Researchers Find Hardcoded Credentials in Cheap Smart Cameras
Summary
A LABScon 2025 investigation found Eken- and Tuck-branded cameras and doorbells share Allwinner hardware, hardcoded root credentials, and superficial firmware fixes. Researchers say traffic routes through China and Hong Kong and warn that opaque suppliers and remote re-
Key points
- Marc Rogers and Silas Cutler investigated low-cost video doorbells and cameras sold under rotating brands including Eken and Tuck.
- The devices share hardware platforms based on Allwinner semiconductors.
- Firmware analysis found hardcoded root passwords and purported fixes that commented out vulnerable services rather than removing them.
- The researchers report that device metadata and video are frequently routed through servers in Hong Kong and mainland China.
- They traced shell companies, fictional personas, non-responsive registered agents, and PO boxes that they say obscure manufacturers and hinder enforcement.
- The researchers warn that overseas configuration pushes could control many devices, but stop short of alleging intentional malice.
Article Details
- Attack Vectors
- Firmware contained hardcoded root passwords, according to the researchers.
- Some reported security fixes only commented vulnerable services out of startup scripts rather than removing them.
- The researchers said devices could be controlled through remote configuration pushes from overseas.