The IT security of “intelligent” doorbells equipped with video cameras, which can be bought for comparatively little money on online marketplaces such as Amazon, eBay or Wish, is not well ordered. This was the result of a test by the IT security company NCC Group for the British online magazine “Which?” surrender. The identified weaknesses therefore range from logon information that is firmly encoded in the hardware, to authentication problems, to data transfer to China. In some cases, the devices are delivered without the latest security updates being installed and long-standing critical errors have been corrected The researchers should find out what smart bells are good for, which cost significantly less than the market leaders from Amazon Ring or Google Nest and mostly come from China. They examined models from Victure, Qihoo and Accfly as well as unbranded products with titles like “HD Wi-Fi Video Doorbell V5”, “Smart WiFi Doorbell (YinXn)” or “Smart Wifi Doorbell – XF-IP 007 H “.
Overall, the experts give the devices a bad rating, which is a” nightmare “in the area of the Internet of Things. The security problems beyond aggressive data collection are massive. In addition, some of the video bells turned out to be “clones” of the Victure model, which not only took over its flaws, but also made them worse. The original contained an undocumented HTTP service on port 80. This required login data which could easily be extracted by one of the “Copy Cats”. Unencrypted WLAN IDs and passwords were found in log files.
The smartphone apps for controlling the digital bells also rely on unencrypted communication, which makes life easy for hackers. “HTTPS was not enforced on a number of devices or did not even exist as a communication method for a number of mobile applications,” the analysis said. For example, the Victure mobile application requested a root certificate via an HTTP request. Sensitive information, user names and passwords could be recorded with simple test instruments.
So many attack possibilities We encountered the Qihoo device the auditors on an undocumented, fully functional DNS service. In principle, this could simply be misused as a channel for the spread of malware. Current indications of such an active “rabbit hole” were not detectable.
Another possible attack vector was the misuse of QR codes. According to the report, a hacker who has access to a user’s cloud-based camera backup could also get their hands on the device’s QR code. The attacker could decrypt it and read the WLAN data with a password.
According to the researchers, the bell hardware is often not securely attached. It was then easy to remove and manipulate. The devices would usually sit loosely in a screwed or glued-on bracket. They could be stolen within a few seconds. Only one of the camera systems had a pressure sensor, which triggered an alarm if tampered with. This can also be prevented by a 2.4 GHz jammer.
No good words Help me the hardware is an attacker in a position to access the videos recorded by the bell and stored on an SD card, the experts say. For example, he could research the typical behavior of residents. In addition, the firmware can be extracted in order to obtain the access data to a network again or to identify further weak points.
The researchers found that one of the devices was still used for “key reinstallation attacks” (Krack ) was prone. This WLAN gap should actually be sealed since 2019. It enables attackers to read encrypted data traffic in plain text, to steal information and – depending on the network configuration – to smuggle in malicious code. Accfly and Victure, the only ones to publish contact information, did not respond to inquiries from Which. US civil rights activists had previously criticized the fact that ring apps are also big data throws.
(mho)
