Ethical Hacking of a Smart Video Doorbell

Abstract: With the rapid development of IoT, more and more cyber security threats occur in people’s lives. In addition, many IoT devices are closely related to lives and have a large number of users, such as smart home. Therefore, it is more worthy for the adversaries to launch attacks. This report provides a security analysis of a specific IoT device —- Xiaomi smart video doorbell, which is a popular choice of the smart home. The smart video doorbell, which is usually set outside the front door, is invented to guarantee and enhance the safety of users’ homes. It has the functionalities of smart motion detection, real-time video and it will send notifications to the user’s mobile application if somebody presses the ring button or stays in front of it. This thesis performs a security analysis of this smart video doorbell system via threat modeling and penetration testing. The results show that the target system is not secure enough and have vulnerabilities which can be exploited, such as data exposure, weak password encryption, lack of logging and so on. Improvements can be made although there is no critical or urgent vulnerability of the target system.