Arlo Pro 2 Cameras / VMB4000

[smalltalker]

Someone with prior access to my cameras is turning off security cameras (I suspect using Alexa) since they don't have my account credentials.   Is it possible to not allow my arlo devices to be controlled by Alexa?   Why isn't there an option to turn that on or off?  That would an excellent feature if it existed.  Trying to figure out how they are doing it since cameras won't record anything in the window but devices are still accessible.   The only think I can speculate is that it is somehow being controlled thru Alexa where motion detection or cameras are turned off. 

[StephenB]

---

@smalltalker wrote:

Someone with prior access to my cameras is turning off security cameras (I suspect using Alexa) since they don't have my account credentials.   

---

They still need your account credentials to pair with Alexa.

• https://kb.arlo.com/000044726/How-can-I-pair-my-Arlo-cameras-with-Amazon-Alexa

Though you could try changing the Arlo account password, and/or changing the username.  Changing the username would of course require another email address.

---

@smalltalker wrote:

Trying to figure out how they are doing it since cameras won't record anything in the window but devices are still accessible.  

---

Are you talking about a time window here?

• Is the window the same every day?
• Is it during daylight hours or at night?
• Are the cameras on a schedule?
• Is Geofencing in use?
• Are you able to make a manual recording when the devices are accessible?

[smalltalker]

Are you talking about a time window here? 

      No.  It appears to be done when they don't want  to be spotted on the camera or trigger based on motion.

Is the window the same every day?   No. 

Is it during daylight hours or at night? Both
Are the cameras on a schedule? No 

Is Geofencing in use? No

Are you able to make a manual recording when the devices are accessible? 
Yes.  So this rules out tampering with the wifi.   I thought about whether they could be disabling wifi but since I can get to the devices, it rules that out.

Changing the password on the account has not helped.  
Somehow I need to force an unpairing of the Alexa devices from the account so they can't pair it back, but there doesn't seem to be a way (if they are using their own Alexa account).

Also, I have 2 factor auth on my arlo account.   

[smalltalker]

I changed the email on my account.  Let's see if that fixes anything.

[DannyBearAgain]

If you were able to read my deleted posted  reply you would have been able to access your partner platform and granted users and delete them.

check in the settings/privacy centre/partners and account menus.

[smalltalker]

There are NO connected apps and no granted members.  There used to be one that was deleted.  
I guess I can always go thru the process of a factory reset and new setup with the new email on the account but I was hoping to avoid that based on how much trouble that can be.

[DannyBearAgain]

Do you have library label in your app, if you create a new account you will be forced to the new version with the feed label and you can’t go back.

 If you had no partners or granted users attached to your account, theory is your not getting hacked by those methods. That leaves the account access, you can check for multiple logins via the same privacy centre under account/ active sessions.

It could also be arlo of course.

[StephenB]

---

@smalltalker wrote:

Somehow I need to force an unpairing of the Alexa devices from the account so they can't pair it back, but there doesn't seem to be a way (if they are using their own Alexa account).

---

You've jumped to a conclusion about Alexa.  So you might be jumping down a rabbit hole.

You might also want to try the motion detection test in the area where this is happening, and make sure that the camera is reliably detecting motion there.

In any event, if changing the email address doesn't seem to work, you could try deleting the account altogether.  Then create a new one, and re-onboard the cameras.

[smalltalker]

Good point about jumping to the Alexa conclusion.

I jumped to that conclusion because on my phone, I was able to go into the Alexa app, and stop motion detection / turn camera off, but it was still available in arlo app just not being triggered.  So it is possible that there is a loophole in in the implementation.  Unfortunately, I deleted the devices from my phone, but am unable to add them back as Alexa can no longer find those devices (there seem to be a lot of threads around that also).  Otherwise, I would put some detailed test notes out.  To me that means that the other person has Alexa on their own profile with my account information. 
Motion detection absolutely works in the area where this happens.  I have plenty of birds and squirrels that trigger the cameras during the day and middle of night.

[smalltalker]

I was just able to add the cameras back in Alexa. 
I can go into a camera settings in Alexa, and set the Enabled Slider to the left (disabled).  There is no alert on Arlo app.  Everything appears normal.  I can do manual recording.  But it won't do motion detection.  Bingo.  That is how it is being done.  
Not sure if changing the email will fix things.  I will need to be able to find the time when the camera is being subverted and determine if it is still being done or not.  And if it is, then I will remove all devices, and then pair them again.  
Seems like this is a big security loophole that should be addressed.  I have a strong computer and security background and it took me a while to figure out how this might be getting done. 

[smalltalker]

Well, I just tested my theories, and I hate to admit it but I was wrong.
I disabled the cameras in Alexa and arlo still picked up the motion and the recording occurred.  
So it is some other way that the cameras or base station are being disabled.  

[StephenB]

---

@smalltalker wrote:

I can go into a camera settings in Alexa, and set the Enabled Slider to the left (disabled).  There is no alert on Arlo app.  Everything appears normal.  I can do manual recording.  But it won't do motion detection.  Bingo.  That is how it is being done.  

---

One next step would be to change the Arlo account password from a PC (so the phone doesn't have it stored).  Then see if Alexa still lets you do this.

[smalltalker]

I changed the password from the PC.  The Alexa app still allows me to disable the Camera.  But I think the disable is only not allowing the feed to be showing on an Alexa device - not actually disabling the camera.  So it may not be Alexa after all.  

This is a mystery for sure.