Security vulnerabilities ‘could allow a dangerous person to take control of the video doorbell on their target’s home,’ consumer advocacy says
A Chinese smart home device maker whose cameras have raised security and privacy concerns will be fined nearly $735,000 for allegedly making a false statement under a U.S. regulator’s proposal.
The FCC identified this issue as part of a broader inquiry into possible security and privacy violations by Eken, along with several other Chinese smart home manufacturers. The commission said its investigation remains ongoing.
Security Flaws
Accessing Eken’s doorbell cameras doesn’t require tools or advanced hacking skills, Consumer Reports said in their February report. All that’s needed is to create an account on the doorbell’s official app, Aiwit. Once in close proximity, malicious users can control the doorbell camera by pressing a button on the device to pair it with their smartphones.
Even after regaining control, the device owner remains at risk, as intruders can still access the camera’s feed using the camera’s serial number. No password or account is needed for continued access, and the camera owners won’t receive any alerts about the breach, Consumer Reports’s engineers found.
Other issues outlined in the report include the exposure of owners’ IP addresses and WiFi network names without encryption.
In addition to security flaws, Rubio also raised concerns about the lack of proper FCC ID labels on Eken’s devices, which could make sale, use, or even shipping into the United States illegal without it.
‘Real and Tangible Threat’
Consumer Reports said in April that the Chinese company had released a firmware update to address security vulnerabilities after discussions with their engineering team.
As a result, the commission announced an audit of “hundreds of certifications” that are registered with the same U.S. agent information as Eken.
Eken did not respond to The Epoch Times’ request for comment by publication time.
Geoffrey Starks, an FCC commissioner, testifies during an oversight hearing to examine the Federal Communications Commission in Washington on June 24, 2020. Jonathan Newton/POOL/AFP via Getty Images
He explained that when a device is compromised, it creates a backdoor into networks, enabling hackers to engage in “identity theft, espionage, and fraud”—costing consumers potentially “billions of dollars.”
Moreover, Starks warned these devices could be exploited as part of a botnet, contributing to large-scale attacks that threaten national security.
That breach is just part of the Chinese Communist Party’s sweeping effort to infiltrate and exploit U.S. infrastructure.
“Salt Typhoon,” another China-backed cyberespionage operation that was uncovered last month, was believed to have compromised major telecommunications service providers, such as those of AT&T and CenturyLink.
Sen. Mark Warner (D-Va.), chairman of the Senate Select Committee on Intelligence, characterized this cyberattack as “unprecedented in its size and scope.”
“I think it will go down as maybe one of the most significant cyberattacks we’ve faced in our country.”
Source link
Add comment