Dozens of Baker’s flaws in one small package
The Akuvox E11 seems like an interesting door camera, as it can open doors, capture live video and audio, take pictures of people walking by, and create real-time entry and exit logs. All the capabilities of small IoT devices are useful, assuming they are well protected to prevent unauthorized use. Sadly, this is a security nightmare and the 13 flaws revealed in this article are bad enough that you’d better unplug it before reading any further.
Some features don’t require proper authentication, and some have hardcoded keys encrypted using accessible keys. Captured still images are uploaded to an unencrypted FTP directory for anyone to view and download. It was also discovered that there is a way to circumvent authentication when accessing via a web interface that allows control over most features. As if that wasn’t enough, a phone app that communicates with the Akuvox E11 can be just as useful.
Akuvox, the company that caused this security nightmare, has not responded to multiple attempts to contact Claroty and the CERT organization. !
