Even people who don't want to blanket their homes with all-seeing digital eyes must admit that doorbell cameras are pretty convenient. This niche used to be dominated by a few players, but now there are countless doorbell cameras available from online retailers like Amazon for next to nothing. Consumer Reports says you should avoid any cameras that look like the one above. This camera, sold under numerous brands, has such poor security that any passerby could hijack it, and there's no way you can boot them out.
Consumer Reports was testing a new batch of video doorbells when it happened upon a collection of devices that appeared to be the same piece of hardware. The cameras are made by Chinese firm Eken and sold under at least ten brands, including Fishbot, Rakeblue, and Tuck. The best way to know if you've got one of these doorbells is to check the app you use to manage it. If your doorbell connects to the Aiwit app, you should be concerned.
These devices lack a visible FCC ID, which means they're illegal to distribute in the US. Regulatory oversight isn't the only place Eken cut corners, though. Consumer Reports says the cameras broadcast your IP address and Wi-Fi network name in plain text. So, anyone snooping on your traffic can see that data. Even worse, the camera streams still images from the camera to unrestricted web servers that don't even ask for a username or password.
All you need to access someone else's doorbell camera is the serial number, and there's no way for the owner to restrict access even if they learn of the breach. You can get the serial number and completely take over the doorbell by holding the button for a few seconds. The owner can reset and reconnect to their app, but the attacker has that serial number forever, giving them access to the still images. Consumer Reports says it tested this by having one staffer download another's camera images from 3,000 miles away without login information. If there's a saving grace, it's that the serial numbers are random and not sequential. Even though the numbers are easy to obtain, it won't be easy to guess one.
Consumer Reports alerted online retailers to the problem, but most have not taken action. Chinese e-commerce giant Temu pulled the devices, but Amazon hasn't even responded to the organization. Several versions of this doorbell are available on Amazon for around $30. You can also find them on Shein, Sears, and Walmart. The company that makes the doorbells has also failed to respond to Consumer Reports' request for comment, so there's little hope for a fix.
Putting a camera on your property is not a decision to be taken lightly. This is not the first time a lesser-known company has sold a camera with security holes, and it won't be the last. Going with established brands that care about security and won't vanish overnight is a good rule of thumb, but even that might not be enough. We could just tell you to stay away from Eken, but it could (and probably will) change its name to escape the bad press.
