Interesting discussion going on over on Reddit.
Seems the Ring Pro has recently started sending data to an IP in China. Thoughts?
So recently installed a ring doorbell and found some interesting network traffic.
At random intervals, it seems to be sending a UDP/1 packet to 106.13.0.0 (China). All other traffic goes to AWS.
Anyone have any thoughts to iot devices calling back to China?
Here is an update from Ring,
Thank you all for your patience. As always, Ring is committed to protecting the privacy and security of our neighbors. I have been monitoring the discussion here closely and understand there is confusion as to what is happening with the Ring Pro device. I would like to take this opportunity to further clarify where we are today.
The security of our devices and protecting our customers’ information are our top priority. Since these posts were raised, we have spent many hours investigating these issues. At this time, it is our assessment this is not a security threat to our customers; we do acknowledge, though, that this architecture could have been better executed.
As background, the data packet that is sent to the IP address in question represents 20ms of audio data. Although some have suggested this could be a vulnerability, we are confident it does not open up the Doorbell to any external threats. Any packets that would have been sent back to the originating IP address of the doorbell were immediately discarded and the socket itself completely shut down after the individual packet had been sent.
What’s more, Ring does not use off-the-shelf cameras from overseas. We work for years, both with partners and internally, to design, manufacture and develop our products; we take extensive measures to build quality products that are secure.
Nevertheless, out of an abundance of caution, Ring has a firmware update ready that will change the way the socket is closed.
This firmware update has begun rolling out and will be active on all Ring Pro devices in the next few days.
We deeply value input from our neighbors and the broader community. We will provide additional updates as appropriate.
Sincerely,
Joshua Roth
Chief Technology Officer at Ring
Even if you believe their claim to have shut the port prior to receiving the reply, this response misses the point that this IP address in China that's collecting all of this audio data now has a complete inventory of the ip addresses of all the Ring doorbells. That makes it pretty simple to mount DoS attacks that would otherwise be more difficult! Unbelievable.
Ask questions and get answers to your physical security questions from IPVM team members and fellow subscribers.
