| Ring Stick Up Cam Battery
|
|
Security Grade
Calculator v1
|
Ring Stick Up Cam Battery
Category: Smart Camera • Model / Gen: 2nd Gen Stick Up Cam Battery (B07Q9LQVTQ)
Release Date: 2019-04-01 • Status: End of sale
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
Rare
|
🔗 Proof
|
Early Ring doorbells leaked Wi-Fi configuration to someone pressing the setup button (CVE-2015-4400); that is the closest documented local attack and no mass physical tampering was found for the Stick Up Cam.
|
| Known vulnerabilities
|
Rare
|
🔗 Proof
|
CVE-2019-9483 (Ring devices before 3.4.7 mishandled encryption, allowing audio/video disclosure or spoofed video) is the main device-level advisory; later Ring CVEs mostly concern the app or Amazon services.
|
| Prior attacks
|
Rare
|
🔗 Proof
|
No Ring product appears in CISA KEV; widely reported 2019 incidents were credential-stuffing account takeovers, not device exploitation.
|
| Updatability
|
Very common
|
🔗 Proof
|
Ring pushes firmware automatically over Wi-Fi with no user action required.
|
| Category Score
|
Score: 2 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
Full
|
🔗 Proof
|
Devices are owned by a Ring account and shared per-user; Alexa integration is brokered through the same Amazon identity.
|
| Communications
|
Encrypted with obselete encryption
|
🔗 Proof
|
Current firmware uses TLS for cloud streaming, but the published mishandled-encryption flaw (CVE-2019-9483) and the absence of end-to-end encryption on most Ring streams keep this out of the current-encryption band.
|
| Storage
|
Encrypted with up-to-date encryption
|
🔗 Proof
|
Recordings live only in Ring/Amazon cloud storage under account-scoped encryption; the camera keeps no user footage locally.
|
| Category Score
|
Score: 2 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Full
|
🔗 Proof
|
Ring account supports shared users, roles, device ownership transfer and remote session revocation.
|
| Authentication
|
Secure
|
🔗 Proof
|
Ring supports and strongly encourages two-step verification and passkeys, which is the main control against the account-takeover pattern seen in 2019.
|
| Brute-force protection
|
Exist
|
🔗 Proof
|
Account login has rate limiting, breach-password checks and verification challenges after repeated failures.
|
| Event logging
|
Access event logged
|
🔗 Proof
|
The app exposes device event history and account login/device-authorisation history ('Authorised Client Devices').
|
| Passwords
|
Require change after setup with complexity requirements
|
🔗 Proof
|
Passwords must meet Amazon complexity rules and are checked against known-breached credentials.
|
| Category Score
|
Score: 1 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
Ring embedded firmware (Companion App: Ring app (Android/iOS))
|
| Hardware (CPU / GPU)
|
CPU: • GPU:
|
| Memory & Storage
|
Memory: • Storage: Cloud recording (Ring Home subscription); no microSD slot
|
| Power, Battery & Charging
|
Battery: • Power: Rechargeable battery pack / optional solar • Charging:
|
| Display & Camera
|
Display: • Camera:
|
| Sound & Connectivity
|
Sound: • Connectivity: 2.4 GHz Wi-Fi (802.11n), Bluetooth (setup)
|
| Physical (Dimensions & Mass)
|
Dimensions: • Mass:
|
Reasoning: The Stick Up Cam's risk is concentrated in the account, not the hardware: there is no local storage and no local API, so the device is only as safe as the Ring account protecting it. Ring has added two-step verification, breach-password checks and session visibility, which addresses the 2019 credential-stuffing wave, but stream encryption is still not end-to-end on most configurations and one historic encryption flaw exists in NVD. Scope note: rated for a current-firmware camera on an account with two-step verification; an account without 2FA would drop several user-authentication criteria. Ring has replaced this model with the Outdoor Cam, so it is assessed as end of sale.
