Chinese Smart Home Manufacturer Orvibo (Still) Leaking Sensitive Information

Unsecured ElasticSearch clusters containing over two billion user logs were leaked from Chinese smart home manufacturer Orvibo over the weekend. Leaked logs were found to contain sensitive customer ranging from email addresses and passwords, to precise geolocation data and conversations recorded by Orvibo's so-called "smart camera." At the time of this publication, Orvibo has neither responded to attempts to contact the vendor, nor have they made any fixes to this security issue.

Recommendations

• If you are using an Orvibo device, ZeroFOX recommends immediately changing your login credentials to prevent the device from being accessed or rendered unusable by attackers.
• Ensure that you are not reusing passwords for multiple devices. If your credentials are leaked by a breach such as this one, it could result in a chain of account compromises.
• Consider enabling the Cyber Chatter rule to monitor for discussion of this leak on covert channels.

Details

In a breach disclosure released on July 1, 2018, it was revealed that the Chinese manufacturer Orvibo has failed to secure ElasticSearch clusters containing plain text, sensitive customer logs, and as a result, over two billion logs have been leaked. Orvibo sells everything from smart lighting, to home security devices, to HVAC and energy control devices. This breach contained information from customers all over the world, and included the following sensitive information, among other things:

• login credentials, including hashed but unsalted password that could easily be cracked by an attacker
• precise geolocation data
• IP addresses
• recorded conversations
• scheduling information

Repercussions of this breach could potentially be severe. An attacker could login as an affected user, and change log in credentials, effectively locking a victim out of their device. This would provide the attacker with full control of the device, which could provide an attacker with access to information like a video feed from a smart camera, or precise geolocation and scheduling information from a smart lock which would allow an attacker to unlock a victim's door. As of July 1, 2019, Orvibo has failed to respond to multiple attempts by researchers to disclose this breach, and the company has failed to offer any kind of fix or resolution of the massive information leak. As no resolution has been offered by Orvibo, it appears that sensitive customer information will continue to be leaked.