From your doorbell to your home network

Dear Fell owl ship, I am delighted to inform you that the owls have found the time to get back to hacking in their spare time. After this two-year hiatus, we are pleased to preach a new homily from this humble digital pulpit of ours.

---

🗺️ Table of Contents

This piece is considerably more exhaustive than my typical entries. Feel free to use the following list to navigate to the specific technicalities that interest you, though this little owl would be thrilled if you read the entire narrative.

• 0x00 Preamble (The "Why")
• 0x01 Introduction to the ecosystem (Hardware & Architecture)
• 0x02 Jamming (Denial of Service)
• 0x03 Soundwave Protocol (Reverse Engineering Sync)
• 0x04 Memory Dump (Extracting OCEAN_XXXXXX credentials)
• 0x05 Config Analysis (Decrypting the hidden network credentials)

---

0x00 Preamble

Last June, I attended the EuskalHack congress to deliver a presentation (a basic 101 guide regarding Linux environments joined to Active Directory). I brought my brother-in-law along; he was wrapping up his Master's in Computer Science—since it seems a Bachelor's is no longer sufficient and a qualifying Master's is now mandatory—and I wanted to introduce him to the world of hacking to see if it sparked any curiosity.

As it turned out, I was successful. A presentation by Pepelux regarding the exploitation of a video intercom system completely captivated him. To keep that momentum going, I suggested we spend the summer hacking a gadget as a practical learning exercise.

After a few weeks of searching for a target, I noticed something while walking through my city: the staggering prevalence of video doorbells. Unfortunately, my hometown is suffering from a modern-day cancer the unchecked growth of tourism and the subsequent erosion of community life caused by short-term rentals. It is a tumor that causes social necrosis in our neighborhoods.

Naturally, I decided to fight back the only way I knew how: identify the most popular model used by these rentals and destroy it pwn it. Thus, I targeted the Eufy Security Video Doorbell ecosystem.

---

0x01 Introduction to the ecosystem

I acquired a "Eufy Security Video Doorbell" kit online. As indicated on the packaging, the system consists of two primary hardware components:

The Homebase acts as the brain, connecting to the "intertubes," while the doorbell is mounted externally. The communication between the doorbell (and likely other Eufy peripherals) and the Homebase occurs over a hidden WiFi network.

The kit even includes a helpful sticker to notify your neighbors that they are being monitored $24/7$: 24/7 video recorded.

System Architecture

Everything is managed via a mobile application, which handles device pairing and general configuration. I noted a previous USENIX presentation titled "Reverse Engineering the Eufy Ecosystem: A Deep Dive into Security Vulnerabilities and Proprietary Protocols." That research (from 2023) highlighted low entropy in the generation of the Pre-Shared Key (PSK) for the management network.

While Eufy has since updated several elements (the PSK is no longer just 8 bytes), one thing remains constant: the hidden SSID follows the pattern OCEAN_XXXXXX, where the suffix represents the last 24 bits of the Homebase's MAC address.

Because the Homebase serves as a gateway, anyone who manages to connect to that hidden network can potentially browse the local network freely, gaining access to other devices or the router's web interface.

---

0x02 Jamming

My first instinct was to test if the system relied on standard WPA2 without additional protections. Specifically, I wondered: Is it vulnerable to deauthentication packets?

The answer is yes. By flooding the device with deauth packets, you can force the doorbell to disconnect from the hidden network. While the doorbell will still record video/audio locally, it cannot stream that data to the Homebase or the app. This creates a window of opportunity to:

1. Physically approach the device.
2. Apply a "wellness massage" with a heavy stone.
3. Open the casing to dump the memory and close it back up without the owner being alerted in real-time.

Disclaimer: This is a threat modeling exercise; I am not encouraging vandalism.

Locating the Target

Finding a Homebase is straightforward because they share a known MAC prefix: 90:bf:d9.

The Attack Workflow:

1. Use an Alfa wifi antenna paired with a battery-powered Raspberry Pi.
2. Scan for beacons from stations matching the prefix.
3. Identify the operating channel.
4. Send a probe request for the SSID OCEAN_XXXXXX, calculating the suffix using the observed MAC:

$\text{SSID} = \text{"OCEAN\_"} + \text{MAC}_{\text{last 24 bits}}$

# Example conceptual command for probing
aireplay-ng -0 5 -a 90:bf:d9:XX:XX:XX -c OCEAN_XXXXXX wlan0mon