A blaring siren suddenly rips through the Ring camera, startling the Florida family inside their own home.
“It’s your boy Chance on Nulled,” a voice says from the Ring camera, which a hacker has taken over. “How you doing? How you doing?”
Videos by VICE
“Welcome to the NulledCast,” the voice says.
The NulledCast is a podcast livestreamed to Discord. It’s a show in which hackers take over people’s Ring and Nest smarthome cameras and use their speakers to talk to and harass their unsuspecting owners. In the example above, Chance blared noises and shouted racist comments at the Florida family.
“Sit back and relax to over 45 minutes of entertainment,” an advertisement for the podcast posted to a hacking forum called Nulled reads. “Join us as we go on completely random tangents such as; Ring & Nest Trolling, telling shelter owners we killed a kitten, Nulled drama, and more ridiculous topics. Be sure to join our Discord to watch the shows live.”
Software to hack Ring cameras has recently become popular on the forum. The software churns through previously compromised email addresses and passwords to break into Ring cameras at scale. This has led to a recent spate of hacks that have occurred both during the podcast and at other times, several of which have been covered by local media outlets. In Brookhaven a hacker shouted at a sleeping woman through her hacked Ring camera to wake-up. In Texas, a hacker demanded a couple pay a bitcoin ransom. Hackers targeted a family in DeSoto County, Mississippi, and spoke through the device to one of the young children.
Ring cameras are the wildly popular home surveillance devices owned and heavily marketed by Amazon. The company has signed partnership agreements with hundreds of police departments around the country; many of these police departments have marketed and sold Ring devices on the company’s behalf. These internet-connected cameras have invaded much of America’s suburbs, as Gizmodo showed using data that Ring left exposed. These hacks, and this podcast, have turned devices nominally designed to protect people’s homes into surveillance devices that have been turned back on their owners.
After the recent media attention about Ring hacks, Nulled members are scrambling to remove evidence of the Ring hacks and distance themselves from the practice.
“Hey NulledCast fans, we need to calm down on the ring trolling, we have 3 investigations and two of us are already probably fucked,” one of the self-described podcast staff wrote on a NulledCast Discord server that Motherboard gained access to. “Drop suggestions on what else we should do. It will still happen just on a much smaller scale,” they added.
On the Nulled forum, which has thousands of members, administrators tried to delete all evidence of Ring hacking by rolling back the entire forum’s database by four days.
Do you know anything else about breaking into Ring cameras? We’d love to hear from you. Using a non-work phone or computer, you can contact Joseph Cox securely on Signal on +44 20 8133 5190, Wickr on josephcox, OTR chat on jfcox@jabber.ccc.de, or email joseph.cox@vice.com.
While Motherboard was originally reporting on the existence of dedicated tools for breaking into Ring cameras, the Nulled website went offline for “unscheduled maintenance,” a placeholder on the site read Wednesday. When the site returned, threads about Ring had been deleted.
A Nulled admin then added a message to the site.
“Following the recent news regarding Ring and various members, we feel it is necessary to address and [sic] concerns or malformed notions. Nulled does not and will not tolerate the harassments [sic] of individuals over Ring cameras or similar,” the message read. It then added that discussing Ring accounts and similar topics was banned from the site, as well as selling any Ring or Nest accounts.
“No discussing in Shoutbox regarding this,” the message read, referring to an instant chat service on Nulled.
The Discord members are split into various groups, such as podcast staff, podcast members, and podcast advocates. In all, around 200 people are members of the Discord server where hackers livestream the hacking of Ring cameras.
In a now deleted thread, a Nulled user wrote, “Hello everyone. As you probably have heard, I was featured on the news for a stunt I pulled.” Motherboard was only able to view a partial archive of the message.
On Thursday, some members of the Discord appeared to be panicking, changing their usernames and some saying they are quitting because mainstream media outlets are now covering the Ring hacking.
A Ring spokesperson previously said in a statement, “Customer trust is important to us and we take the security of our devices seriously. While we are still investigating this issue and are taking appropriate steps to protect our devices based on our investigation, we are able to confirm this incident is in no way related to a breach or compromise of Ring’s security.
“As a precaution, we highly and openly encourage all Ring users to enable two-factor authentication on their Ring account, add Shared Users (instead of sharing login credentials), use strong passwords, and regularly change their passwords,” it added.
“It’s fucked dude. It’s everywhere,” one user wrote on the Discord server.
“I’m quitting. It’s on mainstream news now,” another responded.
“Lmfao doesn’t matter nothing’s gonna happen,” another said.
“Only chance and faez will get arrested don’t worry,” a fourth responded, referring to the hacker named during the Florida Ring hijacking.
It doesn’t seem the livestreaming of Ring hacking is going to end just yet, however.
“Podcast dead?” one user on the Nulled Discord asked Wednesday night.
Another user replied, “Nope. Tune in Friday. Like and subscribe.”
Subscribe to our cybersecurity podcast, CYBER.
