Red Team at My Front Door: I Hired a Hacker to Break My DIY Video Doorbell

There's a special kind of confidence that comes from building your own gadgets. You soldered it. You flashed it. Surely nobody's getting in, right?

That confidence lasted about four minutes into my conversation with Marcus, a penetration tester I know from a local Def Con meetup. When I told him I'd built a self-hosted video doorbell on an ESP32-CAM, he didn't say "cool." He said, "Can I try it?"

So I did what any paranoid maker would do: I set up a sacrificial copy of the whole system on an isolated VLAN, gave him the address, and told him to go nuts.

The Build, Quickly

The hardware is boring in the best way. An ESP32-CAM board (~$10), a cheap wide-angle lens swap, a PIR sensor for motion wake, a 18650 battery with a solar trickle charger, and a reed switch on the doorbell button. Firmware is a custom ESP-IDF project — not Arduino — because I wanted control over the RTSP stream, the TLS stack, and the OTA update path.

Video never touches the internet. Motion clips land on a Raspberry Pi running Frigate inside the house, and notifications go out through a local MQTT broker. If my WAN goes down, the doorbell still works. If my cloud provider (there isn't one) went down, well.

Total cost: about $60. Total monthly cost: zero.

Round One: Marcus Finds Three Holes in Twenty Minutes

I expected a leisurely audit. What I got was a Slack message 22 minutes in: "Found something. And something else. And something you're really not going to like."

Finding #1: The web fallback UI had no rate limiting. I'd built a tiny settings page reachable over the LAN in case MQTT died. It had a password. But nothing stopped Marcus from guessing it a million times a second. Classic. Fixed with a five-attempt lockout and a 30-second backoff.

Finding #2: My RTSP stream was unauthenticated on the internal network. I'd told myself "it's on a trusted VLAN, it's fine." Marcus pointed out that any compromised IoT device on that VLAN — a smart plug, a TV — could silently watch my front door. Stream auth went in that night.

Finding #3, the ugly one: during boot, before TLS keys loaded, the camera exposed a brief unencrypted status beacon. It lasted 800 milliseconds. Marcus caught it by recording traffic across a dozen reboots. The lesson: security holes don't need to be open all day. They just need to be open once.

The Privacy Math Commercial Doorbells Don't Advertise

Here's the thing that kept me motivated through the fixes. A mainstream video doorbell in the US runs $100–250 up front, then $3–6/month for features that should be standard — clip history, person detection, working notifications. That's $40–70 a year, forever, for footage that lives on someone else's servers under a privacy policy you agreed to without reading.

And those policies are worth reading. Most commercial doorbells reserve the right to share video with law enforcement on request, use footage for "service improvement," and retain clips for 30–60 days. One major brand's policy explicitly covers audio transcription.

My DIY setup sends nothing anywhere. My footage stays on a Pi in my closet. The tradeoff is real — I'm my own support department, my detection is dumber than a cloud AI's, and when the firmware breaks, only I can fix it. But nobody can subpoena my doorbell footage from a company that has it.

The Hardening Checklist

Steal this. It applies to any DIY camera — ESP32-CAM, old phone, Raspberry Pi, whatever.

1. Auth on everything, including "internal" services. VLAN trust is a myth the moment any device on that network gets popped.
2. TLS from the first byte. Generate keys in the bootloader before any network service starts. Audit your boot sequence — I didn't.
3. Rate-limit and lock out. Any password prompt should punish brute force.
4. Signed OTA updates only. If your firmware accepts unsigned updates, so does whoever owns your network.
5. Deny by default at the router. The doorbell gets outbound access to nothing. NTP from the local network only.
6. Watch your own traffic. A $10 Wi-Fi Pineapple alternative (or just Wireshark on a mirrored port) will show you what your device actually does. Mine beacons less than my TV does by a factor of a thousand.
7. Physical tamper matters too. Marcus couldn't crack the firmware remotely, but he noted the camera pops off its mount with a firm tug. A security screw cost me $2.

Was It Worth It?

Six weeks of evenings, three firmware rewrites, and one bruised ego later, the doorbell works. It survives the hacker test as well as anything in my house — better than the commercial gear I've sniffed before. Marcus's final report ended with a line I've now taped to my monitor: "Secure enough is a process, not a firmware version."

If you build it, budget as much time for hardening as for building. The fun part is the soldering. The important part is everything after.