Incident: Amazon Key Security Vulnerability Allows Camera Disabling and Intrusion.

Published Date: 2017-11-16

Postmortem Analysis
Timeline 1. The software failure incident with Amazon Key's Cloud Cam occurred in November 2017 [65139].
System 1. Amazon Key service 2. Cloud Cam 3. Wi-Fi devices 4. Zigbee wireless protocol
Responsible Organization 1. The security researchers from Rhino Security Labs discovered and demonstrated the Amazon Key attack, where they were able to disable and freeze the Cloud Cam [65139].
Impacted Organization 1. Amazon customers were impacted by the software failure incident [65139].
Software Causes 1. The software cause of the failure incident was a vulnerability in the Cloud Cam's software that allowed for a deauthorization attack, which could disable and freeze the camera, potentially enabling rogue delivery people to exploit the security system [65139].
Non-software Causes 1. Lack of physical security measures in place to prevent unauthorized access to the home [65139]
Impacts 1. The software failure incident with Amazon Key's Cloud Cam being vulnerable to a deauthorization attack had the impact of potentially enabling rogue delivery people to stealthily steal from Amazon customers or invade their homes undetected [65139]. 2. The incident raised concerns about the security of Amazon Key as a safe solution, as disabling the camera on command could compromise the critical safety mechanism relied upon by Amazon [65139]. 3. The failure led to a loss of trust and privacy for Amazon Key users, as the camera could be frozen on a closed door image while an intruder enters the house, without any alert to the user [65139]. 4. The incident highlighted the need for a software update to address the vulnerability in the Cloud Cam and improve the security of Amazon Key deliveries [65139].
Preventions 1. Implementing stronger authentication mechanisms for the Cloud Cam to prevent unauthorized deauthorization commands, such as requiring multi-factor authentication for critical actions like disabling the camera [65139]. 2. Conducting thorough security testing and audits on the Amazon Key system to identify and address vulnerabilities before the service is launched to the public [65139]. 3. Enhancing the Cloud Cam's firmware to include features that detect and alert users when the camera is being tampered with or disconnected from the network [65139]. 4. Providing customers with the option to store a certain amount of recording locally on the Cloud Cam itself, ensuring that critical events are captured even if the camera loses internet connectivity [65139].
Fixes 1. Amazon plans to send out an automatic software update to address the issue with the Cloud Cam vulnerability [65139].
References 1. Security researchers at Rhino Security Labs [65139]

Software Taxonomy of Faults

Category Option Rationale
Recurring unknown The software failure incident described in Article 65139 involves a security vulnerability in Amazon's Amazon Key service, specifically related to the Cloud Cam camera. This incident highlights a potential flaw in the security system where the camera can be disabled and frozen by sending deauthorization commands, allowing unauthorized access to a customer's home. (a) Regarding the occurrence of a similar incident within the same organization (one_organization), the article does not mention any previous instances of a similar software failure incident happening within Amazon or with its products and services. (b) In terms of a similar incident happening at other organizations or with their products and services (multiple_organization), the article does not provide information about comparable incidents occurring elsewhere.
Phase (Design/Operation) design, operation (a) The software failure incident in the article is related to the design phase. The incident occurred due to a vulnerability in the design of Amazon Key's security system, specifically with the Cloud Cam. Security researchers discovered that a simple program could disable and freeze the camera, allowing rogue delivery people to potentially steal from Amazon customers or invade their homes without detection. This vulnerability was not a software bug in Cloud Cam but rather an issue with Wi-Fi devices in general, which allowed for the camera to be taken offline without alerting the user. Amazon responded by planning to send out an automatic software update to address the issue [65139]. (b) The software failure incident is also related to the operation phase. The incident involved the operation of the Amazon Key service, where a delivery person could exploit the vulnerability in the Cloud Cam design to disable the camera and gain unauthorized access to a customer's home. This operation-based failure allowed for potential theft or invasion of privacy without triggering any alerts or suspicions from the system. Amazon mentioned that it verifies the delivery person's identity and address before unlocking the door for a delivery, but the vulnerability in the operation of the system still posed a significant security risk [65139].
Boundary (Internal/External) within_system, outside_system (a) within_system: The software failure incident described in the article is primarily within the system. The security researchers demonstrated that a simple program could be run to disable and freeze the Cloud Cam, a component of Amazon Key's security system, allowing unauthorized access to homes. This issue was not a software bug in Cloud Cam itself but rather a vulnerability in Wi-Fi devices that could be exploited to keep the camera offline without alerting the user. Amazon responded by planning to send out an automatic software update to address the issue [65139]. (b) outside_system: The software failure incident also involves factors originating from outside the system. The attack on the Cloud Cam involved exploiting a vulnerability in Wi-Fi devices, specifically using a "deauthorization" command that could kick the camera offline. This technique is not specific to Cloud Cam but is a broader issue affecting practically all Wi-Fi devices. The attack demonstrated by the security researchers highlighted how an external factor, such as the Wi-Fi vulnerability, could be leveraged to compromise the security of the system [65139].
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident in the Amazon Key service was due to non-human actions. Security researchers demonstrated that a simple program run from any computer in Wi-Fi range could disable and freeze the Cloud Cam, allowing rogue delivery people to stealthily steal from Amazon customers or invade their homes [65139]. (b) The software failure incident in the Amazon Key service could also be attributed to human actions. The attack demonstrated by the security researchers involved a delivery person running a program on their laptop or a handheld device to send deauthorization commands to the home's Cloud Cam, exploiting a vulnerability in the Wi-Fi network [65139].
Dimension (Hardware/Software) hardware, software (a) The software failure incident related to hardware can be seen in the article where security researchers demonstrated that the Cloud Cam, an internet-enabled camera designed to work with Amazon Key service, could be disabled and frozen with a simple program run from any computer in Wi-Fi range. This issue was not a software bug in Cloud Cam but rather an issue with practically all Wi-Fi devices, allowing anyone to spoof a command from a Wi-Fi router that temporarily kicks a device off the network [65139]. (b) The software failure incident related to software can be observed in the same article where the security researchers demonstrated that a delivery person could run a program to send "deauthorization" commands to the home's Cloud Cam, causing it to be offline and freeze on the last frame it saw when connected. This issue was not a software bug in Cloud Cam but rather a vulnerability in how the camera responded to external commands, potentially allowing rogue delivery people to exploit this flaw and invade customers' homes without detection [65139].
Objective (Malicious/Non-malicious) malicious (a) The software failure incident described in the article is malicious in nature. Security researchers demonstrated how a simple program could be used to disable and freeze Amazon's Cloud Cam, allowing rogue delivery people to stealthily steal from Amazon customers or invade their homes without detection. The attack involved sending deauthorization commands to the home's Cloud Cam, exploiting a vulnerability in Wi-Fi devices to keep the camera offline while showing a fake image to the user. This malicious act was aimed at compromising the security of Amazon Key users [65139].
Intent (Poor/Accidental Decisions) unknown (a) The intent of the software failure incident was not due to poor decisions but rather due to a vulnerability in the design of the Amazon Key service. Security researchers discovered a flaw in the Cloud Cam, which allowed a delivery person to disable and freeze the camera, potentially enabling unauthorized access to customers' homes [65139]. This incident was not a result of poor decisions but rather a security vulnerability that was exploited. (b) The software failure incident was not a result of accidental decisions but rather a deliberate attack exploiting a vulnerability in the Cloud Cam. The attack involved sending deauthorization commands to the camera to keep it offline, allowing unauthorized access to customers' homes without detection [65139]. This incident was a calculated exploit of a security flaw rather than an accidental mistake.
Capability (Incompetence/Accidental) development_incompetence, unknown (a) The software failure incident related to development incompetence is evident in the Amazon Key service vulnerability discovered by security researchers. The incident allowed rogue delivery people to disable and freeze the Cloud Cam, providing them the opportunity to enter a customer's home undetected. This vulnerability was not a software bug in Cloud Cam but rather an issue with Wi-Fi devices that allowed for spoofing commands to keep the camera offline. The failure to address this security flaw could potentially compromise the safety and security of Amazon Key users [65139]. (b) The accidental software failure incident in the Amazon Key service was not explicitly mentioned in the provided article. Therefore, it is unknown if the incident was accidental in nature.
Duration temporary The software failure incident described in the article is temporary. The incident involved a security vulnerability in Amazon's Cloud Cam, which allowed a delivery person to disable and freeze the camera, giving the appearance that everything was normal while they could enter the house undetected [65139]. The article mentions that Amazon responded by planning to send out an automatic software update to address the issue later that week, indicating that the failure was not permanent and could be remedied through a software update.
Behaviour value, other (a) crash: The software failure incident described in the article does not involve a crash where the system loses state and stops performing its intended functions. Instead, the incident involves a security vulnerability in Amazon's Cloud Cam that allows the camera to be disabled and frozen, giving a misleading view to users [65139]. (b) omission: The incident does not involve the system omitting to perform its intended functions at an instance(s). Instead, the vulnerability allows the system to be manipulated to show a false image while someone gains unauthorized access to a user's home [65139]. (c) timing: The incident does not involve the system performing its intended functions too late or too early. The vulnerability allows the system to be manipulated in real-time to deceive users about the security status of their home [65139]. (d) value: The software failure incident does involve the system performing its intended functions incorrectly. The vulnerability allows the Cloud Cam to be disabled and frozen, showing a false image to users while someone gains unauthorized access to their home [65139]. (e) byzantine: The incident does not involve the system behaving with inconsistent responses and interactions. The vulnerability in the Cloud Cam allows for a specific attack scenario where the camera can be manipulated to show a false image while unauthorized access is gained to a user's home [65139]. (f) other: The behavior of the software failure incident can be categorized as a security vulnerability that allows for unauthorized access to a user's home by manipulating the Cloud Cam to show a false image while someone gains entry [65139].

IoT System Layer

Layer Option Rationale
Perception sensor, network_communication (a) The failure was related to the perception layer of the cyber physical system that failed due to contributing factors introduced by sensor error. The incident involved a security vulnerability in Amazon's Cloud Cam, which is an internet-enabled camera designed to work as part of the Amazon Key service. Security researchers demonstrated that the camera could be disabled and frozen by sending deauthorization commands to it, which exploited a Wi-Fi vulnerability common to many devices, including sensors like the Cloud Cam. This sensor error allowed unauthorized access to the system, potentially compromising the security of Amazon Key users' homes [65139]. (b) The failure was not directly related to an actuator error, as the incident primarily focused on the security vulnerability of the Cloud Cam sensor rather than any issues with the actuator component of the cyber physical system. (c) The failure was not directly related to a processing unit error, as the vulnerability exploited in the incident was more related to the sensor (Cloud Cam) and network communication aspects rather than a processing error. (d) The failure was related to the perception layer of the cyber physical system that failed due to contributing factors introduced by network communication error. The attack on the Cloud Cam involved sending deauthorization commands to the camera, exploiting a Wi-Fi vulnerability that allowed the camera to be knocked offline. This network communication error enabled the attacker to freeze the camera on a specific image, providing unauthorized access to the system [65139]. (e) The failure was not directly related to an embedded software error, as the vulnerability exploited in the incident was more related to the sensor (Cloud Cam) and network communication aspects rather than an issue with the embedded software itself.
Communication link_level, connectivity_level The software failure incident described in the article [65139] was related to the communication layer of the cyber-physical system that failed at both the link level and connectivity level. 1. **Link Level**: The failure at the link level was demonstrated by the security researchers who were able to disable and freeze the Cloud Cam by sending "deauthorization" commands to the home's Cloud Cam. This technique exploited a vulnerability in the Wi-Fi devices, allowing anyone to spoof a command from a Wi-Fi router that temporarily kicks a device off the network. This action effectively disabled the camera, showing a frozen image to the user even as unauthorized access occurred [65139]. 2. **Connectivity Level**: The failure at the connectivity level was highlighted by the fact that the Cloud Cam communicates with the Amazon Key lock on the door via the Zigbee wireless protocol through the Cloud Cam, which acts as its connection to the Wi-Fi router and the internet. Disrupting the Cloud Cam's connectivity not only affected the camera but also prevented the door from locking, potentially enabling unauthorized access to the home [65139]. Therefore, the software failure incident in this case involved failures at both the link level (related to the physical layer) and the connectivity level (related to the network layer) of the cyber-physical system.
Application FALSE The software failure incident described in the article [65139] was related to the application layer of the cyber physical system. The failure was due to a vulnerability that allowed a delivery person to disable and freeze the Cloud Cam, an internet-enabled camera designed to work with Amazon Key service, by sending deauthorization commands. This vulnerability was not a software bug in Cloud Cam but rather an issue with Wi-Fi devices in general, allowing the camera to be kept offline without alerting the user. The attack involved running a program on a laptop or a handheld device to send these commands, demonstrating a flaw in the application layer security of the system.

Other Details

Category Option Rationale
Consequence property, theoretical_consequence (a) unknown (b) unknown (c) unknown (d) The software failure incident described in the article [65139] could potentially lead to property loss or theft. The security researchers demonstrated that by exploiting a vulnerability in the Amazon Key service's Cloud Cam, rogue delivery people could stealthily steal from Amazon customers or invade their homes without leaving any suspicious logs or entries. This could result in property loss for the affected individuals. (e) unknown (f) unknown (g) unknown (h) The article [65139] discusses potential consequences of the software failure incident, such as the ability for rogue delivery people to compromise the security of customers' homes without triggering any alerts or suspicions. The article also mentions the potential for theft or spying by exploiting the vulnerability in the Amazon Key system. (i) unknown
Domain information (a) The failed system in the incident was related to the information industry. The software failure incident involved Amazon Key, an internet-enabled camera called Cloud Cam, which was part of Amazon's security system for the Amazon Key service [65139].

Sources

Back to List