Threat Source newsletter (March 30, 2023) — It’s impossible to tell if your home security camera or doorbell is truly safe

Welcome to this weeks edition of the Threat Source newsletter. Everyone loves a good video of someone slipping on their icy steps in the winter, captured thanks to their home security camera or smart doorbell. But what about when that camera is just kind of chilling out and not catching the momen...

LastPass was undone by an attack on a remote employee

Last August, LastPass suffered a well publicised breach: Developer systems were compromised and source code stolen. This resulted in a second breach in November, which was revealed by LastPass in December. The company has now revealed that the individuals responsible for the attack also compromis...

Hacked Ring Cams Used to Record Swatting Victims

Photo: BrandonKleinPhoto / Shutterstock.com Two U.S. men have been charged with hacking into the Ring home security cameras of a dozen random people and then "swatting" them -- falsely reporting a violent incident at the targets address to trick local police into responding with force. Prosecutor...

Eufy "no cloud" security cameras streaming data to the cloud

Eufy home security cameras are currently in a spot of trouble as a result of door camera footage. This is because it turns out that data which should not have been going to the cloud was doing so anyway in certain conditions. Securing your home: a complicated proposition Insecure cameras,...

Abode Systems, Inc. iota All-In-One Security Kit XCMD setAlexa OS command injection vulnerability

Talos Vulnerability Report TALOS-2022-1558 Abode Systems, Inc. iota All-In-One Security Kit XCMD setAlexa OS command injection vulnerability October 20, 2022 CVE Number CVE-2022-33189 SUMMARY An OS command injection vulnerability exists in the XCMD setAlexa functionality of Abode Systems, Inc. io...

Flaws in Enabot Ebo Air Home Security Robot Allowed Attackers to Spy on Users

By Deeba Ahmed If exploited, the flaw could have allowed an attacker to hijack the devices camera and microphone to spy… This is a post from HackRead.com Read the original post: Flaws in Enabot Ebo Air Home Security Robot Allowed Attackers to Spy on Users...

Reimagine Hybrid Work: Same CyberSec in Office and at Home

It was first the pandemic that changed the usual state of work - before, it was commuting, working in the office & coming home for most corporate employees. Then, when we had to adapt to the self-isolation rules, the work moved to home offices, which completely changed the workflow for many...

How To Compare The Top Home Security Brands of 2022

By Owais Sultan When it comes to choosing the right home security system for your family, it can be difficult to… This is a post from HackRead.com Read the original post: How To Compare The Top Home Security Brands of 2022...

SecuritasHome Startpaket – Security Vulnerabilities

SecuritasHome Startpaket is a home security system from the Swedish company Securitas. It is used to provide comprehensive protection against burglary and fire. A security vulnerability exists in SecuritasHome Startpaket HPGW-G 0.0.2.23F BGU-ITR-F1-BDBL.A30.20181117 version, which allows an...

Command injection

A command execution vulnerability exists in the wificountrycodeupdate functionality of the homesecurity binary of Anker Eufy Homebase 2 2.1.6.9h. A specially-crafted set of network packets can lead to arbitrary command execution...

CVE-2021-21950

CVE-2021-21950 affects Anker Eufy Homebase 2 (binary home_security) with CMD_DEVICE_GET_SERVER_LIST_REQUEST. TALOS details/hardened code path: in recv_server_device_response_msg_process, an attacker-controlled nums value drives a loop that writes domain strings and then writes to a fixed buffer (...

PT-2021-7055

Name of the Vulnerable Software and Affected Versions Anker Eufy Homebase 2 version 2.1.6.9h Description The issue is related to an authentication bypass in the CMD DEVICE GET RSA KEY REQUEST functionality of the home security binary. It can be exploited by a specially-crafted set of network...

PT-2021-5383

Name of the Vulnerable Software and Affected Versions Anker Eufy Homebase 2 version 2.1.6.9h Description A command execution issue exists in the wifi country code update functionality of the home security binary. This is due to the lack of measures to neutralize special elements used in the...

Anker Eufy Homebase 2 home_security CMD_DEVICE_GET_RSA_KEY_REQUEST authentication bypass vulnerability

Talos Vulnerability Report TALOS-2021-1379 Anker Eufy Homebase 2 homesecurity CMDDEVICEGETRSAKEYREQUEST authentication bypass vulnerability November 29, 2021 CVE Number CVE-2021-21952 SUMMARY An authentication bypass vulnerability exists in the CMDDEVICEGETRSAKEYREQUEST functionality of the...

All About Ring’s New Virtual Security Guard

By Owais Sultan Ring’s Virtual Security Guard is a live, customizable motion event monitoring service by Rapid Response that works with the external Ring cameras at home or business. This is a post from HackRead.com Read the original post: All About Rings New Virtual Security Guard...

Fortress Home Security Open to Remote Disarmament

A pair of vulnerabilities in the Fortress S03 WiFi Home Security System could allow cyberattackers to remotely disarm the system, leaving homes open to unlawful entry. The Fortress platform is a consumer-grade home security system that allows users to mix and match various sensors, IP cameras and...

Attackers Can Remotely Disable Fortress Wi-Fi Home Security Alarms

New vulnerabilities have been discovered in Fortress S03 Wi-Fi Home Security System that could be potentially abused by a malicious party to gain unauthorized access with an aim to alter system behavior, including disarming the devices without the victim's knowledge. The two unpatched issues,...

Trend Micro Home Network Security Resource Leak DoS

The vulnerability of the Trend Micro Home Network Security antivirus protection lies in resource release errors. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

Insider Attack on Home Surveillance Systems

No one who reads this blog regularly will be surprised: A former employee of prominent home security company ADT has admitted that he hacked into the surveillance feeds of dozens of customer homes, doing so primarily to spy on naked women or to leer at unsuspecting couples while they had sex. …...

ADT Tech Hacks Home-Security Cameras to Spy on Women

Former ADT employee Telesforo Aviles took note when there were attractive women at a home he serviced in the Dallas area. Then he would add his personal email address to their accounts so he could have around-the-clock access to their most private moments, according to the U.S. Attorneys’ Office...