In May, Amazon patched a high-severity vulnerability in their Android application for Ring smart doorbell cameras which if exploited, could expose sensitive user data. The exposed data would include the full name of the user, their email and phone number, geolocation data and street address, as well as the camera video recordings. Researchers from the application security firm Checkmarx first reported this to Amazon via their Vulnerability Research Program. On May 27, 2022, Amazon released a fix for both the Android and iOS Ring applications. The flaw was identified after Checkmarx researchers investigated the Android Ring APK manifest and found an exposed program component known as an “activity” which could be launched by any application installed on the device. To successfully exploit this vulnerability, attackers could install a malicious application that launches the exposed activity and redirects it to an actor-controlled command-and-control (C2) web server. A researcher from Checkmarx stated that by exploiting this vulnerability, it was possible to use Ring’s APIs to extract the customer’s personal and device data. Once they had extracted the video data, the researchers were able to use Amazon’s own machine learning image and video analysis service, known as Amazon Rekognition, to parse through hours of recordings until finding the data that would be considered valuable. At this point, an attacker could use the data to access other parts of the victim network, extort the victim, and spy on their day-to-day activity. At this time there is no evidence that Ring customers were exploited in-the-wild. Amazon was very quick to patch this vulnerability and did not publicly disclose it until a working patch and full report was available. There are over 10 million downloads of the Ring application, and smart doorbells are just one of millions of new IoT devices that represent fresh attack-vectors for threat actors. The Checkmarx report will be published in the coming weeks, and CTIX analysts recommend any Ring customers verify that the software version of their device is up to date to prevent any exploitation attempts.