Ashley LeMay and Dylan Blakeley recently installed a Ring security camera in the bedroom of their 3 daughters, giving the Mississippi parents an extra set of eyes — but not the ones that they had bargained for.
Four days after mounting the camera to the wall, a built-in speaker started piping the song “Tiptoe Through the Tulips” into the empty bedroom, footage from the device showed.
When the couple’s 8-year-old daughter, Alyssa, checked on the music and turned on the lights, a man started speaking to her, repeatedly calling her a racial slur and saying he was Santa Claus. She screamed for her mother.
The family’s Ring security system had been hacked, the family said. The intrusion was part of a recent spate of breaches involving Ring, which is owned by Amazon.
There have been at least 3 similar cases reported this month — the others were in Connecticut, Florida and Georgia. Other breaches, involving Google’s Nest and Taococo, a baby monitor sold on Amazon, have also drawn scrutiny and prompted concerns about privacy.
LeMay, 27, said the Dec. 4 episode unnerved her family, particularly her daughter Alyssa.
“She won’t even sleep in her room,” LeMay said Saturday. “She actually spent the night with a friend the other night because she didn’t want to be here.”
LeMay said that she and her husband, who unplugged the camera, immediately reported the episode to Ring and later to the police in Southaven, Mississippi. Since the episode, she said, her family had been contacted by the FBI and by Ring’s chief operating officer, Jon Irwin.
But she criticized the company’s response, saying it had provided scant information and deflected responsibility for the breaches onto customers.
A Ring spokeswoman said in a statement Saturday that the company took the security of its devices seriously and attributed the recent episodes to hackers gaining users’ login credentials.
“Our security team has investigated this incident and we have no evidence of an unauthorized intrusion or compromise of Ring’s systems or network,” the statement said. “Recently, we were made aware of an incident where malicious actors obtained some Ring users’ account credentials (e.g., username and password) from a separate, external, non-Ring service and reused them to log in to some Ring accounts.”
Ring users can monitor the cameras on the company’s smartphone app and speak to people inside their home and at their front door using a two-way audio feature. But cybersecurity experts say all it takes is a username and password for hackers to gain access to the devices.
Ring said it began sending emails this weekend to its millions of customers, reminding them to use multifactor authentication, which requires users to verify their identity by entering a code that they receive as a text message or by using an authentication application, in addition to their password.
“Unfortunately, when the same username and password is reused on multiple services, it’s possible for bad actors to gain access to many accounts,” the statement said.
A spokesman for the Jackson, Mississippi, field office of the FBI said he could not confirm or deny that the episode was being investigated. The Southaven police chief, Macon Moore, said Monday that the case was under investigation but would not comment further because the investigation was active. He also said that police had not received other reports.
Cybersecurity experts said it’s not that difficult for hackers to gain access to “internet of things” devices, which include Ring security cameras and voice assistants, such as Alexa and Google Home.
“Unfortunately, we’re so reliant on passwords at this point, but passwords are absolutely the weakest link,” said Tim Weber, security services director for ADNET Technologies in Farmington, Connecticut.
Weber, who is a certified ethical hacker, said he had not seen any evidence that Ring’s operating platform had been breached. He recommended that people avoid reusing old passwords because they could have already been compromised as part of a previous data breach without users even knowing it.
“People are honestly struggling right now because they have so many passwords to maintain,” he said.
In Waterbury, Connecticut, Ed Slaughter told NBC Connecticut last week that he felt “violated” after a hacker started yelling obscenities and woke up his mother-in-law, who had been sleeping in the basement where he had installed a Ring camera. Efforts to reach Slaughter were unsuccessful.
In Cape Coral, Florida, Josefine Brown told NBC 2 that she was frightened by an episode in which a hacker could be heard in footage from a Ring security camera provided to the station asking the interracial couple if their son was a “baboon.”
In an email Sunday, Brown said: “We are very concerned about our safety and privacy because we thought having a security camera will keep us safe. We don’t know how long someone has been watching us. It is very scary.”
She said that after listening to the voices on videos in the other Ring cases, she was convinced it was the same person who hacked her device.
A Georgia woman told WSB-TV 2 that she was terrified when a man started talking to her through her Ring camera while she was in bed. The station did not name the woman.
Kelli Burgin, chairwoman of the cybersecurity department at Montreat College in North Carolina, said there are inherent risks with new smart devices.
“Nothing is 100 percent secure,” she said. “It takes a lot of layers of defense to make things more secure and to lower the risk. I understand the convenience of getting these devices, but I would also hate to see children exploited. We don’t know how long someone may be monitoring those cameras.”
In addition to multi-factor authentication, she recommended using passphrases instead of passwords, because they are harder for hackers and computers to guess.
LeMay, who works the overnight shift as a laboratory scientist at a hospital, said she thought she had been getting peace of mind with the Ring camera, as one of her daughters suffers from seizures.
Now, she said, the family is on edge.
“I’m definitely very paranoid,” she said. “Yesterday, I told my husband, ‘I really want to get away from here for a bit.’”
2019 The New York Times Company
source: news.abs-cbn.com
Connor Ball, the 23-year-old bassist of British pop band the Vamps, was in the shower when he realized something was up. The song he was listening to on Spotify, by American singer Lauv, had suddenly stopped.
“That’s a shame,” Ball remembered thinking. (He couldn’t start it again; he was still showering.) Then another song started playing. The music was odd, like nothing he would choose to play for himself.
“It was atmospheric, almost like massage music,” he said.
He soon realized that he had been hacked. The music was playing on Google Chrome, a web browser that Ball does not use. Weeks later, he has not yet changed his password, he said, because of “laziness.” So he has continued to endure his hackers’ strange taste.
Asked how he pictured the person choosing the songs, he said, “I’m imagining a 70-year-old bald man in a rocking chair.”
Accounts get compromised. It’s the way of things. (Spotify said in a statement that it takes “all fraudulent activity on our service extremely seriously” and recommended that its users protect themselves by refraining from using the same user names and passwords across various accounts.) These digital incursions can be unsettling (when not outright upsetting), but they’re often impersonal. Usually, one doesn’t think about one’s hacker too often.
That seems to be less true when it comes to music. When a Spotify account gets hacked, the hackee is able to see the music the hacker has chosen (either on the hacker’s device, or sometimes, presumably by accident, on the hackee’s). A portrait of the hacker often emerges.
“I assumed it was like some sad teenager going through a breakup, listening to bad music,” said Charlene Coughlin of her hacker.
Coughlin, 36 and an advertising executive in Cleveland, was hacked last Saturday. She was in the car listening to either Christmas music or Taylor Swift (she couldn’t recall which), when there was an interruption. When she got home, she looked on her laptop and found her hacker was listening to a playlist of “sad trap music” on a device named Sophia’s iPhone.
Despite the imagined breakup, Coughlin did not feel sorry for this alleged Sophia. “I was mostly a little irritated that someone had broken into my account,” she said.
While Coughlin turned to Spotify and Ball to apathy, other victims of hacking have come up with ingenious ways to drive their hackers out. Margaret Harris, a 23-year-old Toronto resident, realized she had been hacked over the summer when she found a playlist of EDM with song titles in what looked like Cyrillic characters.
She deleted the playlist, but every couple of days it would come back. And her hacker — whom she imagined as “some Russian guy in his car,” though he listened through a web browser and nothing explicitly indicated that he was a man — got more aggressive.
The two of them started fighting over the account as if they were grappling for sole authority over the remote control.
“We were actively having this Spotify battle,” she said. “His music would start. I would just keep hitting pause and playing mine.”
After seeing that the hacker was playing music from Firefox, she had a “eureka” moment. Harris is a metal fan and she wracked her brain for a particularly intense song. She settled on “Bleed,” by Swedish metal band Meshuggah. (Opening lyrics: “Beams of fire sweep through my head / Thrusts of pain increasingly engaged.”)
“I would skip to the middle of the song where it’s most hard-core, and I would crank my Spotify and play it through his computer,” she said. She did this several times.
Though the hacker fought back at first, eventually the interruptions ceased, she said. She had driven the intruder out. “Which is great,” she said.
Some hacks do not seem altogether human. Anneke Schuurman, a high schooler who lives on Vancouver Island in Canada, likes to listen to soft indie music as she falls asleep. (Like Ball, she enjoys Lauv.)
“Over the night it changes what it’s playing,” she said. “I wake up in the morning and it’ll be some weird genre I don’t listen to.”
She suspects that a bot is responsible for the “relaxing music” playlists that started to flood her library.
“Obviously people can listen to relaxing music, but it was too often. Like that was the only thing that they’re listening to,” she said.
A similar idea occurred to Chris Pantin, a 19-year-old sociology student in California, when he was hacked in March. His hacker played an album by Los Angeles rapper YG on repeat. (The first time it happened, the music started playing out of his laptop in the middle of a chemistry class.)
“It almost makes me feel like there’s some weird hack to try to get streams,” Pantin said.
Recently, he has been hacked again. This hacker he imagines to be a human — “probably a skinny white boy who’s short,” he said. The hacker likes what appears to Pantin to be Eastern European club music, music the student thinks is actually pretty decent. And what’s more, this hacker has shown some social grace, unlike the previous one.
“They would be trying to listen to music while I was listening to music so they cut me off. Always with the YG album,” Pantin said. “Whoever’s doing it now just stops listening to the music when I start playing mine. So I’ve just let it happen because it’s not bothering me as much.”
source: news.abs-cbn.com
SEOUL - The personal information of nearly 1,000 North Koreans who defected to South Korea has been leaked after unknown hackers got access to a resettlement agency’s database, the South Korean Unification Ministry said on Friday.
The ministry said it discovered last week that the names, birth dates and addresses of 997 defectors had been stolen through a computer infected with malicious software at an agency called the Hana center, in the southern city of Gumi.
“The malware was planted through emails sent by an internal address,” a ministry official told reporters on condition of anonymity, due to the sensitivity of the issue, referring to a Hana center email account.
The Hana center is among 25 institutes the ministry runs around the country to help some 32,000 defectors adjust to life in the richer, democratic South by providing jobs, medical and legal support.
Defectors, most of whom risked their lives to flee poverty and political oppression, are a source of shame for North Korea. Its state media often denounces them as “human scum” and accuses South Korean spies of kidnapping some of them.
The ministry official declined to say if North Korea was believed to have been behind the hack, or what the motive might have been, saying a police investigation was under way to determine who did it.
North Korean hackers have in the past been accused of cyberattacks on South Korean state agencies and businesses.
North Korea stole classified documents from the South’s defense ministry and a shipbuilder last year, while a cryptocurrency exchange filed for bankruptcy following a cyberattack linked to the North.
North Korean state media has denied those cyberattacks.
The latest data breach comes at a delicate time for the two Koreas which have been rapidly improving their relations after years of confrontation.
The Unification Ministry said it was notifying the affected defectors and there were no reports of any negative impact of the data breach.
“We’re sorry this has happened and will make efforts to prevent it from recurring,” the ministry official said.
Several defectors, including one who became a South Korean television celebrity, have disappeared in recent years only to turn up later in North Korean state media, criticizing South Korea and the fate of defectors.
source: news.abs-cbn.com
Computer hackers have struck PGA of America servers at this week's 100th PGA Championship, demanding a Bitcoin ransom to unlock files without risking data not easily replaced, Golfweek's website reported.
The files, Golfweek said, contained digital promotional banners and logos used on signs around Bellerive as well as materials for next month's Ryder Cup in France.
The PGA of America does not intend to meet extortion demands, unnamed sources told the magazine, and the organization has retained outside information technology experts to ensure the year's final major tournament remains unaffected, according to the report.
The PGA had no comment on the matter.
PGA play began Thursday at Bellerive Country Club. The Ryder Cup is set for September 28-30 at Le Golf National in Paris.
Tournament staff discovered Tuesday their files had been compromised when a message told them their network had been hacked and information files encrypted, with any attempt to unlock the files risking their permanent loss, according to Golfweek.
A Bitcoin wallet number was provided, but no specific ransom amount was requested.
The stolen files, according to the report, also include development work on logos and signs for future PGA Championships, much of it not easily replaced.
Future PGA Championships, to be staged in May starting next year, include 2019 at Bethpage Black, 2020 at San Francisco's Harding Park, 2021 at Kiawah Island, 2022 at Trump National in New Jersey, 2023 at Oak Hill, 2024 at Valhalla, 2027 at Aronimink, 2028 at San Francisco's Olympic Club and 2029 at Baltusrol.
source: news.abs-cbn.com
