Critical Amazon Ring Vulnerability Could Expose Camera Recordings

The vulnerability was discovered by Atlanta-based app security firm Checkmarx while assessing the Ring doorbell app for Android.

In May 2022, Amazon was alerted about a high-severity security flaw in its hugely popular home security-oriented Ring app for Android. The vulnerability could allow attackers to access camera recordings from Ring and extract sensitive data.

For your information, the Ring camera app allows homeowners to monitor video recordings from the doorbells and security cameras and boasts over 10 million downloads.

The vulnerability was discovered by an Atlanta-based app security firm Checkmarx while assessing the Ring doorbell app for Android. The flaw could expose sensitive user data, including the following:

• Address
• Full name
• Geolocation
• Email address
• Phone number

Although Amazon quickly fixed the vulnerability in the same month when it was discovered, the details of it were only shared on August 18th by Checkmarx.

According to the company’s blog post, it was a cross-site scripting flaw that could be exploited in an attack chain to trick victims into installing an infected app. This app could hand over the Authorization Token of the device and extract the session cookie by sending the information with the device’s hardware ID to this endpoint– “ringcom/mobile/authorize.”

The victim is tricked into installing that app, which allows the attacker to collect authentication cookies. These cookies would allow the attacker to access a user’s account without entering the password.

Resultantly, the malicious app could steal the Ring user’s private information, geolocation data, and camera recordings, including files and computer screens visible to the app’s camera. The malicious actor may also track the homeowners’ movements inside the rooms or the building.