Dozens of Video Doorbells Sold on Amazon, Walmart Could Be Easily Hacked

Consumer Reports finds that numerous video doorbells being sold online don't offer data encryption and can be accessed remotely or in-person by a third-party attacker.onsumer Reports finds that numerous video doorbells being sold online don't offer data encryption and can be accessed remotely or in-person by a third-party attacker.

Video doorbells are supposed to improve your home's security by allowing you to privately view footage of what's happening outside your door. But some of the models being sold online may pose a security threat and leave you vulnerable to being spied on by attackers, a new investigation finds.

Consumer Reports has discovered that video camera doorbells issued by the Eken, Tuck, Fishbot, and Rakeblue brands pose a security risk to customers because the Eken-owned app that controls them, Aiwit, is not encrypted. This allowed the publication to be able to effectively "hack" into one of the doorbells to view a colleague through the camera nearly 3,000 miles away. These doorbells also don't conceal the home IP address and WiFi network they're connected to.

If someone isn't a hacker or tech expert, it's also possible to gain control of one of these doorbells simply by downloading the app and pairing the physical device to their phone, the report finds. Even though the original owner will be notified of this change, a spying individual could still be able to view the camera's video feed indefinitely because the device doesn't conceal its serial number, either.

While Amazon and Shein sell the doorbells under brands like those listed above, Walmart is selling them under names like Andoe, Gemee, and Luckwolf, Consumer Reports finds. Sears is also reportedly selling such devices with lackluster security. Temu was also selling devices of concern, but Temu claims it's since removed any doorbell cameras that use the Aiwit app from its site. The CR report suggests that similar doorbells remain on Temu's site, however.

Given the number of different brand names and the fact that these names aren't present on many of the doorbell cameras themselves, it's also possible that sellers could simply change the names of the devices in the future.

Walmart told Consumer Reports that it removes any products from its site that don't meet safety standards and legal requirements, but a quick PCMag search shows Andoe and Luckwolf doorbells still available on Walmart's US site at time of writing.

CR also alleges that these doorbells also lack any visible US Federal Communications Commission (FCC) ID numbers, meaning it's actually illegal to sell them in the US.

Unfortunately, a quick search on Amazon shows tons of results for such cameras, including multiple that Amazon even considers its "Overall Pick." Each of these cameras has anywhere from hundreds to thousands of reviews, suggesting thousands of consumers could now be at risk.

This isn't the first time doorbell cameras have raised security concerns, however. Wyze cameras glitched last year, showing other people's video feeds to camera owners. And customers expecting their data to be encrypted may also be disappointed to learn that Eufy brand owner Anker admitted last month that its cameras' data haven't always been encrypted.

PCMag has reached out to Amazon for comment.

By Kate Irwin

February 29, 2024