Video doorbells — Internet-connected devices that use LED sensors that give homeowners a sense of security so that they know who is approaching their front doors and ringing their bells — are a popular modern physical security tool. They are fairly affordable and available by way of major retailers like Walmart, Lowe’s, and Amazon.
Now, a new investigative report sheds light on some of the security risks that come with some of these devices. It gives consumers a conception of what they should be on the lookout for in choosing products — and when to be wary.
A disturbing trend — video doorbells sold with inherent flaws
In late February, Consumer Reports (CR) revealed that common video doorbells found at retailers like Sears and Walmart were sold with embedded security flaws making them prone to hacks.
These devices also lacked a visible ID issued by the Federal Communications Commission (FCC) that’s required by the agency’s regulations, making them illegal to distribute in the U.S.,” according to CR reporters Stacey Higginbotham and Daniel Wroclawski.
"Big e-commerce platforms like Amazon need to take more responsibility for the harm generated by the products they sell,” Justin Brookman, director of technology policy for CR, said in the article. “There is more they could be doing to vet sellers and respond to complaints. Instead, it seems like they’re coasting on their reputation and saddling unknowing consumers with broken products.”
The flaws were revealed due to CR staffers performing routine product ratings.
Some brands to look out for
These problematic products hailed from two brands— Eken and Tuck.
These devices are almost identical in design and packaging. CR found that online searches yield 10 additional “seemingly identical video doorbells” that were “sold under a range of brand names.”
All these devices are controlled by way of one mobile app: Aiwit, owned by Eken.
CR outlines the serious threats these devices pose. For instance, an estranged abusive partner could stalk their intended target by way of hacking the connected doorbell. They could view them through the doorbell camera feed on their smartphone or other connected device.
The hacker in question could watch as an intended victim enters and exits their home. In essence, this undermines the very purpose of having one of these doorbells in the first place — to feel safer in one's own home.
How to stay safe
"Products like these, by failing to prioritize trust and safety, put domestic violence victims at risk. Without question, the one place a victim needs to be safe is in their home,” Adam Dodge, CEO of EndTAB, told CR. “Devices designed to make someone feel safe at home, while actually doing the opposite, shouldn’t be allowed on the market.”
CR reports that these video doorbells expose a person’s home IP address and WiFi network name without any encryption. Beyond being spied on, this could expose the consumer to even more threats if the company’s servers were ever hacked.
What can a consumer do? CR recommends that if a person has purchased a doorbell from one of these brands, disconnect it from WiFi right away and remove it from the door.
The consumer publication recommends that one should opt for vetted brands like SimpliSafe, Logitech, and Ring, instead.
For more of the publication’s probing look at these security risks, read the full report here.