Reverse Engineering the Eufy Ecosystem: A Deep Dive into Security Vulnerabilities...
summary
Reverse engineering of the Eufy doorbell and Homebase recovers keys and decrypts stored images by extracting serial-derived credentials (MD5 then base64 then first eight bytes, yielding only 16 million combos) and a tiny server-side base parameter (4 chars, entropy ~35), allowing offline brute force of the VAPI handshake in sub-20 seconds and access to the consumer LAN via the Homebase. A custom selective-execution debugger, dAngr, reconstructs cross-architecture encryption keys and automates the exploit chain; vulnerabilities were disclosed and patched with a CVE rated ~9.3.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 0:50What is Eufy
- 1:50Cracking the WE key
- 5:00Breaking the encryption
- 7:00Emulation
- 8:35Binary Lifting
- 9:05Danger
- 10:40How to use Danger
- 13:30Insights
related talks
31mAnti-Forensics: Reverse Engineering a Leading Phone Forensic Tool
01h 06mBackdoors in Back Doors
41mUnlocking Any Door In 21st Century. Immersion In Bio-Security
40mHis Power Level is Over 9000! Vulnerabilities in Solar Panel Controllers
37mOpen Sesame! The full story behind opening a smart lock
18mOwning the Smart Home with Logitech Harmony Hub
39mHow Ecovacs Robots Got Hacked And What We Can Learn From It
52mIoT Hacking 101: Reverse Engineering The Xiaomi Ecosystem