6 ms·

In-short: "Anker has built a remarkable reputation for quality over the past decade [...], including the Eufy home security cameras [...]. Eufy’s commitment to

In-short: "Anker has built a remarkable reputation for quality over the past decade [...], including the Eufy home security cameras [...]. Eufy’s commitment to privacy is remarkable: it promises your data will be stored locally, [...], that its footage only gets transmitted with “end-to-end” military-grade encryption, and that it will only send that footage “straight to your phone.” So you can imagine our surprise to learn you can stream video from a Eufy camera, from the other side of the country, with no encryption at all." And a tweet showcasing how to get the unencrypted video/images from the security researcher who discovered the issue: https://twitter.com/paul_reviews/status/1595421705996042240 https://twitter.com/paul_reviews/status/1595421705996042240

aritmo 4y ago
The media transfers are encrypted. But he uses the Developer Tools of the browser, so he sees the content of the encrypted packets. It is obvious that any cloud-based security camera has to send the media to the cloud! There is no other way. The marketing people at Eufy made a long series of mistakes. It is a marketing problem.
- nathan_phoenix 4y ago
  Eufy markets their cameras as privacy focused, using local storage and local processing without using cloud storage so I'm not sure how you concluded against their marketing that it's cloud based. Also he opens the link in a new private session which doesn't have the auth cookies. Furthermore, he later explains that there is no auth happening. Lastly The Verge confirmed it by watching the camera stream using plain VLC.
- kodah 4y ago
  Eufy isn't cloud-based.
  - haswell 4y ago
    The fact that they are indeed cloud-based is why this story has been blowing up and making quite a few people upset. The reality is, even if the cameras are not configured to save video to Eufy's cloud service, thumbnails are still transmitted to Eufy for the purpose of facilitating push notifications (confirmed by Eufy), and the researcher who discovered this claims to have found a way to access camera feeds without authentication as well (this is not confirmed, and one of the most questionable claims). I own several of these cameras but have them configured as HomeKit devices, and while I'm not terribly concerned about the transmission of thumbnails since this is the name of the game if you want a preview in a push notification, I've always felt a little weird about the fact that these cameras require a Eufy account to configure, and you can access the live streams by logging into that account, even after the cameras have been configured as HomeKit cameras.
    - afavour 4y ago
      > this is the name of the game if you want a preview in a push notification I’m not sure that’s actually true. iOS has notification service extensions that I think could be used to decrypt an image for display in a notification.
      - haswell 4y ago
        It's possible that this is something that Apple rolled out since the last time I dug deeply into push notifications and my understanding of this part could be out of date.
    - senectus1 4y ago
      >The fact that they are indeed cloud-based is why this story has been blowing up and making quite a few people upset. No, its "Cloud Enhanced" if you choose it. If you dont turn on the thumbnail images, or pay for the cloud storage extra option then it just plain doesn't use the cloud. The streaming a camera issue is something else. Possibly something that can be fixed with a patch
      - haswell 4y ago
- paranoidrobot 4y ago
  > There is no other way. That's not true, or at least not always. Plex manages this just fine with my media content. Plex Media Server reaches out to my router and punches an inbound port to itself. When I'm then watching from outside my home network, the traffic is going direct to my home IP.
silisili 4y ago
As I understand it, the Homebase is responsible for the encryption and storage. That said, I realized I could watch live my doorbell via the app when away. I assumed this would be encrypted somehow, too, but I suppose their findings are that they're not. Bummer.
- haswell 4y ago
  The supposed lack of encryption has not been confirmed. There's been quite a bit of FUD spreading since this story hit, and I'm convinced that the security researcher involved has some misconceptions about what it means for content to be encrypted. He seems to believe that because he can see the network requests in browser developer tools, communication is not encrypted. Up to this point, the most solid claim is the fact that thumbnails are transmitted to Eufy to facilitate push notifications. Eufy confirmed this, and pledged to improve the messaging on the options that enable the feature. The concerns related to the streaming of video is as-of-yet not confirmed, and would indicate a breathtaking lapse on Eufy's part if true. It's been disheartening to watch all of this unfold with too many folks taking pretty huge claims at face value. It could be true, but people are acting as if it absolutely it.
  - chaostheory 4y ago
    The streaming of video has been confirmed by multiple sources including the Verge and Linus Tech Tips
    - haswell 4y ago
      Sort of, but with caveats. From The Verge: > This week, we repeatedly watched live footage from two of our own Eufy cameras using that very same VLC media player, from across the United States — proving that Anker has a way to bypass encryption and access these supposedly secure cameras through the cloud. Missing is how they connected "VLC can play a stream" to "Anker has a way to bypass encryption". The ability to open a stream in VLC does not automatically imply it is encryption-free. > There is some good news: there’s no proof yet that this has been exploited in the wild, and the way we initially obtained the address required logging in with a username and password before Eufy’s website will cough up the encryption-free stream. (We’re not sharing the exact technique here.) Things continue to be fuzzy and it's not clear what they believe "encryption-free" means. Since everyone is being understandably cautious about releasing the actual details, all of this is still frustratingly incomplete information. On the LTT side, they went full rage mode in their coverage and it became difficult to take them seriously based on how they were discussing the thumbnail issue. We desperately need an end-to-end review and summary from a reputable security person.
mzs 4y ago
Reading "military-grade encryption" should trigger everyone's BS detector every time.

aritmo 4y ago

The media transfers are encrypted. But he uses the Developer Tools of the browser, so he sees the content of the encrypted packets. It is obvious that any cloud-based security camera has to send the media to the cloud! There is no other way. The marketing people at Eufy made a long series of mistakes. It is a marketing problem.

nathan_phoenix 4y ago
Eufy markets their cameras as privacy focused, using local storage and local processing without using cloud storage so I'm not sure how you concluded against their marketing that it's cloud based. Also he opens the link in a new private session which doesn't have the auth cookies. Furthermore, he later explains that there is no auth happening. Lastly The Verge confirmed it by watching the camera stream using plain VLC.
kodah 4y ago
Eufy isn't cloud-based.
- haswell 4y ago
  The fact that they are indeed cloud-based is why this story has been blowing up and making quite a few people upset. The reality is, even if the cameras are not configured to save video to Eufy's cloud service, thumbnails are still transmitted to Eufy for the purpose of facilitating push notifications (confirmed by Eufy), and the researcher who discovered this claims to have found a way to access camera feeds without authentication as well (this is not confirmed, and one of the most questionable claims). I own several of these cameras but have them configured as HomeKit devices, and while I'm not terribly concerned about the transmission of thumbnails since this is the name of the game if you want a preview in a push notification, I've always felt a little weird about the fact that these cameras require a Eufy account to configure, and you can access the live streams by logging into that account, even after the cameras have been configured as HomeKit cameras.
  - afavour 4y ago
    > this is the name of the game if you want a preview in a push notification I’m not sure that’s actually true. iOS has notification service extensions that I think could be used to decrypt an image for display in a notification.
    - haswell 4y ago
      It's possible that this is something that Apple rolled out since the last time I dug deeply into push notifications and my understanding of this part could be out of date.
  - senectus1 4y ago
    >The fact that they are indeed cloud-based is why this story has been blowing up and making quite a few people upset. No, its "Cloud Enhanced" if you choose it. If you dont turn on the thumbnail images, or pay for the cloud storage extra option then it just plain doesn't use the cloud. The streaming a camera issue is something else. Possibly something that can be fixed with a patch
    - haswell 4y ago
paranoidrobot 4y ago
> There is no other way. That's not true, or at least not always. Plex manages this just fine with my media content. Plex Media Server reaches out to my router and punches an inbound port to itself. When I'm then watching from outside my home network, the traffic is going direct to my home IP.

silisili 4y ago

As I understand it, the Homebase is responsible for the encryption and storage. That said, I realized I could watch live my doorbell via the app when away. I assumed this would be encrypted somehow, too, but I suppose their findings are that they're not. Bummer.

haswell 4y ago
The supposed lack of encryption has not been confirmed. There's been quite a bit of FUD spreading since this story hit, and I'm convinced that the security researcher involved has some misconceptions about what it means for content to be encrypted. He seems to believe that because he can see the network requests in browser developer tools, communication is not encrypted. Up to this point, the most solid claim is the fact that thumbnails are transmitted to Eufy to facilitate push notifications. Eufy confirmed this, and pledged to improve the messaging on the options that enable the feature. The concerns related to the streaming of video is as-of-yet not confirmed, and would indicate a breathtaking lapse on Eufy's part if true. It's been disheartening to watch all of this unfold with too many folks taking pretty huge claims at face value. It could be true, but people are acting as if it absolutely it.
- chaostheory 4y ago
  The streaming of video has been confirmed by multiple sources including the Verge and Linus Tech Tips
  - haswell 4y ago
    Sort of, but with caveats. From The Verge: > This week, we repeatedly watched live footage from two of our own Eufy cameras using that very same VLC media player, from across the United States — proving that Anker has a way to bypass encryption and access these supposedly secure cameras through the cloud. Missing is how they connected "VLC can play a stream" to "Anker has a way to bypass encryption". The ability to open a stream in VLC does not automatically imply it is encryption-free. > There is some good news: there’s no proof yet that this has been exploited in the wild, and the way we initially obtained the address required logging in with a username and password before Eufy’s website will cough up the encryption-free stream. (We’re not sharing the exact technique here.) Things continue to be fuzzy and it's not clear what they believe "encryption-free" means. Since everyone is being understandably cautious about releasing the actual details, all of this is still frustratingly incomplete information. On the LTT side, they went full rage mode in their coverage and it became difficult to take them seriously based on how they were discussing the thumbnail issue. We desperately need an end-to-end review and summary from a reputable security person.

mzs 4y ago

Reading "military-grade encryption" should trigger everyone's BS detector every time.