--- title: From your doorbell to your home network | daily.dev description: A detailed security research writeup on the Eufy Security Video Doorbell ecosystem, covering three attack vectors: (1) WiFi deauthentication attacks to... canonical: https://daily.dev/posts/from-your-doorbell-to-your-home-network-xbypvw6qr twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: From your doorbell to your home network | daily.dev og:description: A detailed security research writeup on the Eufy Security Video Doorbell ecosystem, covering three attack vectors: (1) WiFi deauthentication attacks to... og:url: https://daily.dev/posts/from-your-doorbell-to-your-home-network-xbypvw6qr og:image: https://api.daily.dev/og/posts/XbYPVw6QR.png og:image:alt: From your doorbell to your home network og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # From your doorbell to your home network **[Hacker News](https://daily.dev/sources/hn)** · 32 min read · 0 upvotes · 0 comments ## Summary A detailed security research writeup on the Eufy Security Video Doorbell ecosystem, covering three attack vectors: (1) WiFi deauthentication attacks to disconnect the doorbell from its hidden OCEAN_XXXXXX management network using broadcast deauth packets, (2) full reverse engineering of the soundwave-based sync protocol used to pair the doorbell with the Homebase — including frequency analysis (19 tones, 150Hz apart), Reed-Solomon error correction, and CRC-16 validation — culminating in a working encoder/decoder, and (3) extraction and decryption of the OCEAN_XXXXXX hidden network credentials from the doorbell's flash memory. The config file (es_config) is encrypted with AES-128-ECB using a hardcoded key derived from a fixed string XORed with a repeating 3-byte pattern and then MD5-hashed. Connecting to the OCEAN network grants full internet access through the home network and access to other devices on the same router, including the router's admin interface. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does the Eufy doorbell sync with the Homebase station using sound? The Homebase emits an ultrasonic tone sequence encoding a temporary SSID and password for a short-lived hotspot, not the actual hidden network credentials. The doorbell decodes 19 frequencies spaced 150Hz apart using Reed-Solomon error correction and CRC-16 validation, connects to that temporary hotspot, then receives the real OCEAN_XXXXXX network credentials out-of-band over TCP or UDP. _Curious readers piecing together obscure IoT protocols can follow reverse-engineering breakdowns like this on daily.dev._ ### Can you deauth a Eufy video doorbell to disconnect it from its Homebase? Yes, because the hidden OCEAN_XXXXXX network uses standard WPA2 with no additional protection, an attacker can flood it with broadcast deauthentication packets to disconnect the doorbell from the Homebase. This stops video and audio from streaming to the app while still recording locally, creating a window to physically tamper with the device undetected. _Anyone assessing wifi camera and IoT deauth risks can track findings like this via daily.dev._ ### How is the OCEAN_XXXXXX wifi password stored and encrypted on the Eufy doorbell firmware? The hidden network credentials are stored in an es_config file encrypted with AES-128-ECB using a hardcoded key derived from a fixed 64-byte alphabet string, XORed with a repeating 3-byte pattern (0x01, 0x04, 0x06), then MD5-hashed to produce the 16-byte key C0C714B43806EF49. Because the key is hardcoded, it is identical across devices, so dumping flash memory reveals the SSID and password for any unit. _Developers auditing embedded device encryption schemes can keep up with hardware teardown research through daily.dev._ ## Community take How the wider developer community reacted, aggregated from 1 discussion and 8 comments across hackernews (as of 2026-09-14). **TL;DR:** Commenters are largely unsurprised by the vulnerabilities and use the writeup as a springboard to discuss network isolation strategies and the broader problem of poorly designed IoT devices on home networks. **Sentiment:** 20% positive · 40% mixed · 40% skeptical **The case for** - The soundwave-based sync protocol was noted as a neat, more thoughtful design than expected for a consumer IoT device. **The pushback** - The hidden OCEAN management network with hardcoded, weakly derived AES keys is seen as poor security design. - Connecting to the OCEAN network exposes the full home network and router admin interface, a serious lateral-movement risk. - VLAN isolation sacrifices product functionality, forcing users to choose between security and convenience. **By community** - hackernews (mixed): Commenters acknowledge the research is interesting but treat the vulnerabilities as an expected outcome of poorly designed IoT, pivoting quickly to mitigation strategies like VLANs and Zigbee. **Hottest debate:** Whether VLAN isolation is a practical solution given that it degrades the product's remote-access functionality. **Open questions** - Is there a way to achieve both genuine network isolation and full remote-access convenience for smart home devices? - Will Matter replace Zigbee as the go-to privacy-respecting protocol, and does it offer comparable network-level isolation? **Highlights** > This is why my doorbell is on a separate VLAN, without internet access. > — [Fnoord on hackernews · 1 comments](https://news.ycombinator.com/item?id=49224488) > Network isolation, unless it's true airgapping (and then lack of remote access is a feature), relies on router not forwarding traffic where it shouldn't go. Same goes for NVR or intermediate hub(s) (if NVR is somewhere outside of one's premises). They should only accept what they need and know how to handle, and reject anything else. Those Eufy homebases are just poorly designed, that's all. > — [drdaeman on hackernews](https://news.ycombinator.com/item?id=49226177) > This was honestly more secure than I expected. Nothing that would survive defcon but that’s a neat sync protocol. > — [showerst on hackernews](https://news.ycombinator.com/item?id=49224014) > Does anyone ever wonder why a doorbell needs to be connected? I do, so I don't have one. Diminishing returns by design? I've never been like "oh I am glad my doorbell is connected to my network". Wondering what marketing I didn't see (and fall for). > — [baw-bag on hackernews](https://news.ycombinator.com/item?id=49226381) **Source threads** - [hackernews](https://news.ycombinator.com/item?id=49177224) · 67 points · 8 comments ## Similar posts on daily.dev - [Anyone on the Internet Can Ring Your Doorbell](https://daily.dev/posts/anyone-on-the-internet-can-ring-your-doorbell-phnpjhrsg) · Hacker News · 1 upvotes · 0 comments - [Zigbee protocol security assessment](https://daily.dev/posts/zigbee-protocol-security-assessment-m49uj0izz) · Securelist · 0 upvotes · 0 comments - [My doorbell tells me who's at the door before I look, and the recognition runs on the NAS in my cupboard](https://daily.dev/posts/my-doorbell-tells-me-who-s-at-the-door-before-i-look-and-the-recognition-runs-on-the-nas-in-my-cupb-gqyxrmlq7) · XDA Developers · 0 upvotes · 0 comments - [Connected & Compromised: When IoT Devices Turn Into Threats](https://daily.dev/posts/connected-compromised-when-iot-devices-turn-into-threats-ubqear0qp) · Dark Reading · 0 upvotes · 0 comments --- Tags: [#hardware](https://daily.dev/tags/hardware), [#reverse-engineering](https://daily.dev/tags/reverse-engineering) [View this post on daily.dev](https://daily.dev/posts/from-your-doorbell-to-your-home-network-xbypvw6qr) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"From your doorbell to your home network","url":"https://daily.dev/posts/from-your-doorbell-to-your-home-network-xbypvw6qr","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/from-your-doorbell-to-your-home-network-xbypvw6qr"},"datePublished":"2026-08-08T21:47:29.168Z","dateModified":"2026-09-14T06:16:40.784Z","description":"A detailed security research writeup on the Eufy Security Video Doorbell ecosystem, covering three attack vectors: (1) WiFi deauthentication attacks to...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/7a5feb395574f804a1e3a21fe3e88937?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/7a5feb395574f804a1e3a21fe3e88937?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Hacker News","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Hacker News","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/hn","url":"https://daily.dev/sources/hn"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/from-your-doorbell-to-your-home-network-xbypvw6qr","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"hardware,reverse-engineering","timeRequired":"PT32M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Hacker News","item":"https://daily.dev/sources/hn"},{"@type":"ListItem","position":3,"name":"From your doorbell to your home network"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/from-your-doorbell-to-your-home-network-xbypvw6qr#faq","mainEntity":[{"@type":"Question","name":"How does the Eufy doorbell sync with the Homebase station using sound?","acceptedAnswer":{"@type":"Answer","text":"The Homebase emits an ultrasonic tone sequence encoding a temporary SSID and password for a short-lived hotspot, not the actual hidden network credentials. The doorbell decodes 19 frequencies spaced 150Hz apart using Reed-Solomon error correction and CRC-16 validation, connects to that temporary hotspot, then receives the real OCEAN_XXXXXX network credentials out-of-band over TCP or UDP. Curious readers piecing together obscure IoT protocols can follow reverse-engineering breakdowns like this on daily.dev."}},{"@type":"Question","name":"Can you deauth a Eufy video doorbell to disconnect it from its Homebase?","acceptedAnswer":{"@type":"Answer","text":"Yes, because the hidden OCEAN_XXXXXX network uses standard WPA2 with no additional protection, an attacker can flood it with broadcast deauthentication packets to disconnect the doorbell from the Homebase. This stops video and audio from streaming to the app while still recording locally, creating a window to physically tamper with the device undetected. Anyone assessing wifi camera and IoT deauth risks can track findings like this via daily.dev."}},{"@type":"Question","name":"How is the OCEAN_XXXXXX wifi password stored and encrypted on the Eufy doorbell firmware?","acceptedAnswer":{"@type":"Answer","text":"The hidden network credentials are stored in an es_config file encrypted with AES-128-ECB using a hardcoded key derived from a fixed 64-byte alphabet string, XORed with a repeating 3-byte pattern (0x01, 0x04, 0x06), then MD5-hashed to produce the 16-byte key C0C714B43806EF49. Because the key is hardcoded, it is identical across devices, so dumping flash memory reveals the SSID and password for any unit. Developers auditing embedded device encryption schemes can keep up with hardware teardown research through daily.dev."}}]} ```