CyberCX raises alarm on Chinese device security risks

CyberCX has alerted consumers to the potential security risks associated with Chinese-manufactured internet-connected devices following an investigation involving a compromised doorbell in Australia.

The Digital Forensics and Incident Response (DFIR) team at CyberCX found that a Dahua connected doorbell in an Australian home had been compromised by an attacker. Through the breach, the device became part of a botnet, allowing the attacker to potentially gain access to other devices connected to the same Wi-Fi network, such as computers, televisions, and security systems.

The attacker manipulated the compromised doorbell to receive a live surveillance feed of the household's front door and driveway while simultaneously blocking the family from accessing the device. This breach was identified only when a household member connected a work computer to the compromised home Wi-Fi, which triggered an alert in their employer's cyber security system.

The alert from CyberCX coincides with security concerns in the United States, where authorities are contemplating a ban on TP-Link routers, which are also available in Australia, due to alleged cyber attack connections. Furthermore, the U.S. has previously banned Chinese-made software and hardware in cars over data collection and national security concerns.

Alastair MacGibbon, Chief Strategy Officer at CyberCX, stated: "Chinese internet connected devices are manufactured and sold at the lowest possible cost and with negligible security measures, leaving many wide open for exploitation by criminals. We are effectively sleepwalking into a world where demonstrably unsafe Chinese products are flooding the Australian market."

MacGibbon further explained: "Internet-connected devices are not secure when they come out of the box, and while these risks can apply to all connected devices in the home, they are particularly pronounced for Chinese-made tech which requires a constant, ongoing connection to Chinese manufacturers to operate, leaving them at the whim of Chinese government security agency direction and surveillance. While these cheap, imported devices are attractive to cost-conscious consumers battling the rising costs of living, consumers need to understand they are effectively bringing foreign surveillance tools into their homes."

MacGibbon acknowledged the Australian government's recent implementation of new security requirements for smart devices as part of last year's cyber security reforms but noted the ambiguity about how these measures will shield households from the influx of low-cost connected devices available on platforms such as Temu and Shein.

The company's investigation highlights an increasing convergence between home and workplace security, revealing how compromised personal 'smart' devices at home can serve as an entry point for criminals or state-sponsored actors to breach corporate networks.