Eufy’s “No clouds” Cameras Upload Facial Thumbnails to AWS

[upnorth]

Content source

https://arstechnica.com/gadgets/2022/11/eufys-no-clouds-cameras-upload-facial-thumbnails-to-aws/

Eufy, a smart home brand of tech accessory firm Anker, had become popular among some privacy-minded security camera buyers. Its doorbell camera and other devices proudly proclaimed having "No Clouds or Costs," and that "no one has access to your data but you."

That's why security consultant and researcher Paul Moore's string of tweets and videos, demonstrating that Eufy cameras were uploading name-tagged thumbnail images to cloud servers to alert owners' phones, likely unencrypted, stung smart home and security enthusiasts so hard this week. Moore, based in the UK, started asking Eufy rhetorical questions about its practices on Twitter starting November 21. "Why is my 'local storage" #doorbellDual storing every face, without encryption, to your servers? Why can I stream my camera without #authentication?!" Moore also posted lines from "source code & API responses" that suggested a very weak AES key was being used to encrypt video footage.

On November 23, Moore uploaded a video that demonstrated his findings. With his Eufy Homebase unplugged, Moore walked in front of his camera. From an incognito web browser, Moore could pull up a thumbnail image of himself, an image of the feed shortly before he was visible, and—perhaps more concerning—ID numbers indicating his recognized face and his status as the camera owner.

Eufy, meanwhile, responded to Ars and other outlets with a statement. Eufy affirms that its video footage and "facial recognition technology" are "all processed and stored locally on the users' device." For mobile push notifications, however, thumbnail images are "briefly and securely stored on an AWS-based cloud server." They are server-side encrypted, behind usernames and passwords, automatically delete, and comply with Apple and Google's messaging standards, as well as General Data Protection Regulation (GDPR) standards.

Eufy admits that when users choose between text-based or thumbnail-based notifications from their system during setup, "it was not made clear that choosing thumbnail-based notifications would require preview images to be briefly hosted in the cloud."

Eufy’s “No clouds” cameras upload facial thumbnails to AWS

Company says it should have better informed users of how it sends mobile alerts.

arstechnica.com

 

[upnorth]

(Update 7:30 a.m. ET 12/2/2022: Eufy has issued a statement in response to findings from The Verge and a security researcher:

"eufy Security adamantly disagrees with the accusations levied against the company concerning the security of our products. However, we understand that the recent events may have caused concern for some users. We frequently review and test our security features and encourage feedback from the broader security industry to ensure we address all credible security vulnerabilities. If a credible vulnerability is identified, we take the necessary actions to correct it. In addition, we comply with all appropriate regulatory bodies in the markets where our products are sold. Finally, we encourage users to contact our dedicated customer support team with questions." The original story follows.)

Eufy didn't respond to other claims from security researcher Paul Moore and others, including that one could stream the feed from a Eufy camera in VLC Media Player, if you had the right URL. Last night, The Verge, working with the security researcher "wasabi" who first tweeted the problem, confirmed it could access Eufy camera streams, encryption-free, through a Eufy server URL.

This makes Eufy's privacy promises of footage that "never leaves the safety of your home," is end-to-end encrypted, and only sent "straight to your phone" highly misleading, if not outright dubious. It also contradicts an Anker/Eufy senior PR manager who told The Verge that "it is not possible" to watch footage using a third-party tool like VLC.

Eufy’s “local storage” cameras can be streamed from anywhere, unencrypted

The URLs for accessing your camera streams are also way too easy to brute-force.

arstechnica.com

 

[enaph]

Two weeks after getting caught lying to The Verge, Anker still hasn’t sent us any answers about its security cameras. Instead, it’s nerfed the Eufy “privacy commitment.”

Anker’s Eufy deleted these 10 privacy promises instead of answering our questions

Eufy lied to us about the security of its security cams.

www.theverge.com

 

[HarborFront]

According to the article below, EUFY has taken steps to address some issues. The other issues should be addressed in forthcoming firmware updates, since security vulnerabilities are now being exposed.

Security researcher says Eufy has a big security problem

Eufy cameras aren't as secure as they claim.

www.androidcentral.com

FI, I have this EUFY Security System setup with 9x IP cameras and a video doorbell. I have faith in EUFY that the mentioned vulnerabilities would be addressed subsequently.

Looking forward to upgrading all my EUFY 2K cameras to 4K next year once more 4K cameras are released

 

[upnorth]

Eufy, the Anker brand that positioned its security cameras as prioritizing "local storage" and "No clouds," has issued a statement in response to recent findings by security researchers and tech news sites. Eufy admits it could do better but also leaves some issues unaddressed.

In a thread titled "Re: Recent security claims against eufy Security," "eufy_official" writes to its "Security Cutomers and Partners." Eufy is "taking a new approach to home security," the company writes, designed to operate locally and "wherever possible" to avoid cloud servers. Video footage, facial recognition, and identity biometrics are managed on devices—"Not the cloud."

This reiteration comes after questions have been raised a few times in the past weeks about Eufy's cloud policies. A British security researcher found in late October that phone alerts sent from Eufy were stored on a cloud server, seemingly unencrypted, with face identification data included. Another firm at that time quickly summarized two years of findings on Eufy security, noting similar unencrypted file transfers.

Eufy publicly acknowledges some parts of its “No clouds” controversy

Eufy changed some cloud behavior, admitted it can do more, ignored some issues.

arstechnica.com

 

[HarborFront]

Well, that's improvement