If you didn't have any privacy concerns about slapping a Ring doorbell on your front door or putting Ring cameras inside, you'll love Amazon's newest offerings, which move around homes and businesses to capture views stationary cameras might miss. The house of Bezos announced the launch of Ring Robotics on Tuesday along with its first two products: a drone designed for indoor home security, and a wheeled robot with a telescoping camera mast for automated after-hours business patrols. Both are designed to proactively patrol spaces as well as respond to alerts from connected alarm systems and Ring-connected devices. According to Ring founder Jamie Siminoff, this is something customers actually want, as those stationary cameras just can’t quite see everywhere. “It’s not just a new category of security; it’s the beginning of a future where proactive, autonomous protection is something every home and every business can have,” Siminoff said. The consumer-focused Ring Drone Cam launches from its own charging dock that Amazon says keeps the thing “out of sight” when not in use, and when in flight is able to patrol a home by flying around pre-programmed routes to take in the sights with its 148-degree FOV, 2K camera that includes LED illumination for night patrols. Amazon says it can also respond to alerts from cameras, sensors, and alarm systems. The Ring Rover Cam, designed with businesses in mind, is sort of like a security Roomba that sports a camera on a telescoping mast that Amazon says can be programmed to certain heights to let it see over counters, shelves, and other workplace obstacles. The Rover can also perform 360-degree scans and includes a siren, lights, and two-way audio so you can yell at intruders who aren't dissuaded by its presence. The Rover streams and records video in up to 4K while moving or patrolling and is designed to make regular patrols of businesses during off hours. It can also detect people and respond to alerts from connected Ring devices. Of course, given that this is Ring we're talking about, these flying and free-wheeling cameras use Amazon's cloud for some processing, likely inviting privacy concerns about what footage and mapping data the company can access and retain. The Amazon-owned security tech firm has faced a number of privacy complaints over the years, some of which have resulted in multimillion-dollar settlements. Ring agreed to pay $5.8 million in a 2023 settlement with the FTC over allegations that employees and contractors improperly accessed customers' private videos and that the company failed to adequately protect accounts against unauthorized access – just imagine the privacy concerns raised by flying robots. More recently, the company took heat for partnering with surveillance outfit Flock Safety, a relationship which it has since canceled. Amazon/Ring also invited criticism for a Super Bowl ad earlier this year promoting a new feature called Search Party, which would remotely activate Ring cameras to search for lost pets, suggesting that Amazon had the ability, in theory, to use Ring cameras like a dystopian neighborhood surveillance network. Another Ring feature, Familiar Faces, which uses AI-powered facial recognition to identify people captured by compatible cameras, prompted a proposed class-action lawsuit filed in June. The complaint alleges that the feature collected biometric information from visitors and passersby without their consent. If we can’t have iRobot, we’ll do it with Ring Amazon abandoned its efforts to buy Roomba robot-vacuum maker iRobot in 2024, blaming regulatory scrutiny for the move. The FTC, under then-chair Lina Khan, examined the deal's potential effects on competition and consumer privacy, including concerns about the information Roombas collect while mapping customers' homes. European regulators, meanwhile, raised concerns that Amazon could use its marketplace to disadvantage rival robot vacuum makers. With this Ring move, Amazon is once again putting robots capable of mapping interior spaces into customers' hands, reviving some of the privacy questions raised during its failed iRobot acquisition. As Amazon explains in Tuesday’s press release, both new Ring robots are powered by AI Pilot, “a custom-built system that uses the devices’ cameras, specialized vision models, on-device sensors, and cloud processing to see, think, and navigate autonomously.” To help the Ring robots understand where they're operating, the devices generate floor plans of interior spaces, according to Amazon. “Carry Ring Drone through your space or let Ring Rover autonomously explore, and it turns what it sees into a floor plan,” the company explains of the setup process. AI Pilot takes the reins in identifying the types of rooms it sees and suggests key patrol areas it should focus on, which users can add to in the Ring app. Amazon claims that videos captured by these new flying and free-wheeling cameras will be protected by an encryption scheme it calls Throw Away the Key Encryption (TAKE). The system temporarily allows Ring's cloud services to access recordings for enabled features before the relevant encryption keys are deleted. Ring announced the scheme in August, presenting it as a way to limit access to customer recordings without sacrificing cloud-powered features. “With TAKE, your Ring videos are protected with unique, rotating encryption keys,” Amazon explained. “A copy of the keys is temporarily held inside a secure enclave within the cloud; think of it as a sealed vault that can only provide Ring access to the key under strict, limited conditions.” The keys, Amazon claims, are later deleted so that only users and those they allow access to can see videos, with Ring only retaining them “to power the intelligent features that you have active on your account.” “We take privacy concerns seriously, and we believe privacy and customer control are fundamental to building products people trust,” a Ring spokesperson told The Register when asked about prior privacy concerns. “That is why customers decide where these devices go and when.” We asked about floor plan security, but didn’t get an answer about that. As for when those devices will be available, the Rover Cam will start shipping on December 16 at a price of about $1,000, but the Drone Cam might not ever actually make it to homes. Amazon’s announcement mentions a release date of January 27, 2027, but that’s subject to the FCC giving its blessing. “Ring Drone Cam has not been authorized as required by the rules of the FCC,” Amazon’s release states. “This device is not, and may not be, offered for sale or lease, or sold or leased, until authorization is obtained.” Amazon told us that the Drone Cam would still start shipping in January, luckily giving everyone a few months to figure out how to deal with this new, more mobile, invasion of privacy. ®

Linux KVM, the hypervisor favoured by hyperscale clouds, apparently has a full VM escape bug. That nasty news came from security researcher Paulos Yibelo, who on X shared a screenshot of a bug bounty award he won for discovering what he described as “Full VM escape zeroday (guest>host root in industry standard hypervisors)!” The bug bounty Yibelo participated in is run by Vercel, a company that provides MicroVMs as sandboxes for AI agents to work inside. The company’s Sandbox uses Firecracker MicroVMs, a technology created by AWS, which relies on Linux KVM – the kernel level hypervisor in Linux. Vercel CEO Guillermo Rauch named KVM as the hypervisor identified by Yibelo. “We’ve confirmed a KVM 0day through our Vercel Sandbox bounty program. Affecting the industry’s gold standard solution for Linux virtualization,” he wrote. And that’s all the info that has made it into the public view at this time. The Register can find no chat on relevant mailing lists. We have asked Rauch and Yibelo for additional details. Hopefully, we don’t hear from either of them for days or weeks, for two reasons. One is that guest-host escapes are the nightmare virtualization scenario because they mean whoever runs a guest VM could take over an entire server, and perhaps gain the ability to control other guests. The other is that KVM is astoundingly prevalent: AWS and Google both use it to power their public clouds. Enterprise virtualization players Nutanix, HPE, and Proxmox also rely on KVM. And of course KVM is also in Firecracker, which is open source and could therefore be running in all sorts of places. Whatever Yibelo discovered therefore very much needs a responsible disclosure process, because if hints about the flaw emerge it could allow attackers to do a lot of damage. Once a fix is found, the next question is whether implementing it will require disruption or downtime. It’s possible to hot-patch KVM, and to migrate live VMs from vulnerable hosts to machines running a patched version of Linux. Hopefully those techniques will work. This might be the second nasty bug discovered in KVM this year, after the so-called Januscape flaw. Beyond the potential risks this bug created, observers have suggested the potential seriousness of the flaw means Yibelo’s reward should exceed the $50,000 available under Vercel’s bug bounty program. ®