Amazon Ring Neighbors Exposes Customer Data
A significant security issue with the Amazon-owned Ring Neighbors app exposed the exact location and the home address of users. The leak comes on the heels of the late 2020 Ring camera hack incident that led to users launching a class action suit against Ring.
Ring was acquired by Amazon back in 2018 - the same year when the company launched Neighbors as a separate app. According to the app's own description, it allows users to "get real-time crime and safety alerts from neighbors and local law enforcement".
The security issue with the Neighbors app allowed bad actors to acquire the location data of users who submitted reports and posted inside the app - an act that is normally done without disclosing exact location. The issue caused the application to extract the exact coordinates of people submitting the reports, right from the Ring servers.
The issue was further complicated by the fact that each user post was assigned a numeric value that was incremented for new posts. This sort of setup made it relatively easy to snatch location data from previous posters, even if they were not in the same neighborhood area.
Ring came up with a statement, informing the bug had been fixed, along with the usual reassurances about how serious the company's policies are when it comes to user security.
Ring came under fire once again in late 2020, when people took up a class action lawsuit against the company. The suit alleges insufficient security measures installed and enforced with Ring cameras.
Ring had previously come out with a somewhat controversial statement, which many perceived as shifting the blame to the end users for not having enabled two-factor authentication on their devices, even though they could have.
MFA was later enforced upon all users inside the application. This happened in the wake of the discovery that hackers were working on dedicated tools used to crack Ring accounts and steal credentials and a chunk of over 1000 user passwords was leaked online.
