IoT security: ‘Smart’ doorbell unlocks homes to unauthorized visitors

guest · Oct 9, 2019

IoT security: ‘Smart’ doorbell unlocks homes to unauthorized visitors
October 9, 2019
https://portswigger.net/daily-swig/...orbell-unlocks-homes-to-unauthorized-visitors

A security researcher has disclosed a serious vulnerability in a first-generation ‘smart’ doorbell that could, quite literally, open the door to malicious hackers.

The dbell WiFi Smart Video Doorbell (DB01-S) was found to have no authentication mechanism to prevent a remote attacker from launching commands.
Noah Clements, 19, who details his findings in a recent blog post (non-HTTPS link), said that if the IoT device was connected to a lock via a relay switch, an attacker would be able to open the associated door without any authorization required.

“It is not limited to opening the lock either, any .cgi function that is on the webserver can be executed without it properly validating the input.”
The Daily Swig has reached out to dbell and asked whether it plans to notify its customers about the product’s potential security risks, along with an estimate on how many DB01-S have likely been purchased since it first became available in 2016.
The issue has been allocated as CVE-2019-13336, and is also detailed on the National Vulnerability Database (NVD).
Click to expand...

guest · Nov 24, 2020

Smart Doorbells Are Wide Open to Security Flaws
November 24, 2020
https://www.infosecurity-magazine.com/news/smart-doorbells-are-wide-open-to/

A consumer rights group has found security vulnerabilities in 11 popular smart doorbell products available on two of the world’s biggest online marketplaces.

Which? enlisted the help of researchers at NCC Group to run tests on the smart devices they found on eBay and Amazon, many of which had scores of five-star reviews, were recommended as “Amazon’s Choice,” or on a bestsellers list.
Typical issues included: weak password policies, meaning hackers could guess the factory defaults to hijack the device; excessive data collection and lack of data encryption, meaning attackers could lift Wi-Fi password details to hijack other devices on the home network.
Click to expand...

E-commerce giant eBay said it immediately removes any products found to violate its safety standards.

“These listings do not violate our safety standards but represent technical product issues that should be addressed with the seller or manufacturer,” it said of the report. “We have and will continue to facilitate discussions between Which? and the sellers so the concerns can be addressed.”
Click to expand...

Which?: The smart video doorbells letting hackers into your home

All 11 doorbells we tested demonstrated high-risk security issues
Click to expand...

guest · Dec 21, 2020

Smart Doorbell Disaster: Many Brands Vulnerable to Attack
Investigation reveals device sector is problem plagued when it comes to security bugs
December 21, 2020
https://threatpost.com/smart-doorbell-vulnerable-to-attack/162527/

Smart doorbells, designed to allow homeowners to keep an eye on unwanted and wanted visitors, can often cause more security harm than good compared to their analog door bolt alternatives. Consumer-grade digital doorbells are riddled with potential cybersecurity vulnerabilities ranging from hardcoded credentials, authentication issues and devices shipping with unpatched and longstanding critical bugs.

That fresh assessment comes from NCC Group, which published a report last week outlining “domestic IoT nightmares.” In partnership with the publication Which?, it assessed smart doorbell models made by three vendors Victure, Qihoo and Accfly along with white-box offerings from three additional doorbell makers.
Click to expand...

The verdict?

“Overall the issues we have seen during this research have outlined a poor approach to developing secure IoT devices. There are still devices being developed, shipped and sold with an array of issues let alone these issue being cloned into knock-off, copycat devices,” wrote NCC Group’s co-authors of the report.
Noticeably absent from the analysis are the names of market-share leader Ring Video Doorbell and the handful other big players such as Nest, Vivint and Remo.
Click to expand...

Researchers said the majority of the devices analyzed were clones of the Victure doorbell, which had a number of preexisting security issues associated with it.
Click to expand...

NCC Group: Domestic IoT Nightmares: Smart Doorbells

Attack Scenarios
Gain Persistence Access to a network
Attackers could use the shared hard-coded username and password to log in to exposed control panels, perform a malicious firmware upgrade and create a gateway into a victim’s network.
Firmware manipulation
Due to the lack of encryption for the firmware it is very easy to reverse engineer the firmware and extract not only the structure of the underlying OS but also extract the BSSID and plaintext password of a network and then log into that network; [...]
Click to expand...

Log in or Sign up

IoT security: ‘Smart’ doorbell unlocks homes to unauthorized visitors

guest Guest

guest Guest

guest Guest

Log in or Sign up

IoT security: ‘Smart’ doorbell unlocks homes to unauthorized visitors

guest Guest

guest Guest

guest Guest

Useful Searches