Exclusive: How safe is the Maximus Answer DualCam video doorbell?

Sectional: How prophylactic is the Maximus Respond DualCam video doorbell?

(Image credit: Maximus)

The Maximus Respond DualCam is i of the best video doorbells, as its two-camera setup lets y'all run across very clearly if someone left a parcel at your door. But while the DualCam may be proficient at protecting your packages, how good is it at protecting your data?

As part of a partnership with Tom'south Guide, security firm Bitdefender has analyzed the Maximus Reply DualCam video doorbell that Tom's Guide reviewed in 2022. Bitdefender looked at the video doorbell's network communications and its internal software and hardware, and its study report found the video doorbell'due south security to be pretty proficient overall.

I finally installed an indoor security camera — and you should, too
The best video doorbells you tin buy
Plus: Google Maps is getting a major upgrade for cyclists

Some bug with server authentication

The only major vulnerability was a lack of server hallmark in two instances. The video doorbell did non verify the Amazon Web Services data "saucepan" to which it uploaded video feeds and logs. Nor did it verify the server from which it downloaded firmware updates.

These network communications are sent using the plain old HTTPS spider web protocol, not the OpenVPN protocol used to handle commands to the video doorbell from the smartphone app.

That flaw could, at least in theory, lead to a homo-in-the-middle attack if an attacker who was already on the doorbell owner'southward home Wi-Fi network could force the doorbell to have a artificial HTTPS certificate and intercept the uploads.

"As a result," says the Bitdefender written report, "an attacker sitting between the photographic camera and the servers could intercept the uploaded logs and recordings."

So your nasty neighbour could intercept your video feed this manner. To protect yourself against such an attack, however unlikely information technology may be, make certain y'all use a potent, unique password to access your dwelling house Wi-Fi network.

As for the log files, "they practice not comprise sensitive information that could be useful to an attacker," the report says. "Most of the letters pertain to the operation of the camera."

While "the surrounding Wi-Fi networks and their MAC addresses are transmitted, too as the proper name of the electric current network" every bit office of the log files, "the password for the current network is not transmitted."

Firmware updates are very well protected

Hacking the doorbell with a bogus firmware update, a common method of attacking smart-home devices, would be very difficult to pull off on the Maximus Reply DualCam for a number of reasons.

First, the web address, or URL, of the update server seems to be hard-coded in the Maximus Answer DualCam video doorbell'south firmware, and changing the server address would crave root access.

2d, the Bitdefender written report says that "the set on requires knowledge of both the ta.key file (to authenticate TLS connections), and a way to fox the camera into connecting to the rogue server."

At to the lowest degree in theory, an attacker could perhaps "spoof" the Maximus server by setting up a rogue Wi-Fi hotspot and forcing the doorbell to connect to that. Then a poisoned DNS file on the rogue hotspot could redirect queries for the server URL to instead go to the attacker'southward auto as the "server."

3rd, setting up or changing the doorbell's Wi-Fi network connection tin can simply exist done via Bluetooth using the Kuna companion app on the owner's smartphone.

The Kuna app relays the doorbell'southward serial number plus random data — a "nonce," in cryptography terms — to the Maximus server. The server replies with a token (consisting of a "hashed" version of the nonce plus a secret lawmaking) that authorizes the video doorbell and gives the doorbell the local Wi-Fi access credentials it got from the owner'south Kuna smartphone app.

"The Bluetooth connexion can be established at any time to change the Wi-Fi network, but only the camera possessor can initiate it," the report says.

"If an assailant wishes to alter the network, they would demand either the secret to create the token, or the token provided from the server. The secret is unknown, and the server sends the token to the possessor just."

Finally, the Maximus Reply DualCam's firmware updates are digitally signed by the vendor. A rogue firmware update delivered past a rogue server would but non be installed.

"Any modifications to the binary will issue in a signature mismatch," says the report. "The binary will be discarded in this case. An attacker tin't forge the signature, as it requires the private certificate corresponding to the public key used to check the signature."

Locked down pretty tight

Otherwise, the Maximus Reply DualCam video doorbell has practiced security. Equally noted before, for most communications it uses the OpenVPN protocol to communicate with its server so that tertiary parties on the same wireless network as the video doorbell cannot decipher the signals.

Each photographic camera has a unique digital identifier to identify itself to its servers. Attempts to admission ports on the video doorbell over the local Wi-Fi network were unsuccessful, then was an endeavour to exploit the OpenVPN connection using a widely applicable flaw.

Commands sent by the owner to the video doorbell are routed through Maximus' servers, but each request has to be accompanied by an authorization token.

Also, "to modify the camera's settings, the user requires its series number. An attacker who knows the serial number cannot modify settings, equally ownership is validated."

Similar authentication is required for live streaming.

Even UART connections, which involve clipping wires to specific spots on the motherboard for software or hardware debugging, crave a countersign in this case. UART connections are often a reliable backstairs into a smart-home device, but non on the Maximus Answer DualCam video doorbell.

How Bitdefender tested the Maximus Answer DualCam

Bitdefender researchers used several tools and methods to analyze the security of the Maximus Answer DualCam.

A virtual machine running on a PC served as the Wi-Fi access indicate. The Burp Suite penetration-testing tool was used to monitor encrypted network traffic. The UBI Reader Extract Files utility was used to read the filesystem on the firmware deejay image.

The Bluetooth Host Controller Interface logging tool congenital into Android (with Developer fashion activated) was used to capture data packets exchanged between a smartphone and the video doorbell during the initial setup process, and the Wireshark network-packet analyzer was used to examine those packets. A custom digital certificate was used to stage a man-in-the-centre assail in lodge to decrypt traffic to and from the Android app.

The Ghidra decompiler developed past the U.Southward. National Security Agency was used to contrary-engineer binary data, i.due east. turning information that was just bits and bytes dorsum into source code. The network mapper Nmap was used to make up one's mind that the Maximus Answer DualCam had no open up ports.

Safe to apply? Yes, mostly

Overall, the Maximus Respond DualCam video doorbell seems condom to use, except for the remote possibility that someone already on your Wi-Fi network might be able to intercept the video feed, provided the assaulter knows how to spoof a digital server certificate.

We think that'southward not something nearly people would need to worry near, unless they work for a defense contractor or another organisation having to exercise with national security. If we were to give devices letter of the alphabet grades in security, we'd requite the Maximus Answer DualCam video doorbell an A-minus.

Paul Wagenseil is a senior editor at Tom's Guide focused on security and privacy. He has also been a dishwasher, fry cook, long-haul commuter, code monkey and video editor. He's been rooting around in the data-security space for more than than 15 years at FoxNews.com, SecurityNewsDaily, TechNewsDaily and Tom's Guide, has presented talks at the ShmooCon, DerbyCon and BSides Las Vegas hacker conferences, shown upward in random Television news spots and even moderated a panel discussion at the CEDIA habitation-engineering conference. You can follow his rants on Twitter at @snd_wagenseil.