Video Doorbells Sold By Big Retailers Have Major Security Flaws Consumer Reports

p
Adfree Influencefree Powered by consumers
pp
Get involved
pp
Issues we work on
pp
The payment for your account couldnt be processed or youve canceled your account with us
ppSign Inpp
We dont recognize that sign in
Your username maybe be your email address Passwords are 620
characters with at least one number and letter
pp
We still dont recognize that sign in

Retrieve your username



Reset your password

ppRequiredppRequiredpp
Forgot your username or password
ppDont have an accountppMy accountpp

pp
Save products you love products you own and much more
ppOther Membership Benefitspp
Suggested Searches
pp
Cars
pp
Car Ratings Reviews
pp
CARS
pp
2024 Top Picks
pp
Car Buying Pricing
pp

pp
Which Car Brands Make the Best Vehicles
pp
Tires Maintenance Repair
pp

pp
Car Reliability Guide
pp
Key Topics News
pp
CAR NEWS
pp
Listen to the Talking Cars Podcast
pp
Home Garden
pp
Bed Bath
pp
Top Picks From CR
pp
Best Mattresses
pp
Lawn Garden
pp
TOP PICKS FROM CR
pp
Best Lawn Mowers and Tractors
pp
Home Improvement
pp
Home Improvement Essential
pp
Best Wood Stains
pp
Home Safety Security
pp
HOME SAFETY
pp
Best DIY Home Security Systems
pp
Appliances
pp
Kitchen
pp
REPAIR OR REPLACE
pp
What to Do With a Broken Appliance
pp
Small Appliances
pp
TOP PICKS FROM CR
pp
Best Small Kitchen Appliances
pp
Laundry Cleaning
pp
Top Picks From CR
pp
Best Washing Machines
pp
Heating Cooling Air
pp
TOP PICKS FROM CR
pp
Most Reliable Central AirConditioning Systems
pp
Electronics
pp
Home Entertainment
pp
FIND YOUR NEW TV
pp
Best TVs
pp
Home Office
pp
Save Money
pp
Cheapest Printers for Ink Costs
pp
Smartphones Wearables
pp
BEST SMARTPHONES
pp
Find the Right Phone for You
pp
Digital Security Privacy
pp
MEMBER BENEFIT
pp
CR Security Planner
pp
More
pp
Take Action
ppThe devices are also sold by Walmart Sears and other retailersand big platforms have faced few consequences for shipping flawed productsppUpdate This article was originally published on Feb 29 2024 It was updated on March 15 2024 to reflect information provided by Eken after publication That information appears below in italics In April CR confirmed that Eken had issued fixes for the problems wed foundppOn a recent Thursday afternoon a Consumer Reports journalist received an email containing a grainy image of herself waving at a doorbell camera shed set up at her back doorppIf the message came from a complete stranger it would have been alarming Instead it was sent by Steve Blair a CR privacy and security test engineer who had hacked into the doorbell from 2923 miles away ppBlair had pulled similar images from connected doorbells at other CR employees homes and from a device in our Yonkers NY testing lab While we expected him to gain access to these devices it was still a bit shocking to see photos of the journalists deck and backyard After all video doorbells are supposed to help you keep an eye on strangers at the door not let other people watch youppBlair was able to capture those images because he and fellow test engineer David Della Rocca had found serious security flaws in this doorbell along with others sold under different brands but apparently made by the same manufacturer The doorbells also lack a visible ID issued by the Federal Communications Commission FCC thats required by the agencys regulations making them illegal to distribute in the US The doorbell manufacturer Eken did not respond to queries before publication but it contacted CR after publication and stated that new packaging with the ID would be available in about a monthppThousands of these video doorbells are sold each month on Amazon and other online marketplaces including Walmart Sears and the globally popular marketplaces Shein and Temu Experts say theyre just a drop in the flood of cheap insecure electronics from Chinese manufacturers being sold in the US ppPreviously regulators have asserted that thousands of unsafe products including potentially dangerous childrens sleepwear carbon monoxide detectors and dietary supplements have been widely available on AmazonppBig ecommerce platforms like Amazon need to take more responsibility for the harms generated by the products they sell says Justin Brookman director of technology policy for CR There is more they could be doing to vet sellers and respond to complaints Instead it seems like theyre coasting on their reputation and saddling unknowing consumers with broken productspp
Photo Consumer Reports

Photo Consumer Reports
ppBlair and Della Rocca discovered the problems while evaluating a number of video doorbells for our regular ratings program They were sold under two brand names Eken and TuckppThe two devices stood out not just because of the security problems but also because they appeared to be identical right down to the plain white box they came in despite having different brand names Online searches quickly revealed at least 10 more seemingly identical video doorbells being sold under a range of brand names all controlled through the same mobile app called Aiwit which is owned by Eken ppWe bought two of these products sold under the Fishbot and Rakeblue brands and found the same vulnerabilitiesppThe security issues are serious People who face threats from a stalker or estranged abusive partner are sometimes spied on through their phones online platforms and connected smartphone devices The vulnerabilities CR found could allow a dangerous person to take control of the video doorbell on their targets home watching when they and their family members come and go ppProducts like these by failing to prioritize trust and safety put domestic violence victims at risk Without question the one place a victim needs to be safe is in their home says Adam Dodge CEO of EndTAB a nonprofit that provides information on how to combat technologyenabled abuse Devices designed to make someone feel safe at home while actually doing the opposite shouldnt be allowed on the marketppCR tried to reach company officials at Eken and Tuck to warn them of the problems hoping to have the issues fixed before reporting on them publicly We did not receive responsesppAfter publication Eken contacted CR and in a subsequent discussion said it was addressing the findings Eken has a dedicated RD team and a robust and thorough RD process to ensure our consumers privacy and safety are protected the company said in an emailed statement CR will evaluate the companys changes once they have rolled out to consumersppFirst these doorbells expose your home IP address and WiFi network name to the internet without encryption potentially opening your home network to online criminals Security experts worry there could be more problems including poor security on the company servers where videos are being stored ppThe fact that they arent using encryption is egregious says Beau Woods a digital security researcher with the cybersecurity advocacy group I Am The Cavalry It indicates there may be a whole host of bad practicesppThe video doorbells pose a special threat to individuals who are in danger from people who know where they liveppAnyone who can physically access one of the doorbells can take over the deviceno tools or fancy hacking skills needed Lets imagine that an abusive exboyfriend wants to watch the comings and goings of his former partner and her children Hed simply need to create an account on the Aiwit smartphone app then go to his targets home and hold down the doorbell button to put it into pairing mode He could then connect the doorbell to a WiFi hotspot and take control of the deviceppAs the new owner of the device he could now watch who comes and goes and when ppAnd he can see the devices serial number Thats dangerous because of the companys poor security systemsppWhen the stalker pairs the device to his phone the original owner will get an email saying she no longer has access to the device That might seem like a small technological glitch she can solve by simply repairing the device with her own phone taking back control ppBut once the stalker has the serial number he can continue to remotely access still images from the video feed The CR journalist provided the serial number to Blair to allow him to remotely access her camera No password is needed or even an account with the company and no notification is sent to the doorbells ownerppIn our scenario the dangerous actor will continue to see timestamped photos of everyone who comes and goes And if he chooses to share that serial number with other individuals or even post it online all those people will be able to monitor the images tooppUnencrypted personal data in network traffic is unfortunately not uncommon with connected devices but I was shocked to find such a gaping security hole allowing complete strangers to freely harvest private video thumbnails Blair says The lack of basic access controls contradicts basic information security principles Its alarmingppEken Tuck and the other brands we saw arent the biggest names in the video doorbell market but they are strong sellers The doorbells appeared in multiple listings on Amazonwe found eight for the Eken video doorbell and three for the Tuck version of the product Those listings generated more than 4200 sales in January 2024 aloneppWe also found these doorbells for sale at walmartcom searscom and on the global marketplaces Shein and Temu And seemingly identical video doorbells are available from even more brands Walmartcom for example is selling them under the names Andoe Gemee and LuckwolfppThe large variety of brands devices versions and sellers can make it extremely hard for buyers to find safe reliable products Woods says It also increases the difficulty level for those trying to get unsafe or illegal devices out of these marketplacesppIn addition to contacting Eken and Tuck Consumer Reports also told Amazon Walmart Sears Shein and Temu what wed found pp
Source Manufacturers

Source Manufacturers
ppTemu said in an emailed statement that it was reviewing CRs findings and had removed from its website all video doorbells using the Aiwit app and made by Ekenbut similarlooking if not identical doorbells remained on the site Walmart told CR via email that it expects the products sold in its marketplace to be safe reliable and compliant with our standards and all legal requirements Items that are identified to not meet these standards or requirements will be promptly removed from the website and remain blockedppAmazon Sears and Shein didnt respond to questions from CRs journalistsppAs of the end of February 2024 most of the products we found online were still available for sale on those retailers websitesppOn top of the security vulnerabilities CRs testers noticed that the doorbells lacked FCC identifiers that are supposed to be visible to consumers These codes let you look up a product in an FCC database to see that its been tested to ensure it doesnt cause harmful radio interference with other electronics or exceed safe radiofrequency limits for human healthppWe found FCC records online for some of the devices including Ekenbranded doorbells which means those doorbells were tested However without visible IDs they are illegal to sell in the US according to published FCC rules The agency did not comment directly on our findings After publication Eken notified CR that it would be adding the IDs to its products so that the FCC ID will be properly reflected in the new packaging of the productsppAmazon provides a link on every product listing to alert the company to problematic items We used the link to report the missing FCC ID for the Tuck video doorbell but days later it was still availableppOver the past few months Eken and Tuck video doorbells have often carried badges saying Amazons Choice Overall Pick The badges appeared even after CR alerted Amazon to the security problemsppTo many shoppers an Amazons Choice label might imply that Amazon had deliberately chosen that video doorbell as one to keep in stock and was promoting it for its quality But thats not the way it works pp
Source Amazon

Source Amazon
ppLike more than 6 out of every 10 items sold on Amazon Ekens products are posted by an independent company with Amazon generally handling services such as warehouse services shipping and returns Anyone can sell nearly anything on Amazon and the company earned roughly 140 billion in revenue from thirdparty sellers in 2023 ppThat allows shoppers to find a vast array of products but it can also make it hard to know just what youre buying and whos selling itppAll 10 of the doorbell brands as well as the Aiwit app appeared to be owned by an 18yearold company called Eken Group Ltd based in Shenzhen China The company also has an office in Southern California run out of an apartment in Temple CityppEken didnt respond to CRs questions about its video doorbells before publication After publication the company told CR that it manufactures video doorbells under its own brand and also manufactures whitelabel doorbells for separately owned brandsppFor many Chinese tech companies selling cheap hardware under multiple brand names can increase sales in a product category thats very popularuntil it isnt according to Andrew Huang a prominent engineer and software expert who goes by the name Bunnie and is the author of The Essential Guide to Electronics in Shenzhen At that point Huang says the company will switch products moving on to the next big thing ppFor the security camera market a brand is just a brandthink of it more like a marketing agency that can do a bit of injection molding and package design to create a look and feel but they dont do much beyond that he says They dont hold a lot of inventory and they flit in and out of existence surfing the trends of commodity marketsppTo create their products such companies can take a reference design from a chip company that makes the brains inside electronic devices buy the relevant electronics from neighboring factories manufacture a cheap plastic case and then assemble the final product ppHuang says some Chinese companies can put together a new electronic device in as little as two weeksppHowever that kind of fast cheap product development doesnt lend itself to cybersecurity according to Steve Hanna who is responsible for IoT security strategy and technology at Infineon Technologies a semiconductor company ppIts always the case that building a more secure product costs more he says but for many lowcost IoT companies there is little economic incentive to include security because it is invisible to most consumersppIf such products havent been vetted by Amazon why are they receiving Amazons Choice badges According to a company FAQ the designation is based on a products ratings price popularity product availability and fast delivery They are generated dynamically by an algorithm and can suddenly pop up then disappear just as quickly ppIf you own one of these doorbells Consumer Reports recommends that you disconnect it from your home WiFi and remove it from your door CR has evaluated video doorbells with much better security from brands including Logitech SimpliSafe and Ringwhich is actually owned by Amazon ppMore broadly dont assume that large online retail platforms have evaluated the safety of all the products they sell Federal agencies and journalists have reported a variety of dangerous or illegal products for sale on Amazon over the years ppIf you bought flawed items from a local store it might be liable for damages or fines but in previous legal proceedings Amazon has claimed that its not responsible for items sold by third parties on its platform because for those sellers its just acting as a logistics company The Consumer Product Safety Commission disagrees and has tussled with Amazon over this issue in the past It is considering an order that would officially classify the marketplace as a distributor of goods with the responsibilities of conventional retailers according to reporting in The Wall Street Journal If such an order goes through similar rulings could affect other online marketplaces ppMeanwhile Consumer Reports is asking online retailers to take steps to guarantee the quality of the products available on their platforms CR has also advocated for legislation to make online platforms strictly liable for selling defective products and pushed for laws that make it clear that retailers need to take reasonable steps to keep harmful fraudulent or insecure products off their platforms ppAnd we shared our findings about video doorbells with the Federal Trade Commission which has the power to remove products like these from the marketplace The agency declined to comment on what action it might take noting that its investigations are private After publication FCC Commissioner Geoffrey Starks sent letters to the retailers cited in this article asking what steps they take to ensure that products they sell conform to FCC regulationsppRegulators need to be doing more to address the torrent of junk thats out there says CRs Brookman That means going after the manufacturers but also the platforms that sell themand apparently even explicitly recommend themppA post shared by Consumer Reports consumerreportsppStacey HigginbothamppStacey Higginbotham has been writing about technology for 20 years Her articles have appeared in publications including Fortune PCMag and MIT Technology Review She was also the founder and cohost of The Internet of Things Podcast and is a policy fellow with Consumer Reports working on security for connected devices and right to repair lawsppDaniel WroclawskippDan Wroclawski is a home and appliances writer at Consumer Reports covering products ranging from refrigerators and coffee makers to cuttingedge smart home devices Before joining CR in 2017 he was an editor at USA Todays Reviewed and launched the sites smart home section In his spare time you can find him tinkering with one of the over 70 connected devices in his house Follow Dan on Facebook and Twitter danwrocpp
We respect your privacy
All email addresses you provide will be used just for sending this story
pppppppppppppppppppppppppppppppppppppppppppppppppp

See All Ratings

pppppppppppppppppppppppppppppppppppppppppppppppppp

Load More

ppTrending in Video DoorbellsppThe Worst Home Products of 2023and What to Buy InsteadppBest Video Doorbell Cameras Without a SubscriptionppBest Video Doorbell Cameras of 2024ppWhich Ring Doorbell Should You Buyp