Millions of smart home devices will go online next week as people give security cameras, doorbells, thermostats and televisions as Christmas gifts. Activating them without taking a few security measures can be a terrible mistake.
It’s tempting to open the box and get the device up and running as soon as possible. Devices like the Ring doorbell are easy to set up. Just connect it to a home’s WiFi network, download and app and connect.
Anyone can download the app and, if they have my username and password, could watch through any camera they find online. That’s most likely how some Ring security cameras are being hacked now. But no matter if your device is a Ring, Nest, Arlo, or one of the many Chinese camera brands on Amazon, it’s important to change your login credentials as soon as you set up the camera.
If you already have a camera installed, check its password. Is it the same password that came with it, or did you change it and use the same one for something else?
Ring has confirmed that some 3,600 user accounts were leaked online that included the account’s username and password and even the name of each camera on the account. Ring did not say where the leak occurred, only that it did not originate within its own security systems.
So why should you use different passwords for different accounts? Here’s how the bad actors operate: There is a leak of one company’s database that includes usernames, email addresses and passwords. This happens every day. Once leaked, bad guys often put the database for sale on the dark web. Someone then buys that list and can target people on it. If they have the username and password, they can then start trying the same login credentials on other sites, such as popular smarthome security systems.
So, whether it’s a new gaming system, security camera, or an app that comes with a gift this Christmas, don’t sign up and sign in with the same password you use everywhere else.
Also, if it is an option, active 2-factor authentication for each account. This will require that anyone signing in to a service to confirm the sign-in using the phone number provided on the account.
