Cracking the Eufy Doorbell — From the Front Door to the Home Network

After a two-year hiatus, the author of the Adepts of 0xCC blog returned to what he loves — hacking gadgets for fun. The spark was a workshop he wanted to give his brother-in-law, plus the sheer number of video doorbells in his tourist-saturated hometown. He picked the most common model as his target: the Eufy Security Video Doorbell ecosystem.

How the ecosystem works

The kit has two parts: a Homebase 2 station that connects to the internet, and the doorbell itself at your door. They talk over a hidden Wi-Fi network named OCEAN_XXXXXX, where the suffix is the last 24 bits of the base's MAC (the prefix is always 90:bf:d9). The base acts as a gateway, and that network is in no way isolated from the home LAN.

Three avenues of attack

Jamming. The hidden network uses plain WPA2 with no protection against deauthentication. A flood of deauth packets disconnects the doorbell from the base: video keeps recording locally but never reaches the app. Bases are trivial to locate by their known MAC prefix, after which you can calmly walk up, pull the device off the wall and open it — unnoticed.

The sound-based sync protocol. During pairing the base transmits data via... sound. The author — by his own admission clueless about maths and telecom — enlisted a friend and reverse-engineered the firmware to decode it: 19 frequencies spaced 150 Hz apart, symbols around 70 ms, blocks protected with Reed-Solomon correction and a CRC-16. It turned out the audio carries not the real hidden-network password but the credentials of a temporary hotspot. He wrote an inverse encoder, played synthetic audio near the doorbell, and it dutifully connected to his rogue network.

Pulling passwords from flash. A memory dump of the doorbell takes a couple of minutes via the SPI interface of an old Raspberry Pi. The es_config file is AES-128-ECB encrypted, but the key is derived from firmware-hardcoded data (a string XORed with a repeating pattern, then MD5'd) and is therefore identical across devices. Decryption reveals the hidden OCEAN network's SSID and password in plaintext.

Why it matters

With physical access to a doorbell — which nobody is watching for if the link has been jammed first — you can dump the flash in five minutes and recover the network keys. And since the base's network is not isolated, anyone who joins it gets internet access over the home connection and can reach other devices: the router, internal services. The author admits that for him the point was never the result, but rediscovering the joy of hacking something purely for the pleasure of learning.

Source: Lobsters