Recently, to bridge the gap between security of Measurement-device-independent quantum key distribution (MDI-QKD) and a high key rate, a novel protocol, the so-called detector-device-independent QKD (DDI-QKD), has been independently proposed by several groups and has attracted great interest. A higher key rate is obtained, since a single photon bell state measurement (BSM) setup is applied to DDI-QKD. Subsequently, Qi has proposed two attacks for this protocol. However, the first attack, in which Bob's BSM setup is assumed to be completely a "black box", is easily prevented by using some additional monitoring devices or by specifically characterizing the BSM. The second attack, which combines the blinding attack and the detector wavelength-dependent efficiency, is not explicitly discussed, and its feasibility is not experimentally confirmed. Here, we show that the second attack is not technically viable because of an intrinsically wavelength-dependent property of a realistic beam splitter, which is an essential component in DDI-QKD. Moreover, we propose a feasible attack that combines a well-known attack-detector blinding attack with intrinsic imperfections of single-photon detectors. The experimental measurement and proof-of-principle test results confirm that our attack can allow Eve to get a copy of quantum keys without being detected and that it is feasible with current technology.