what set the alarms ringing was the fact that Wyze seemed to do the bare minimum to help their users at the time…Which is a strange thing for a security company to do. Some commentators felt the company should be trying harder.
This 2019 misstep was followed by a similar issue in 2022, when cybersecurity researchers discovered that apermanent vulnerability in the same model of Wyze camerascould allow cybercriminals to hack into users’ cameras, watch recorded content and even compromise the camera’s security further. The vulnerability, if exploited, could allow hackers to take full control of the device, including disabling microSD recording, turning the camera on and off and even changing the direction it was facing in, functionally allowing cybercriminals to spy on victims even if they could not access the camera’s live video feed. The vulnerabilities were reportedly patched in 2019 and 2020, yet the camera could still be accessed via its SD card, leaving users in a “permanent window of vulnerability”, as stated by the researchers.
These unaddressed vulnerabilities led to Wirecutter magazine taking the unprecedented step ofremoving Wyze cameras from all their recommendation guidesin September of 2023, citing the fact that “Wyze has failed to develop the sorts of robust procedures that adequately protect its customers”. Just five months later here we are, with the company facing yet another problem breach.
Once again the company initially downplayed the issue, claiming that only 14 users were affected, until being forced to admit that it was in fact over 13,000. Whilethe company has now apologized, it has left a sour taste in many user’s mouths as they seek explanations for the data leaks.
It’s clear that this history of security lapses is unlikely to stop anytime soon. In the meantime the industry continues to advise users to use strong passwords and keep their firmware and software updated. Finally users should also remember that they also have a duty to respect the privacy of those neighbors who may be subject to their surveillance footage. The UK’s surveillance commissioner has issueda guide to the use of domestic CCTV, and how users should be careful about capturing and storing footage. Doing it the wrong way can leave you open to a fine, especially if you breach the European GDPR regulations. It’s worth a read.
These security breaches that exposed people in the presumed safety and vulnerability of their own homes serves as a reminder that cyber security is not something to be overlooked. While we may be aware of the danger physical criminals to our homes, cybercriminals remain a threat. This is why it’s important to consider running yourhome security camerathrough an encrypted networkthrough a VPN routeror byusing a VPN. By doing so, you will enhance the privacy and security of your internet connection in your household, by protecting your connection and masking your credentials.
Nigel Powell is an author, columnist, and consultant with over 30 years of experience in the tech industry. He produced the weekly Don’t Panic technology column in the Sunday Times newspaper for 16 years and is the author of the Sunday Times book of Computer Answers, published by Harper Collins. He has been a technology pundit on Sky Television’s Global Village program and a regular contributor to BBC Radio Five’s Men’s Hour. He’s an expert in all things software, security, privacy, mobile, AI, and tech innovation.
Reolink Altas PT Ultra review: a security camera that’s great for continuously monitoring your property
Ring Pan-Tilt Indoor Cam review: would make the perfect indoor security camera if it wasn’t missing this one key thing
I’ve been a Firefox power user since it launched 20 years ago – here’s why it still beats Chrome and Safari
