Eken fixes ‘terrible’ video doorbell issue that could allow someone to spy on you

A company that makes video doorbells found by Consumer Reports contain serious security vulnerabilities issued a correction, the consumer advocacy group is reporting. Eken Group has issued a firmware update for the affected security products under its own name, as well as those from other brands with which it has licensing agreements, including Fishbot, Rakeblue, Tuck and others. All video doorbells use the Aiwit smartphone app and can be purchased from popular online retailers like Amazon, Shein, Temu and Walmart.

In February, CR reported that it found vulnerabilities in Video doorbells produced by Eken this “could allow a dangerous person to take control of the video doorbell at their target’s home.”

Gaining access to the doorbell didn’t even require any level of hacking knowledge: bad actors could simply download the Aiwit app, go to the target’s house and hold down the doorbell button to pair it with their own smartphones, changing the Wi-Fi. network and take control of the device.

Additionally, anyone with the doorbell’s serial number can remotely view still images from the video feed – no password or account required, CR security experts discovered. Doorbell owners did not receive any type of notification if another user accessed their video feed in this manner.

The doorbells also did not encrypt the user’s home IP address or Wi-Fi network, leaving both potentially exposed to criminals.

The bells that CR initially reviewed were sold under the brands Eken and Tuck and appeared identical as both required users to download the Aiwit smartphone app. The group I later found 10 other seemingly identical doorbells made by Eken but sold under several different brand names.

CR reviewed the Eken firmware update and said the issue was fixed. “While we would prefer products to be safe and secure from their initial release, our testing’s ability to uncover vulnerabilities results in better products for consumers,” CRsaid the company’s senior director of product testing, Maria Rerecich, in her report.

As a result of CRAccording to FCC reports, the FCC asked Amazon, Sears, Shein, Temu and Walmart for more details about how they vet products sold on their platform. None of the five retailers responded to CRrequest for comment on the matter.

Eken’s video doorbells also did not have Federal Communications Commission identification labels, which are required by law, CR found. The company has since added FCC IDs to electronic doorbell manuals.

Since CR published its February report, many of the Eken doorbells have been withdrawn from online retailers. Notably, several doorbells were selected as Amazon: General Choices or with the Amazon’s Choice badge, a label with arcane criteria that Amazon has refused to fully explain and can be found on many questionable products.

If you have a video doorbell produced by Eken, make sure your firmware is up to date. Your doorbell should receive the update automatically, but you may want to double-check. Go to the “Devices” page of the Aiwit app and tap the doorbell name, which should open the settings. The firmware number must be 2.4.1 or higher, which indicates that it is up to date.