Arlo Camera Hacked

[SecuriConcerned]

Today, my system was hacked!

I have two cameras setup at my house. One in front and one in the backyard. The backyard camera is missing video for 3hrs when a visitor was looking at the property. The backyard videos are present immediately before and after the visitors were there. Also, front camera worked the entire time.

Arlo has not helped resolve this issue.

Warning that your system is likely highly vulnerable!

[jguerdat]

That's a pretty broad statement given that you haven't provided any useful information. It's extremely unlikely the system has been hacked unless you 1) use a weak password and 2) don't have 2FA enabled. There have been no actual instances reported of successful hacks that I'm aware of.

There can be a number of reasons for missing videos, from the camera not being armed, power and/or Internet being down, motion not being detectable, etc.

[SecuriConcerned]

Thanks for the reply. Here are the additional details you requested:
- Password was strong
- 2Fa was setup and in use.
- No power or internet outages during this period (this would have cause both cameras to not work, our oven clock to rest and several other wifi devices to need rebooting - which did not occur)
- Camera is always armed (no schedule) and was armed during this period.
- as for motion not being detectable:
— the camera is outside with no physical barriers and is placed such that people must walk within 2 feet of the camera to enter the house. One person takes up roughly 1/4 of the screen when entering.
—- The same camera was able to detect one single human the entire morning prior to this event and afterwards.

I am not sure what information you wanted with “etc.”. It’s not a pretty broad statement that doesn’t provide any useful information. I can say:
—- Two cameras were fully functional before, one camera was fully functional during, and both were fully functional afterwards.
— Arlo confirmed there was a network system error on their end about 1hour prior to this event. They did not publish this issue on their website though, so maybe the agent was just making up a story? But also, the time period the system was reportedly down does not match the time that 1 of 2 cameras was not recording. If the system was down then video should be missing from both cameras.

At this point, it seems like one camera was hacked.

It’s not a very useful term when asking for details.

[MVT]

I'd say it was unlikely you were "hacked".  Arlo "smart" just probably thought the people were shadows of a tree or something and  the "smart" algorithm just ignored them.  It is not uncommon for recordings to be missed with Arlo - just read more here.....

[SecuriConcerned]

There are no trees causing shadows around the camera view. It looks like your message got truncated or is missing a link to more information. While it is common that Arlo will sometimes miss motion, I have found these issues occur only with the following scenarios:

1. Motion is too fast so the camera starts recording after the object has passed. Best fix is have the camera look over a wider area, or make the objects approach "parallel" to direction the camera is pointed. This will cause the object to be in frame longer. I used this strategy in setting up my cameras and has worked wonders in the past.

2. Pause between videos. There is a pause between videos when motion events occur. A false trigger (such as bird flying to nearby nest) can cause you to miss out on getting the face of a person stealing your bbq... this has happened. It was my fault and I fixed it a long time ago. 

3. Shadows: when shadows rapidly move across the camera's view, the camera has a hard time knowing shadow from person. Fix by ramping up sensitivity and getting a lot of videos of your trees, (which can lead to issue #2), or moving the camera to a better spot. 

4. Camera behind a window. Yup, I once tried setting cameras up indoors and looking through the window. At night time, they just see the reflection of the house interior. Also get a lot of "false starts" do to reflections on the glass and light refracting through the window. I Don't recommend putting the cameras behind any barrier. 

Have I missed anything? Do you mind showing the relevant topic? 

As for "hacked". This is a general term meaning the device and/or system was compromised by an external party. Maybe they hacked into the cloud storage and deleted video (unlikely through my account with 2Fa, but possible from server side). Maybe they managed to remotely turn off the camera (no idea how that would happen and nothing I've seen in the blogs provide an explanation). Maybe they aimed some sort of signal jammer at the one camera which caused it to not trigger anything. 

I have spent a lot of time previously setting up my cameras, modifying the layout and settings based on real world experience, and maintaining passwords to keep this system operating at a point that I get 99% of all video I needed. I've been able to catch several porch pirates and animal sightings. This is the first time the system has failed in an utterly spectacular and coincidental way to a known time people were around a camera for several hours. I was really hoping Arlo was going to say it was a Cloud recording error, but they didnt. 

Instead, I am left only with an extremely odd coincidence that the only time a camera failed was when someone came to the house with knowledge of 1 camera location. 

[MVT]

Nothing truncated - I meant read the various messages and you'll find lot's of missed recording posts.  Don't worry, support will tell you it is something to do with your set up or your internet speed......

[StephenB]

---

@SecuriConcerned wrote:

Maybe they aimed some sort of signal jammer at the one camera which caused it to not trigger anything. 

---

FWIW, This bit doesn't fit the definition of "hacked" - which means "to gain illegal access to (a computer network, system, etc.)" Though a signal jammer is illegal in most juristrictions. 

Do you have USB storage connected to your base?  If you do, did you look there to see if there are any recordings?

[MVT]

"Do you have USB storage connected to your base?  If you do, did you look there to see if there are any recordings?"

My beef with this is that if Arlo is recording - it should be on the web - after all I am PAYING for this service!!!  there is no reason a recording should be stored locally and not also sent to the web portal!  What if you don't want to manage local storage?  what if you don't have memory installed?  Local storage is great if your system is local, but many use it to monitor remote locations with no access to the local storage.  At worst case, the device should store and forward any local recordings to the web so that the 30 day window matches exactly.  Nowhere does Arlo state that recordings might only be stored locally and not uploaded to the web.  The subscription inference is that you will get EVERYTHING uploaded to the web library! 

[StephenB]

---

@MVT wrote:

My beef with this is that if Arlo is recording - it should be on the web - after all I am PAYING for this service!!! 

My reply was directed to @SecuriConcerned. No matter the cause, he is missing recordings and I'm assuming that he'd like to have them if possible. If he has local storage, he should check it - as in practice it often does have recordings that don't show up in the cloud.

Note that if he is using Cloud Activity Zones, then the cloud will intentionally drop recordings if it detects that they are out-of-zone.  I also believe that there was an outage - I've heard some other reports on this - and that likely lasted for a while.  In either of these scenarios, the recordings would be in local storage, but would not be in the cloud.

[dcfox1]

@SecuriConcerned   There was an outage yesterday afternoon (USA) for about several hours. I had no cloud recordings at all including past ones. . The did come back when it was back up Don't know if that was your problem though. . It is listed on Arlo outage  site for the 27th. 

Arlo

[SecuriConcerned]

I do not have a local storage (USB or otherwise). 

If a lot of other people are having this issue, why do you jump to "Its impossible to be hacked"? Also, I am a bit disappointed the use of "etc" or "...." to explain a malfunction away as a user error versus Arlo error.

Random disappearance of information from a cloud based product is a major issue! It is either internal (Arlo) errors that are not being publicized to save face of poor system design/maintenance, or the system is being compromised a lot! 

The reality is that cloud based systems are being hacked (jammed, compromised, whatever easier to digest term you want to call it). So stop telling people "no way the system got hacked", but then immediately pointing out that a lot of users have the same unresolved issues. Until Arlo is able to clearly answer why the issue occurred, it is more and more becoming reasonable to assume either a local camera was compromised or the digital cloud based content was compromised.

[SecuriConcerned]

@dcfox1 No issues with being able to view videos. One of two cameras had video during the down time.

[MVT]

I get cloud recordings that are outside of set activity zones.

[StephenB]

---

@SecuriConcerned wrote:

So stop telling people "no way the system got hacked"

FWIW, I didn't tell you that.

---

@SecuriConcerned wrote:

Until Arlo is able to clearly answer why the issue occurred, it is more and more becoming reasonable to assume either a local camera was compromised or the digital cloud based content was compromised.

---

This is a community forum, and no one from Arlo has commented so far.  Support might be able to find more evidence in their logs. Attaching a usb thumb drive to your base would give you more clues if this were to happen again.

Although I haven't (ever) said hacking - using the dictionary definition - is impossible, IMO other explanations are more likely in your case. A system or camera malfunction (perhaps related to the outage somehow), or a wifi jammer seem more likely to me.

Someone simply seeing your camera is very unlikely to be able to instantly hack into your account - they'd need to know it was an Arlo camera, they'd need to know your account user name, and have the technical knowledge needed to defeat the network security in a way that bypassed 2FA - and be able to execute their attack using their mobile device.