If you’re so inclined, you can read the full White Paper on the Bitdefender website.Īccording to Bitdefender, all Ring Doorbell Pro cameras have received the security patch that fixes this flaw.

At this point, the mobile app loses connectivity and instructs the user to reconfigure the device.” Bitdefender One way to do this is to continuously send deauthentication messages, so that the device gets dropped from the wireless network.

“Another important step in exploitation is thew fact that a hostile actor can trigger the reconfiguration of the Ring Video Doorbell Pro. Data exchange is performed through plain HTTP, which means that the credentials are exposed to any nearby eavesdroppers. “When entering configuration mode, the device receives the user’s network credentials from the smartphone app. At that point, the hacker could listen in during the reconfiguration of the device to gain those credentials. While this seems unlikely, the issue was further compounded by the fact that a remote reconfiguration of the doorbell could be triggered at will. In plain English, what this means is that if a hacker was so inclined and sitting nearby, they could intercept said data and then gain access to your Wi-Fi network. And here we are two months later with both companies releasing the disclosure of said flaw.Īs for the bug itself, the setup configuration for Amazon’s Ring Video Doorbell Pro sent the user’s network information through the app via a non-HTTPS connection. Bitdefender alerted Amazon and after some back and forth, finally confirmed that a fix was “being partially deployed” in September. The security flaw was first discovered in June. We rolled out an automatic security update addressing the issue, and it’s since been patched.” UPDATE (): A Ring spokesperson reached out to Techaeris with the following statement concerning this story: “Customer trust is important to us and we take the security of our devices seriously. Another day and another security flaw exposed… this time, Bitdefender and Amazon have disclosed a since-patched bug in which Ring Video Doorbell Pro setups were sending user Wi-Fi passwords through unsecured HTTP requests.

Bitdefender 2019 update