Used Nest cameras had bug that let previous owners peer into homes

Google says a fix has been found, and the update is being applied automatically.

Google says it has fixed an issue that allowed old owners of Nest security cameras to continue to view a feed from the device, even after de-registering it from their account. The issue could have potentially allowed an old owner of one of the cameras to continue to look through it, even after selling it to someone else. The new owner would have had no indication that a stranger could be able to look inside their home.

“We were recently made aware of an issue affecting some Nest cameras connected to third-party partner services via Works with Nest,” a Google spokesperson said to The Verge, “We’ve since rolled out a fix for this issue that will update automatically, so if you own a Nest camera, there’s no need to take any action.”

WORKS WITH NEST IS BEING DISCONTINUED

The issue was related to Nest’s integration with Wink, a third-party home hub which its cameras connect to using the Works with Nest program. Even though de-registering a Nest cam from your account stops you from being able to view it using Nest’s own app, a user on a Wink Facebook group discovered that they could still view a feed through Wink’s third-party app.

Wirecutter was later able to verify the existence of the problem, which allowed them to view still images from the camera. Since the camera was de-registered from its old Nest account, a new owner would be able to sign up for a new Nest account without any indication that the device was still associated with its old owner in some way. Wirecutter Verified that the problem affected the Nest Cam Indoor, but it’s unclear whether the company’s other connected cameras were also impacted.

It’s telling that the bug appeared through Google’s Works with Nest program, which the company announced it was discontinuing last month. At the time it said it was discontinuing the program in the name of privacy, to stop third party devices from having as much access to data captured by Nest products. Now that we’ve seen the extent of this data sharing, it’s hard to blame them. Works with Nest was originally due to shut down on August 31st, but Google later clarified that customers will be able to continue to use any services and connections until they’re replicated in Google’s new Works with Google Assistant program.

This is the second major privacy scandal suffered by Google’s Nest division this year. Back in February it emerged that the Nest Secure home security system included an on-device microphone, which the company had failed to disclose when it was originally released.

Although Google claims the issue has now been resolved, the process of buying a pre-owned Nest camera can still be complicated. If a previous owner hasn’t de-registered the camera from their account, then the only advice Google’s support page has is to email the previous owner directly to ask them to remove the device. Still, at least you’d be aware that there’s a problem in that case, unlike this more recent oversight.

Source: Jon Porter|@JonPorty (The Verge).
~Best Feeds ™...