Hacking the Eufy Doorbell and Base Station
A researcher showed Eufy doorbells can be deauthenticated off hidden Wi-Fi and credentials recovered from memory.
A security researcher published a reverse-engineering write-up of the Eufy Security Video Doorbell and Homebase Station 2. The doorbell joins a hidden WPA2 network named OCEAN_ plus the last 24 bits of the Homebase MAC (OUI 90:bf:d9), and the base acts as a gateway. Standard deauthentication disconnects the doorbell so live video and audio are not streamed, while local recording continues. The post also reverse engineers the soundwave sync protocol and recovers encrypted OCEAN credentials from a memory dump.
- Hidden SSID is OCEAN_ plus the last 24 bits of the Homebase MAC.
- 802.11 deauthentication stops live video and audio streaming to the base.
- Soundwave pairing protocol between doorbell and Homebase was reverse engineered.
- Encrypted OCEAN credentials were recovered from a doorbell memory dump.
- A 2023 USENIX study covered the same ecosystem; Eufy later changed the PSK.
From the original article
17 min read at adepts.of0x.cc
Dear Fell owl ship, I am delighted to inform you that the owls have found the time to get back to hacking in their spare time. After this two-year hiatus, we are pleased to preach a new homily from this humble digital pulpit of ours. Please, take a seat and listen to the story.
By adepts.of0x.cc via hoistbypetard · adepts.of0x.cc
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.