Earlier this year, major vulnerabilities were found in some cameras manufactured by Eken Group Ltd., a Chinese company that produces video doorbells. These cameras were available on Amazon, Walmart, Shein, Sears, and Temu and had security flaws that made it possible for hackers to view footage from the devices or even fully control them.
Researchers found that these doorbell cameras made by Eken Group can be controlled by a company-operated app called Aiwit. They found a flaw and reported it, which prompted some of these online retailers to remove the items from their marketplace and offer refunds for the products purchased. The online retailer Amazon had given this EKEN and Tuck doorbells its “Amazon’s Choice” badge and took some time to remove it from their site. Shein and Sears also took some time to act on the information which allowed consumers to purchase this product for a while before they actually took it down.
The vulnerabilities allowed bad actors to get into the user network by creating an account on the Aiwit app and gaining access to a doorbell camera nearby by pairing it with another device. This gives them access to view footage or still images, and even lock out the owner from the device.
The Aiwit app, which lacks sufficient security, allows attackers to exploit the vulnerabilities in the affected doorbell cameras and gives them unauthorized access to the cameras, view the live video feed, and control the devices. Such access can be used to infiltrate the home network, potentially compromising other connected devices and sensitive information.
By accessing video footage or images, bad actors can gather information about the residents, their routines, and their security measures. This information could be used to craft targeted social engineering attacks, such as phishing or vishing (voice phishing), to manipulate residents into divulging sensitive information.
With access to the doorbell camera, hackers can determine when the property is vacant, making it easier to plan and execute a burglary or other criminal activities. They could also potentially unlock smart locks if those are integrated with the same network, further compromising physical security.
Once inside the device network, hackers can attempt to penetrate other connected devices within the same network, such as smart thermostats, security systems, and personal computers. This could lead to a broader compromise of the home network, exposing sensitive personal data and other critical systems.
Bad actors could manipulate the functionality of the doorbell camera, such as turning it off or modifying its settings, rendering it useless as a security device. They might also use it to harass the residents by repeatedly triggering the doorbell or alarms.
Hackers could also use the compromised device as a launchpad to introduce malware into the home network, which could result in further compromises of other devices, data theft, or even the creation of a botnet for conducting large-scale cyber attacks. Let’s look at security as a whole and think about every device that could be compromised in our surroundings, including third-party devices. Because a small vulnerability is a window of opportunity for cyber hackers.