Wyze Cam v3 exceeds 60,000 DNS lookups per day

alext · January 22, 2021, 3:48am

I recently setup an internal PiHole DNS server and have found that my Wyze Cam v3 is attempting about 60,000 DNS lookups per day. Most of these are to non-existent hosts/domains. There are four domains which have almost equal lookups, about 17,000 per day. They are:

wyze-general-api.wyzecam.comv1
wyze-general-api.wyzecam.comv1.alext.local
wyze-general-api.wyzecam.comv1.#
wyze-general-api.wyzecam.comv1.wlan0

I have power cycled the camera which fixes the issue for about 12 hours but then it’s back at it again. Does this look familiar to anyone?

Ipil60R34s · January 22, 2021, 8:30am

Leftover dead code used during development and alpha testing stages? Sloppy programming? Given the kind of bugs I see, I’m not surprised.

R_T · January 22, 2021, 12:33pm

+1

DM1 · January 22, 2021, 8:10pm

Seeing the same on my end, over 61k requests to each one of those domains.

gordonmeyer · January 22, 2021, 8:54pm

Yikes! C’mon Wyze, get your act together!

alext · January 24, 2021, 3:05am

Hmm, well needless to say I’m not buying any more Wyze 3 cameras until they get this fixed. I really like the low light performance of this camera but if each one is going to generate this many DNS requests to bogus domains I don’t want them on my network.

Customer · January 24, 2021, 4:17am

Because why? The performance impact is likely negligible and there is not yet an indication of a security vulnerability, just apparently very careless coding…

R_T · January 24, 2021, 3:11pm

60,000 look ups a day per camera is not chicken feed, it’s significant traffic. And what other careless issues might there be?

So glad I’m down to just 1 non-critical V2 and no further Wyze products in my future.

kenmaples · January 28, 2021, 2:18am

same here:
|Domain|Hits|
|—|—|—|
|wyze-general-api.wyzecam.comv1|68053||
|wyze-general-api.wyzecam.comv1.local|67630||
|wyze-general-api.wyzecam.comv1.#|67381||
|wyze-general-api.wyzecam.comv1.wlan0|67132||

|Client|Requests|
|—|—|—|
|WyzeCam.local|157776||
|WyzeCam.local|114541||

Penguin94 · January 31, 2021, 1:42am

You guys are lucky. My Wyze v3 cam is hiting about 200,000 DNS request per day.

all to the same domains:
wyze-general-api.wyzecam.comv1
wyze-general-api.wyzecam.comv1.#
wyze-general-api.wyzecam.comv1.localdomain
wyze-general-api.wyzecam.comv1.wlan0

Any ideas for a fix? @UserCustomerGwen @CaptainMark

chrisjost · January 31, 2021, 4:02pm

Also a pi-hole user. My two v2 cams are the top users on my network. They also have hard coded DNS addresses in use so you aren’t seeing everything. I’m blocking port 53 for all devices on my network except the pi-hole. Also 853 for DNS over TLS.

We’re going to need a stateful inspection OUTBOUND firewall if they go to DNS over HTTPS.

vbwilkes · February 3, 2021, 8:47pm

I disagree - This is a significant security issue. All those holes allow return traffic through the firewall.

mattbta · February 3, 2021, 9:58pm

I need to block outbound 53 on my network, too and just force everything through my dual pihole setup. Currently logging 36k requests on a single v3. WTF?

alext · February 3, 2021, 11:14pm

I ended up adding an entry for some of the bogus domains on my Pi-hole. Just did a lookup of what the IP address should be for wyze-general-api.wyzecam.com and added a DNS entry on the Pi-hole for wyze-general-api.wyzecam.comv1. That seemed to calm things down.

I’m hoping somebody from Wyze is listening in and a bug is already submitted for this.

Cos · February 5, 2021, 12:47am

Another Pi-Hole user here. I also block DNS (53 & 853) for everything but the Pi-Hole:

Everything was normal until the latest Cam v3 firmware update, then I noticed my 24 hour activity started to spike up noticeably:

wyze-general-api.wyzecam.comv1	41772
wyze-general-api.wyzecam.comv1.local	41768
wyze-general-api.wyzecam.comv1.#	41768
wyze-general-api.wyzecam.comv1.wlan0	41766

vbwilkes · February 5, 2021, 1:19am

This is just not good…

Cos · February 5, 2021, 2:01am

Rebooting the camera does seem to cause this activity to drop off for a bit however.

croldan72 · February 5, 2021, 2:13am

I searched that first URL and it appears that this has happened before: https://www.reddit.com/r/wyzecam/comments/cmoibt/wyzedatacollectapiwyzecamcom/ew3tb4i/

I wonder if it’s something similar?

Customer · February 5, 2021, 4:45am

Nice find but wow that thread turned out to be a waste, huh. It went off on nothing tangents.

Cos · February 6, 2021, 6:38am

So - after rebooting the v3 camera running firmware 4.36.0.248 last night the issue seemed to go away only to return at just before 0800 as you can see by the orange uptick above.

These lookups rapidly ramp up and dwarf the rest of my DNS lookup traffic.