LABScon25 Replay | Are Your Chinese Cameras Spying For You Or On You?
Researchers expose shadow supply chain of Chinese smart cameras with firmware flaws and foreign data routing.
Marc Rogers and Silas Cutler presented research at LABScon 25 revealing how cheap Chinese smart home devices (video doorbells and security cameras) sold under rotating brand names like Eken and Tuck conceal a complex shadow supply chain involving shell companies and government-subsidized Allwinner semiconductors. Analysis uncovered hardcoded root passwords, inadequate security patches, and metadata/video routing through Hong Kong and China servers despite claims of local processing. The researchers traced networks of shell entities designed to evade regulatory oversight, describing patterns similar to malware distribution campaigns.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Allwinner?
Get an email when a new story names Allwinner, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonSecurity researchers exposed how cheap Chinese smart home cameras and doorbells sold under rotating brand names conceal a complex shadow supply chain involving shell companies and government-subsidized components. These devices contain hardcoded root passwords, inadequate security patching, and secretly route video data through China despite marketing claims of local processing. The shell company networks are designed to evade regulatory oversight using tactics similar to malware distribution campaigns. This demonstrates how nation-state actors can weaponize consumer IoT supply chains for surveillance while maintaining plausible deniability through corporate obfuscation.
What helps against this
How we list vendors- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- External attack surface management (EASM)
You find your forgotten internet-facing systems before attackers do.
- OT and industrial control system security
Factory, building and utility control systems get visibility and protection.