The seemingly identical video doorbells under at least 10 different brands — EKEN, Tuck, Fishbot, Rakeblue, Andoe, Gemee, Luckwolf, etc — as well as the Aiwit doorbell management app appear to be owned by
Shenzhen-based Eken Group Ltd. (Eken is apparently linked to Shenzhen Puge Electronics, which is displayed on the product boxes for some of the above doorbells as the manufacturer.)
Anyone who can physically access one of the doorbells can take over the device— no tools or fancy hacking skills needed. He’d simply need to create an account on the Aiwit smartphone app, then go to his target’s home and hold down the doorbell button to put it into pairing mode. He could then connect the doorbell to a WiFi hotspot and take control of the device. As the new "owner" of the device, he could now watch who comes and goes, and when.
On top of the security vulnerabilities, the doorbells lack FCC identifiers that are supposed to be visible to consumers. Without visible IDs, they are illegal to sell in the US, according to published FCC rules.
consumerreports.org/home-garden/ho
ポストを翻訳
5