Wyze uses ThroughTek vulnerable IoT service

  • Release Candidate 6
    We are at a “proposed final” true release candidate with nothing known remaining to be changed or fixed. For the full story, please see this page in the "Pre-Release Announcements & Feedback" forum.
  • Be sure to checkout “Tips & Tricks”
    Dear Guest Visitor → Once you register and log-in:

    This forum does not automatically send notices of new content. So if, for example, you would like to be notified by mail when Steve posts an update to his blog (or of any other specific activity anywhere else), you need to tell the system what to “Watch” for you. Please checkout the “Tips & Tricks” page for details about that... and other tips!



Active member
Oct 22, 2020
In SN 833, @Steve discussed the Mandient/FireEye research into ThroughTek's IoT SDK and some major vulnerabilities. I recall hearing this from the FireEye post "Mandiant was not able to create a comprehensive list of affected devices..." Ha! This is typical of vulnerability research. Very rarely do you get lists of devices, unless they were specifically tested. FireEye doesn't even tell us that. They say "ThroughTek’s clients include IoT camera manufacturers, smart baby monitors, and Digital Video Recorder (“DVR”) products." The IoT camera link goes to https://www.throughtek.com/case-studies/ which ThroughTek has taken down.

Fortunately, we have the Internet Archive (why not make a donation for their valuable service!).

This reveals the one widely recognizable name in ThroughTek's partners is Wyze. I guess that's how you sell a camera for $30.

The complete list of clients on their page (as of 17 Aug 2021):
Their "partner" list includes industry consortiums for computer makers, cloud service providers, and an electric vehicle platform.

"What could go wrong?"