Hacking the Eufy Doorbell and Base Station
Here is the follow-up dive into the base station Comments
The narrative begins with the author reflecting on their involvement in hacking, specifically mentioning a presentation they gave at the EuskalHack congress. They recount their interest in hacking a video intercom, which led them to choose the Eufy Security Video Doorbell as their target gadget. The author bought an Eufy Security Video Doorbell from the internet, noting that it consists of two parts: a Homebase Station 2 and the Doorbell itself.
The Homebase Station 2 functions as a central hub, connected to the internet via Wi-Fi or an Ethernet cable, while the Doorbell is placed on the door.
The devices communicate with each other through a hidden Wi-Fi network named OCEAN_XXXXXX, where the suffix is the last 24 bits of the Homebase's MAC address. The Homebase Station 2 acts as a gateway, allowing the device to connect to the internet. The author hypothesizes that if this system uses standard WPA2 without any protection, it could be vulnerable to deauthentication packets, potentially allowing physical manipulation of the device.
The author explains how they discovered the hidden network by sending deauthentication packets remotely and identifying the network's channel using a battery-powered Raspberry Pi. They emphasize that the synchronization process between the Doorbell and Homebase Station 2 is accomplished through sound waves. Initially, they believed the Homebase Station 2 encoded the SSID and passphrase in a soundwave, but later found it was for a temporary hotspot only used during the initial connection process. The actual SSID and password are shared out-of-band after the Doorbell connects to the hotspot.
Written by urgent.news from Lobsters's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
