HOUSTON – Harris County investigators are looking into a Memorial family’s report that someone hacked into their Nest Wi-Fi camera network and pretended to kidnap their son.
It happened just before midnight Monday, when Nathan and Ellen Rigney were fast asleep downstairs, and 4-month-old Topper was asleep upstairs.
“I said, 'Hey, what is this? What’s going on?'” Ellen Rigney said after she heard beeping coming from the monitor next to her bed. She assumed it was a CO2 alert.
“Then we heard sexual expletives being said in his room,” Rigney said. “Immediate reaction was that there’s somebody in here, somebody’s in my son’s room! How did they get in there?!”
When Nathan and Ellen jumped out of bed and turned on the light, a Nest camera in their room, which had been off, suddenly turned on, and a man’s voice ordered them to turn the light off.
“Then [he] said “I’m going to kidnap your baby, I’m in your baby’s room,” Ellen Rigney said.
Her husband sprinted out of the room and upstairs, where Topper was safe and sound. That’s when Ellen remembered reading a story online about Wi-Fi camera hacking.
“We just had to figure out how to get (the Wi-Fi) shut down, and shut down fast!” Ellen said. “I kept telling [Nathan], he’s not in here, somebody’s hacking this!”
They shut off the Wi-Fi and turned off the cameras, called police, filed a police report with the Harris County Precinct 5 Constable's Office, and shared their story online.
“Wow. Turning my kids cameras off now,” one mom responded to the Rigney's post.
Ellen Rigney called Nest, whose representatives “were no help at all,” she said, and “did not apologize.” The Rigney's Nest cameras are now in the trash.
The second camera above Topper’s crib is a non-Wi-Fi camera that his mom installed recently after Wi-Fi in the neighborhood started having issues. That camera stayed put.
“It’s unnerving and unsettling,” Ellen Rigney said. “Something that is supposed to make you feel better and instead it makes you feel the opposite, it makes you feel invaded and uncomfortable.”
"A lot of hackers are just scanning the environment to see what can they find? And if they find something -- what can they do with it?" said Mary Dickerson, the chief information security officer for the University of Houston.
Dickerson said once hackers figure out a password, or how a software works, they can likely use it and manipulate it. In this case, the Rigneys believe hackers may have accessed it through the app.
"If you can access it remotely, chances are someone else can as well," Dickerson said.
Nest told KPRC2 they couldn't comment on this specific case, but said in part
"We have seen instances where customers reused passwords that were previously exposed through breaches on other websites and published publicly ... Reusing compromised passwords can expose customers to other people using the credentials to log into their Nest account and potentially other websites and services ... We are now also rolling out changes to proactively prevent customers from using a password compromised in a public breach as their Nest password."
Dickerson said apps tend to have less security because they have to be flexible and accessible. She said taking measures such as securing your Wi-Fi, changing your passwords and updating software consistently can make it much harder for other people to hack.
Nest representatives said they have also alerted affected customers to reset their passwords and set up a two-factor authentication. This specific case is being investigated by Harris County Precinct 5.