So this week's nightmare fuel, at least in my corner of the internet, was the story out of a family near Memphis whose Ring camera got taken over by some stranger who started talking to their eight year old through the speaker in her bedroom. Told her he was Santa Claus. Played music. The parents heard it happening and ran in and the thing was still moving on its own, panning around like it had a mind of it's own. I read that story twice before breakfast and then went and unplugged the little Wyze cam I've got pointed at my kitchen, which is probably an overreaction but here we are.
It wasn't an isolated thing either. There've been a handful of these Ring stories floating around this week and last, different families, different states, same basic shape: camera starts talking, camera starts moving, nobody in the house did it. Ring's official line, and I actually think this part is true, is that they weren't breached. No one broke into Ring's servers. What happened is way more boring and way more depressing, which is that a huge pile of usernames and passwords from other breaches (LinkedIn, Yahoo, whichever pick your poison) is floating around on hacking forums, and if you reused one of those same logins on your Ring account, someone just... walked in the front door you left unlocked. Credential stuffing, they call it. Automated tools try millions of leaked email/password pairs against every login page on the internet until a few of them stick.
I get why the headlines say "Ring cameras hacked" instead of "consumers reuse the password baseball1997 across nine different services and one of them happened to control a camera pointed at their kid's crib," but the second headline is the actually true one and nobody wants to read it because it makes the story about us instead of about a scary corporation with a evil-sounding blue logo. Doesn't make it less horrifying to be the family it happened to, obviously. I'm not trying to blame the victims here, reusing passwords is basically the default behavior for like 80% of people and always has been, myself included until embarrassingly recently. I just think it's worth being honest about where the actual hole in the fence is, because "don't buy a Ring" doesn't fix anything if you're going to do the same thing on the next brand's app.
The fix, for what it's worth, is dumb and simple and almost nobody does it: turn on two factor authentication and stop reusing passwords for anything that has a camera or a microphone in your house. Ring apparently added a "control center" thing in the app in the last few months where you can see every device logged into your account and kick strangers out, and enabling 2FA there closes basically all of this off, because a leaked password alone isn't enough anymore. I turned it on for my own stuff this afternoon and it took about four minutes including the part where I had to dig my phone out from under a couch cushion.
None of this is really specific to Ring, and I'd bet money we'll be having the exact same conversation about a different brand of camera sometime next year, because the industry keeps shipping cheap always-on microphones and cameras into bedrooms and nurseries faster than anyone's shipping good default security to go with them. My Wyze cam is back up and running as I type this, by the way, because I decided unplugging it and just being generically more scared of my kitchen wasn't a real strategy. I changed the password to something absurd and long, turned on 2FA, and I'm choosing to feel fine about it, mostly.
Also, completely unrelated but I need to say it somewhere: whoever is in charge of holiday merchandising over at Disney needs to be fired, because there is still no official Baby Yoda toy you can buy anywhere, and Etsy is now an entire marketplace of bootleg 3D printed Grogus in various states of structural integrity. I ordered one for my nephew last week and it arrived looking like it had been left out in the rain for a decade. Get it together.