10 ms·

Anker’s Eufy lied to us about the security of its security cameras

256 points by nathan_phoenix 4y ago

jasonhansel 4y ago
> there’s no proof yet that this has been exploited in the wild Give it a few days.
nathan_phoenix 4y ago
In-short: "Anker has built a remarkable reputation for quality over the past decade [...], including the Eufy home security cameras [...]. Eufy’s commitment to privacy is remarkable: it promises your data will be stored locally, [...], that its footage only gets transmitted with “end-to-end” military-grade encryption, and that it will only send that footage “straight to your phone.” So you can imagine our surprise to learn you can stream video from a Eufy camera, from the other side of the country, with no encryption at all." And a tweet showcasing how to get the unencrypted video/images from the security researcher who discovered the issue: https://twitter.com/paul_reviews/status/1595421705996042240 https://twitter.com/paul_reviews/status/1595421705996042240
- aritmo 4y ago
  The media transfers are encrypted. But he uses the Developer Tools of the browser, so he sees the content of the encrypted packets. It is obvious that any cloud-based security camera has to send the media to the cloud! There is no other way. The marketing people at Eufy made a long series of mistakes. It is a marketing problem.
  - nathan_phoenix 4y ago
    Eufy markets their cameras as privacy focused, using local storage and local processing without using cloud storage so I'm not sure how you concluded against their marketing that it's cloud based. Also he opens the link in a new private session which doesn't have the auth cookies. Furthermore, he later explains that there is no auth happening. Lastly The Verge confirmed it by watching the camera stream using plain VLC.
  - kodah 4y ago
    Eufy isn't cloud-based.
    - haswell 4y ago
      The fact that they are indeed cloud-based is why this story has been blowing up and making quite a few people upset. The reality is, even if the cameras are not configured to save video to Eufy's cloud service, thumbnails are still transmitted to Eufy for the purpose of facilitating push notifications (confirmed by Eufy), and the researcher who discovered this claims to have found a way to access camera feeds without authentication as well (this is not confirmed, and one of the most questionable claims). I own several of these cameras but have them configured as HomeKit devices, and while I'm not terribly concerned about the transmission of thumbnails since this is the name of the game if you want a preview in a push notification, I've always felt a little weird about the fact that these cameras require a Eufy account to configure, and you can access the live streams by logging into that account, even after the cameras have been configured as HomeKit cameras.
      - afavour 4y ago
        > this is the name of the game if you want a preview in a push notification I’m not sure that’s actually true. iOS has notification service extensions that I think could be used to decrypt an image for display in a notification.
        haswell 4y ago
        It's possible that this is something that Apple rolled out since the last time I dug deeply into push notifications and my understanding of this part could be out of date.
      - senectus1 4y ago
        >The fact that they are indeed cloud-based is why this story has been blowing up and making quite a few people upset. No, its "Cloud Enhanced" if you choose it. If you dont turn on the thumbnail images, or pay for the cloud storage extra option then it just plain doesn't use the cloud. The streaming a camera issue is something else. Possibly something that can be fixed with a patch
  - paranoidrobot 4y ago
    > There is no other way. That's not true, or at least not always. Plex manages this just fine with my media content. Plex Media Server reaches out to my router and punches an inbound port to itself. When I'm then watching from outside my home network, the traffic is going direct to my home IP.
- silisili 4y ago
  As I understand it, the Homebase is responsible for the encryption and storage. That said, I realized I could watch live my doorbell via the app when away. I assumed this would be encrypted somehow, too, but I suppose their findings are that they're not. Bummer.
  - haswell 4y ago
    The supposed lack of encryption has not been confirmed. There's been quite a bit of FUD spreading since this story hit, and I'm convinced that the security researcher involved has some misconceptions about what it means for content to be encrypted. He seems to believe that because he can see the network requests in browser developer tools, communication is not encrypted. Up to this point, the most solid claim is the fact that thumbnails are transmitted to Eufy to facilitate push notifications. Eufy confirmed this, and pledged to improve the messaging on the options that enable the feature. The concerns related to the streaming of video is as-of-yet not confirmed, and would indicate a breathtaking lapse on Eufy's part if true. It's been disheartening to watch all of this unfold with too many folks taking pretty huge claims at face value. It could be true, but people are acting as if it absolutely it.
    - chaostheory 4y ago
      The streaming of video has been confirmed by multiple sources including the Verge and Linus Tech Tips
      - haswell 4y ago
        Sort of, but with caveats. From The Verge: > This week, we repeatedly watched live footage from two of our own Eufy cameras using that very same VLC media player, from across the United States — proving that Anker has a way to bypass encryption and access these supposedly secure cameras through the cloud. Missing is how they connected "VLC can play a stream" to "Anker has a way to bypass encryption". The ability to open a stream in VLC does not automatically imply it is encryption-free. > There is some good news: there’s no proof yet that this has been exploited in the wild, and the way we initially obtained the address required logging in with a username and password before Eufy’s website will cough up the encryption-free stream. (We’re not sharing the exact technique here.) Things continue to be fuzzy and it's not clear what they believe "encryption-free" means. Since everyone is being understandably cautious about releasing the actual details, all of this is still frustratingly incomplete information. On the LTT side, they went full rage mode in their coverage and it became difficult to take them seriously based on how they were discussing the thumbnail issue. We desperately need an end-to-end review and summary from a reputable security person.
- mzs 4y ago
  Reading "military-grade encryption" should trigger everyone's BS detector every time.
landr0id 4y ago
This looks more like negligence than malice. In order to send the push notification you have to send the content to a server that then gets pushed down through say Apple's Push Notification Service. The doorbell cannot talk directly to your device. The notification contains the image and whatever other text and metadata shown. I'd imagine that what they mean by "planning to encrypt" this content is to E2EE the content and register a notification extension (something like: https://developer.apple.com/documentation/usernotifications/unnotificationserviceextension/1648229-didreceivenotificationrequest?language=objc https://developer.apple.com/documentation/usernotifications/...) that transforms the content once received by the client. As most people probably know, E2EE isn't a simple problem to do in a user-friendly way. Perhaps when setting up the app/doorbell the doorbell could have some certificate that the app is aware of that's used for encrypting the data before it leaves the doorbell, and decrypted using the app's private key but this obviously isn't something provided out of the box. Obviously a warrant could be served to Apple/Google/Eufy for notification content, but I don't take this as being particularly nefarious. It genuinely wouldn't surprise me if other offline doorbells like Ubiquiti's UniFi line were also affected. *I should probably mention I wrote this comment after reading a different article/video but didn't catch that their marketing mentioned that everything is E2EE. So yeah, seems like a pretty glaring lie in that regard.
- iancarroll 4y ago
  It might be difficult, but it's possible to send encrypted push notifications as you mention, and you don't get to make the E2EE claims until you actually do it. I don't think UniFi or most other cameras claim anything like Eufy did.
  - landr0id 4y ago
    Fair point that their marketing explicitly says this stuff is end-to-end encrypted. Seems like an obvious gap in validation/coverage of their network comms.
- jasonhansel 4y ago
  The issue is that Anker said the footage was e2e encrypted. If they needed to be able to decrypt it to send notifications, they shouldn't have advertised it as providing end-to-end encryption.
kodah 4y ago
If you want a truly local camera system with all the fancy features, check out Home Assistant (homeassistant.io) and Frigate (https://github.com/blakeblackshear/frigate https://github.com/blakeblackshear/frigate).
- imiric 4y ago
  My biggest concern about setting up a camera system is not about the fancy features, but about the camera hardware itself and its firmware. Frigate recommends[1] only Chinese devices, which is a deal breaker for me. Yes, I could restrict them from accessing the internet, put them behind a VLAN or VPN etc., but it's a hassle. I would ideally like to trust the device that handles such sensitive data, and not have to fight it. Do you have a recommendation of a reputable camera manufacturer? Or failing that, a device that can be flashed with trusted open source firmware? At this point I'm ready to just use an old Android phone instead. It's ridiculous how seemingly nobody in this industry is capable of producing trustworthy products. [1]: https://docs.frigate.video/hardware https://docs.frigate.video/hardware
  - phpisthebest 4y ago
    Zero Trust is a better way, for me that means my IoT and Camera's are on a completely seperate vLAN and Wifi network with zero internet access. HA is the bridge between the 2 networks, HA is the only device on both networks. So even if the the Camera's want to phone home, they have zero path to do so
  - formerly_proven 4y ago
    IP CCTV systems which are set up correctly are always air-gapped, because the firmware of all of them - yes all of them, including the EU/US premium vendors - is insecure crap. Separate CCTV network/VLAN costs essentially nothing and is extremely effective. There's no open source firmware for any of this because you're in the image processing badlands, where everything is proprietary, triply patented and only available under quintiplicately signed NDA. For a lot of the image sensors you can't even freely get the "marketing copy" version of the datasheet, let alone a full datasheet. The closest thing would be a Raspberry Pi with the HQ camera, since the necessary blobs are made available through the RPi Foundation. In terms of image quality in low light that will be more than a full order of magnitude worse than a 230 $ 4K Dahua with an 1/1.2" IMX485 (e.g. IPC-Color4K-X/T / DH-IPC-HFW5849T1-ASE-LED). The 5442 Dahua models are even cheaper (though accordingly worse than the models with the larger sensors; these have the same pixels). Planning a good CCTV system that actually fulfills the requirements (you do want to have an idea what you want to achieve with it) is not as simple as buying a kit of four ultra-wide wifi cameras and slapping them on the outside of the house. All consumer CCTV cameras are useless crap in comparison to these; no known exceptions.
mfkp 4y ago
Debunked, this is just clickbait: https://youtu.be/a_rAXF_btvE https://youtu.be/a_rAXF_btvE
- ChrisMarshallNY 4y ago
  Thanks for the video. That is well-done. Not sure it's deliberate clickbait, though. That speaks to intent.
  - mfkp 4y ago
    True, I suppose it's just reporters capitalizing on outrage without actually doing much research. Not sure if that's much better though.
- francislavoie 4y ago
  LTT has already replied to this, and no, it's still very much a problem. https://youtu.be/Luz82RG5PqA?t=160 https://youtu.be/Luz82RG5PqA?t=160
  - Godel_unicode 4y ago
    Is this the video where Linus talks about how RCE is only something that happens in the movies? I wish he would realize that people actually think he knows what he’s talking about and be a bit more careful.
    - francislavoie 4y ago
      You misunderstood that then. He wasn't saying that at all. He was just saying that simply having a port open isn't an automatic RCE, because there needs to be something that listens on that port that has a vulnerability to exploit. A simple web API is not that likely to have a vulnerability if the dev of the API did their job correctly.
      - jeroenhd 4y ago
underwater 4y ago
This article seems confused about the claims it's making. The embedded Tweet shows that the thumbnails for push notifications are stored on AWS as a secret URL. Thats not great, but also expected for the convenience of having push notifications include media. The part about VLC seems to be a completely different issue. > This week, we repeatedly watched live footage from two of our own Eufy cameras using that very same VLC media player, from across the United States — proving that Anker has a way to bypass encryption and access these supposedly secure cameras through the cloud. The part about streaming from across the United States is irrelevant. Just because can be accessed over the internet doesn't mean it's using "the cloud." And of course Anker has the capability to access streams. They allow you to login to the app using a username and password and then start streaming from your devices. Them abusing that capability was always a risk.
- jjulius 4y ago
  >The part about streaming from across the United States is irrelevant. Just because can be accessed over the internet doesn't mean it's using "the cloud." You're forgetting about the part where the video was supposed to be E2E encrypted.
princevegeta89 4y ago
I recall that there was a trick to block Eufy from phoning home by connecting them to a Wifi network that connects to the internet only through a custom DNS server that blocks all the Eufy specific hosts. I am not sure about it but was wondering if anyone has done it successfully so far? I have Eufy cameras too but never trusted them for security, although they are pretty reliable for me from a service perspective.
vikramkr 4y ago
There seem to be a few comments talking about how it's just thumbnails stored or how any cloud based system has to send some media to the cloud - fundamentally I think we need to make sure we're not missing the bigger picture here. They said that they make sure to keep your data off of cloud servers. Exact copy: >Keep Privacy in Your Hands >HomeBase uses local storage kept off of cloud servers to ensure that only you are reviewing your data. From: https://web.archive.org/web/20221003175526/https://us.eufy.com/pages/security-eufycam3 https://web.archive.org/web/20221003175526/https://us.eufy.c... Even if it's just a thumbnail - their copy is crystal clear about the fact that your data does not end up on the cloud. They are then putting data on the cloud. They claim: >Safe and Private >Your videos and other data is stored privately in your own home behind 3-step military-grade AES-128 encryption. Only you have the key to access. Their marketing is very clear. They sold devices based on this claim, and violating it to any extend is unacceptable.
- tootie 4y ago
  Article says they can stream unencrypted video which certainly could be done via NAT traversal without sending data to the cloud. There's plenty of appliances that do that. It's also possible they thoroughly encrypt the data at rest but just don't use https because that's tricky to do without static IPs/hostnames. Not saying Eufy is off the hook but I'd like to see a little more technical of a breakdown.
  - vikramkr 4y ago
    They at the least upload thumbnails to the cloud, which would include photos of the areas being recorded and people's faces. If this is part if a notification system, that probably includes timestamps. That's enough to begin to build a profile of the user, patterns regarding visitors, etc.
- brookst 4y ago
  Agree, with the nuance that “unacceptable” is not binary. This is bad and wrong and contrary to their promises, and also not the most terrible thing ever.
- 4y ago
mandrizzle 4y ago
It’s a shame they don’t seem to want to support Apples HomeKit Secure Video platform on their new devices. At least with apple we can trust everything stays local. The Eufy cameras I do have that support home kit, I’ve blocked internet access to them from my router and can only access them through Apples Hone app. That said I do recommend blocking internet to all cameras and use a self hosted app like Scrypted or Homebridge to manage your cameras
- drdaeman 4y ago
  I think the part of the reason is that Apple HSV doesn’t support resolutions higher than 1080p.
  - sebazzz 4y ago
    They have been promising RTSP for a long time now and also failed to deliver.
- moistly 4y ago
  Heck, I went beyond blocking and just pulled the Ethernet. The only time I need to look at the DVR is when my house has been broken into. The root of the problem here is that there is this idea that “cloud storage“ or “network access” can be private.
tux2bsd 4y ago
eufy/anker are fucking useless. https://community.security.eufy.com/t/major-flaw-delete-homebase-data-via-camera/903359 https://community.security.eufy.com/t/major-flaw-delete-home... I spent ~1 month full-time savings on a camera kit, cameras + base station. I was to be able to return the product for a refund (NZ law), I luckily found that thread within 24 hours of buying that SHIT. p.s. don't confuse an existing good NZ law with our current inept government (i.e. we have a female Trudeau)
- steve_adams_86 4y ago
  That’s insane. My understanding is that if someone knows how to, they can destroy all of your locally stored footage by pressing and holding a button? This seems easy enough to remove from the firmware and migrate to software, protected by some kind of auth layer.
  - tux2bsd 4y ago
    A baddy gets the camera, holds the button for some time and that resets the camera (disassociates the camera from the base station). The recordings for that camera on the base station are now gone because they are encrypted and rely on the association the camera had. Eufy refused to fix the problem. It was something that could have been fixed with a firmware update via its app. It was a shame, the cameras were good but the product overall wasn't fit for purpose (due to their incompetence).
    - tux2bsd 4y ago
      p.s. I use the term encrypted loosely, the mechanism could be as basic as a unique file name... whatever it is the association to the existing footage is lost.

> there’s no proof yet that this has been exploited in the wild Give it a few days.

In-short: "Anker has built a remarkable reputation for quality over the past decade [...], including the Eufy home security cameras [...]. Eufy’s commitment to privacy is remarkable: it promises your data will be stored locally, [...], that its footage only gets transmitted with “end-to-end” military-grade encryption, and that it will only send that footage “straight to your phone.” So you can imagine our surprise to learn you can stream video from a Eufy camera, from the other side of the country, with no encryption at all." And a tweet showcasing how to get the unencrypted video/images from the security researcher who discovered the issue: https://twitter.com/paul_reviews/status/1595421705996042240 https://twitter.com/paul_reviews/status/1595421705996042240

aritmo 4y ago
The media transfers are encrypted. But he uses the Developer Tools of the browser, so he sees the content of the encrypted packets. It is obvious that any cloud-based security camera has to send the media to the cloud! There is no other way. The marketing people at Eufy made a long series of mistakes. It is a marketing problem.
- nathan_phoenix 4y ago
  Eufy markets their cameras as privacy focused, using local storage and local processing without using cloud storage so I'm not sure how you concluded against their marketing that it's cloud based. Also he opens the link in a new private session which doesn't have the auth cookies. Furthermore, he later explains that there is no auth happening. Lastly The Verge confirmed it by watching the camera stream using plain VLC.
- kodah 4y ago
  Eufy isn't cloud-based.
  - haswell 4y ago
    The fact that they are indeed cloud-based is why this story has been blowing up and making quite a few people upset. The reality is, even if the cameras are not configured to save video to Eufy's cloud service, thumbnails are still transmitted to Eufy for the purpose of facilitating push notifications (confirmed by Eufy), and the researcher who discovered this claims to have found a way to access camera feeds without authentication as well (this is not confirmed, and one of the most questionable claims). I own several of these cameras but have them configured as HomeKit devices, and while I'm not terribly concerned about the transmission of thumbnails since this is the name of the game if you want a preview in a push notification, I've always felt a little weird about the fact that these cameras require a Eufy account to configure, and you can access the live streams by logging into that account, even after the cameras have been configured as HomeKit cameras.
    - afavour 4y ago
      > this is the name of the game if you want a preview in a push notification I’m not sure that’s actually true. iOS has notification service extensions that I think could be used to decrypt an image for display in a notification.
      - haswell 4y ago
        It's possible that this is something that Apple rolled out since the last time I dug deeply into push notifications and my understanding of this part could be out of date.
    - senectus1 4y ago
      >The fact that they are indeed cloud-based is why this story has been blowing up and making quite a few people upset. No, its "Cloud Enhanced" if you choose it. If you dont turn on the thumbnail images, or pay for the cloud storage extra option then it just plain doesn't use the cloud. The streaming a camera issue is something else. Possibly something that can be fixed with a patch
- paranoidrobot 4y ago
  > There is no other way. That's not true, or at least not always. Plex manages this just fine with my media content. Plex Media Server reaches out to my router and punches an inbound port to itself. When I'm then watching from outside my home network, the traffic is going direct to my home IP.
silisili 4y ago
As I understand it, the Homebase is responsible for the encryption and storage. That said, I realized I could watch live my doorbell via the app when away. I assumed this would be encrypted somehow, too, but I suppose their findings are that they're not. Bummer.
- haswell 4y ago
  The supposed lack of encryption has not been confirmed. There's been quite a bit of FUD spreading since this story hit, and I'm convinced that the security researcher involved has some misconceptions about what it means for content to be encrypted. He seems to believe that because he can see the network requests in browser developer tools, communication is not encrypted. Up to this point, the most solid claim is the fact that thumbnails are transmitted to Eufy to facilitate push notifications. Eufy confirmed this, and pledged to improve the messaging on the options that enable the feature. The concerns related to the streaming of video is as-of-yet not confirmed, and would indicate a breathtaking lapse on Eufy's part if true. It's been disheartening to watch all of this unfold with too many folks taking pretty huge claims at face value. It could be true, but people are acting as if it absolutely it.
  - chaostheory 4y ago
    The streaming of video has been confirmed by multiple sources including the Verge and Linus Tech Tips
    - haswell 4y ago
      Sort of, but with caveats. From The Verge: > This week, we repeatedly watched live footage from two of our own Eufy cameras using that very same VLC media player, from across the United States — proving that Anker has a way to bypass encryption and access these supposedly secure cameras through the cloud. Missing is how they connected "VLC can play a stream" to "Anker has a way to bypass encryption". The ability to open a stream in VLC does not automatically imply it is encryption-free. > There is some good news: there’s no proof yet that this has been exploited in the wild, and the way we initially obtained the address required logging in with a username and password before Eufy’s website will cough up the encryption-free stream. (We’re not sharing the exact technique here.) Things continue to be fuzzy and it's not clear what they believe "encryption-free" means. Since everyone is being understandably cautious about releasing the actual details, all of this is still frustratingly incomplete information. On the LTT side, they went full rage mode in their coverage and it became difficult to take them seriously based on how they were discussing the thumbnail issue. We desperately need an end-to-end review and summary from a reputable security person.
mzs 4y ago
Reading "military-grade encryption" should trigger everyone's BS detector every time.

landr0id 4y ago

This looks more like negligence than malice. In order to send the push notification you have to send the content to a server that then gets pushed down through say Apple's Push Notification Service. The doorbell cannot talk directly to your device. The notification contains the image and whatever other text and metadata shown. I'd imagine that what they mean by "planning to encrypt" this content is to E2EE the content and register a notification extension (something like: https://developer.apple.com/documentation/usernotifications/unnotificationserviceextension/1648229-didreceivenotificationrequest?language=objc https://developer.apple.com/documentation/usernotifications/...) that transforms the content once received by the client. As most people probably know, E2EE isn't a simple problem to do in a user-friendly way. Perhaps when setting up the app/doorbell the doorbell could have some certificate that the app is aware of that's used for encrypting the data before it leaves the doorbell, and decrypted using the app's private key but this obviously isn't something provided out of the box. Obviously a warrant could be served to Apple/Google/Eufy for notification content, but I don't take this as being particularly nefarious. It genuinely wouldn't surprise me if other offline doorbells like Ubiquiti's UniFi line were also affected. *I should probably mention I wrote this comment after reading a different article/video but didn't catch that their marketing mentioned that everything is E2EE. So yeah, seems like a pretty glaring lie in that regard.

iancarroll 4y ago
It might be difficult, but it's possible to send encrypted push notifications as you mention, and you don't get to make the E2EE claims until you actually do it. I don't think UniFi or most other cameras claim anything like Eufy did.
- landr0id 4y ago
  Fair point that their marketing explicitly says this stuff is end-to-end encrypted. Seems like an obvious gap in validation/coverage of their network comms.
jasonhansel 4y ago
The issue is that Anker said the footage was e2e encrypted. If they needed to be able to decrypt it to send notifications, they shouldn't have advertised it as providing end-to-end encryption.

kodah 4y ago

If you want a truly local camera system with all the fancy features, check out Home Assistant (homeassistant.io) and Frigate (https://github.com/blakeblackshear/frigate https://github.com/blakeblackshear/frigate).

imiric 4y ago
My biggest concern about setting up a camera system is not about the fancy features, but about the camera hardware itself and its firmware. Frigate recommends[1] only Chinese devices, which is a deal breaker for me. Yes, I could restrict them from accessing the internet, put them behind a VLAN or VPN etc., but it's a hassle. I would ideally like to trust the device that handles such sensitive data, and not have to fight it. Do you have a recommendation of a reputable camera manufacturer? Or failing that, a device that can be flashed with trusted open source firmware? At this point I'm ready to just use an old Android phone instead. It's ridiculous how seemingly nobody in this industry is capable of producing trustworthy products. [1]: https://docs.frigate.video/hardware https://docs.frigate.video/hardware
- phpisthebest 4y ago
  Zero Trust is a better way, for me that means my IoT and Camera's are on a completely seperate vLAN and Wifi network with zero internet access. HA is the bridge between the 2 networks, HA is the only device on both networks. So even if the the Camera's want to phone home, they have zero path to do so
- formerly_proven 4y ago
  IP CCTV systems which are set up correctly are always air-gapped, because the firmware of all of them - yes all of them, including the EU/US premium vendors - is insecure crap. Separate CCTV network/VLAN costs essentially nothing and is extremely effective. There's no open source firmware for any of this because you're in the image processing badlands, where everything is proprietary, triply patented and only available under quintiplicately signed NDA. For a lot of the image sensors you can't even freely get the "marketing copy" version of the datasheet, let alone a full datasheet. The closest thing would be a Raspberry Pi with the HQ camera, since the necessary blobs are made available through the RPi Foundation. In terms of image quality in low light that will be more than a full order of magnitude worse than a 230 $ 4K Dahua with an 1/1.2" IMX485 (e.g. IPC-Color4K-X/T / DH-IPC-HFW5849T1-ASE-LED). The 5442 Dahua models are even cheaper (though accordingly worse than the models with the larger sensors; these have the same pixels). Planning a good CCTV system that actually fulfills the requirements (you do want to have an idea what you want to achieve with it) is not as simple as buying a kit of four ultra-wide wifi cameras and slapping them on the outside of the house. All consumer CCTV cameras are useless crap in comparison to these; no known exceptions.

mfkp 4y ago

Debunked, this is just clickbait: https://youtu.be/a_rAXF_btvE https://youtu.be/a_rAXF_btvE

ChrisMarshallNY 4y ago
Thanks for the video. That is well-done. Not sure it's deliberate clickbait, though. That speaks to intent.
- mfkp 4y ago
  True, I suppose it's just reporters capitalizing on outrage without actually doing much research. Not sure if that's much better though.
francislavoie 4y ago
LTT has already replied to this, and no, it's still very much a problem. https://youtu.be/Luz82RG5PqA?t=160 https://youtu.be/Luz82RG5PqA?t=160
- Godel_unicode 4y ago
  Is this the video where Linus talks about how RCE is only something that happens in the movies? I wish he would realize that people actually think he knows what he’s talking about and be a bit more careful.
  - francislavoie 4y ago
    You misunderstood that then. He wasn't saying that at all. He was just saying that simply having a port open isn't an automatic RCE, because there needs to be something that listens on that port that has a vulnerability to exploit. A simple web API is not that likely to have a vulnerability if the dev of the API did their job correctly.
    - jeroenhd 4y ago

underwater 4y ago

This article seems confused about the claims it's making. The embedded Tweet shows that the thumbnails for push notifications are stored on AWS as a secret URL. Thats not great, but also expected for the convenience of having push notifications include media. The part about VLC seems to be a completely different issue. > This week, we repeatedly watched live footage from two of our own Eufy cameras using that very same VLC media player, from across the United States — proving that Anker has a way to bypass encryption and access these supposedly secure cameras through the cloud. The part about streaming from across the United States is irrelevant. Just because can be accessed over the internet doesn't mean it's using "the cloud." And of course Anker has the capability to access streams. They allow you to login to the app using a username and password and then start streaming from your devices. Them abusing that capability was always a risk.

jjulius 4y ago
>The part about streaming from across the United States is irrelevant. Just because can be accessed over the internet doesn't mean it's using "the cloud." You're forgetting about the part where the video was supposed to be E2E encrypted.

princevegeta89 4y ago

I recall that there was a trick to block Eufy from phoning home by connecting them to a Wifi network that connects to the internet only through a custom DNS server that blocks all the Eufy specific hosts. I am not sure about it but was wondering if anyone has done it successfully so far? I have Eufy cameras too but never trusted them for security, although they are pretty reliable for me from a service perspective.

vikramkr 4y ago

There seem to be a few comments talking about how it's just thumbnails stored or how any cloud based system has to send some media to the cloud - fundamentally I think we need to make sure we're not missing the bigger picture here. They said that they make sure to keep your data off of cloud servers. Exact copy: >Keep Privacy in Your Hands >HomeBase uses local storage kept off of cloud servers to ensure that only you are reviewing your data. From: https://web.archive.org/web/20221003175526/https://us.eufy.com/pages/security-eufycam3 https://web.archive.org/web/20221003175526/https://us.eufy.c... Even if it's just a thumbnail - their copy is crystal clear about the fact that your data does not end up on the cloud. They are then putting data on the cloud. They claim: >Safe and Private >Your videos and other data is stored privately in your own home behind 3-step military-grade AES-128 encryption. Only you have the key to access. Their marketing is very clear. They sold devices based on this claim, and violating it to any extend is unacceptable.

tootie 4y ago
Article says they can stream unencrypted video which certainly could be done via NAT traversal without sending data to the cloud. There's plenty of appliances that do that. It's also possible they thoroughly encrypt the data at rest but just don't use https because that's tricky to do without static IPs/hostnames. Not saying Eufy is off the hook but I'd like to see a little more technical of a breakdown.
- vikramkr 4y ago
  They at the least upload thumbnails to the cloud, which would include photos of the areas being recorded and people's faces. If this is part if a notification system, that probably includes timestamps. That's enough to begin to build a profile of the user, patterns regarding visitors, etc.
brookst 4y ago
Agree, with the nuance that “unacceptable” is not binary. This is bad and wrong and contrary to their promises, and also not the most terrible thing ever.
4y ago

mandrizzle 4y ago

It’s a shame they don’t seem to want to support Apples HomeKit Secure Video platform on their new devices. At least with apple we can trust everything stays local. The Eufy cameras I do have that support home kit, I’ve blocked internet access to them from my router and can only access them through Apples Hone app. That said I do recommend blocking internet to all cameras and use a self hosted app like Scrypted or Homebridge to manage your cameras

drdaeman 4y ago
I think the part of the reason is that Apple HSV doesn’t support resolutions higher than 1080p.
- sebazzz 4y ago
  They have been promising RTSP for a long time now and also failed to deliver.
moistly 4y ago
Heck, I went beyond blocking and just pulled the Ethernet. The only time I need to look at the DVR is when my house has been broken into. The root of the problem here is that there is this idea that “cloud storage“ or “network access” can be private.

tux2bsd 4y ago

eufy/anker are fucking useless. https://community.security.eufy.com/t/major-flaw-delete-homebase-data-via-camera/903359 https://community.security.eufy.com/t/major-flaw-delete-home... I spent ~1 month full-time savings on a camera kit, cameras + base station. I was to be able to return the product for a refund (NZ law), I luckily found that thread within 24 hours of buying that SHIT. p.s. don't confuse an existing good NZ law with our current inept government (i.e. we have a female Trudeau)

steve_adams_86 4y ago
That’s insane. My understanding is that if someone knows how to, they can destroy all of your locally stored footage by pressing and holding a button? This seems easy enough to remove from the firmware and migrate to software, protected by some kind of auth layer.
- tux2bsd 4y ago
  A baddy gets the camera, holds the button for some time and that resets the camera (disassociates the camera from the base station). The recordings for that camera on the base station are now gone because they are encrypted and rely on the association the camera had. Eufy refused to fix the problem. It was something that could have been fixed with a firmware update via its app. It was a shame, the cameras were good but the product overall wasn't fit for purpose (due to their incompetence).
  - tux2bsd 4y ago
    p.s. I use the term encrypted loosely, the mechanism could be as basic as a unique file name... whatever it is the association to the existing footage is lost.