4 ms·

Debunked, this is just clickbait: https://youtu.be/a_rAXF_btvE https://youtu.be/a_rAXF_btvE

by mfkp 4y ago

ChrisMarshallNY 4y ago
Thanks for the video. That is well-done. Not sure it's deliberate clickbait, though. That speaks to intent.
- mfkp 4y ago
  True, I suppose it's just reporters capitalizing on outrage without actually doing much research. Not sure if that's much better though.
francislavoie 4y ago
LTT has already replied to this, and no, it's still very much a problem. https://youtu.be/Luz82RG5PqA?t=160 https://youtu.be/Luz82RG5PqA?t=160
- Godel_unicode 4y ago
  Is this the video where Linus talks about how RCE is only something that happens in the movies? I wish he would realize that people actually think he knows what he’s talking about and be a bit more careful.
  - francislavoie 4y ago
    You misunderstood that then. He wasn't saying that at all. He was just saying that simply having a port open isn't an automatic RCE, because there needs to be something that listens on that port that has a vulnerability to exploit. A simple web API is not that likely to have a vulnerability if the dev of the API did their job correctly.
    - jeroenhd 4y ago
      > if the dev of the API did their job correctly You're not wrong, but we can see the current setup the devs came up with and I don't think they have either the time or skill to build a secure local server app. The sad fact of the matter is that most IoT devices with publicly accessible web servers are feeding grounds for botnets within a few years after release.
    - Godel_unicode 4y ago
      Sounds like you have the same misunderstanding that Linus has. Shellshock would like a word with you. Imagemagick is in line behind it, and after that are the majority of IoT devices (including several camera manufacturers).
    - moistly 4y ago
      Given the hourly updates from CVE, I am exceedingly sceptical that an online device, let alone a cloud system, can be invulnerable. https://twitter.com/CVEnew/ https://twitter.com/CVEnew/
    - wackadack 4y ago
      Did you know Microsoft Defender had a wormable RCE not long ago? It executed things it thought looked like javascript. Oh and by the way, it runs with the highest privilidges in Windows :)
- alphabettsy 4y ago
  Linus was out of his depth with this discussion. When it was brought up on the WAN show it was clear to me he didn’t understand enough to offer an educated opinion.
icehawk 4y ago
I mean it's not that debunked, I was able to confirm that the homebase will send unencrypted video to mediaserver-usa3.eufylife.com (hosted in ec2 at the time of writing) when I request a video stream while logged into mysecurity.eufylife.com in about half an hour most of which was deciding the best place to packet capture. Its very much sending video data to the cloud upon request.
jeroenhd 4y ago
This video is full of questionable stuff. Images within notifications don't need to be hosted on an internet-facing service without authentication, for example, they can use authentication just fine. They don't even need the cloud for anything but basic signalling (thanks, Apple and Google, for forcing your proprietary notification servers on every app). Authenticated peer to peer protocols (and failing that, end-to-end encrypted protocols) are everywhere and most of us use them every day. The reliance on cloud stuff isn't because it's impossible to live up to the claims on their website, it's because doing what they claim to be doing is hard and piping everything through Amazon is easy. The video also seems to confirm that content is in fact mirrored on the internet, which Eufy promised not to do. It also claims that Eufy chose to not do local-only processing for facial recognition for performance reasons, which is entirely valid were it not for the local-only promises. The GDPR regulations do not necessarily apply to user content in the context of account deletion; content, which by the promises of the seller's website, should've never left the device in the first place. The 30 day limitation of deletion requests is not related to deleting files, it's merely the maximum response time for the company upon receiving a correction or deletion request. If the GDPR were involved at all, Amazon should be listed as a data processor in the privacy policy, which it isn't, so that would be illegal. Even still, "we legally have the right to keep your data even longer" is a dickish excuse for not quickly throwing out the access keys/encryption keys/data for deleted accounts/files. The video completely glosses over the complete breach of trust Eufy committed by saying "some parts of the initial reporting are exaggerated". Eufy did in fact lie about the security of its product and they lied about how it works. This is a huge blemish on the good name of Anker.

Debunked, this is just clickbait: https://youtu.be/a_rAXF_btvE https://youtu.be/a_rAXF_btvE

by mfkp 4y ago

Debunked, this is just clickbait: https://youtu.be/a_rAXF_btvE https://youtu.be/a_rAXF_btvE

ChrisMarshallNY 4y ago

Thanks for the video. That is well-done. Not sure it's deliberate clickbait, though. That speaks to intent.

mfkp 4y ago
True, I suppose it's just reporters capitalizing on outrage without actually doing much research. Not sure if that's much better though.

francislavoie 4y ago

LTT has already replied to this, and no, it's still very much a problem. https://youtu.be/Luz82RG5PqA?t=160 https://youtu.be/Luz82RG5PqA?t=160

Godel_unicode 4y ago
Is this the video where Linus talks about how RCE is only something that happens in the movies? I wish he would realize that people actually think he knows what he’s talking about and be a bit more careful.
- francislavoie 4y ago
  You misunderstood that then. He wasn't saying that at all. He was just saying that simply having a port open isn't an automatic RCE, because there needs to be something that listens on that port that has a vulnerability to exploit. A simple web API is not that likely to have a vulnerability if the dev of the API did their job correctly.
  - jeroenhd 4y ago
    > if the dev of the API did their job correctly You're not wrong, but we can see the current setup the devs came up with and I don't think they have either the time or skill to build a secure local server app. The sad fact of the matter is that most IoT devices with publicly accessible web servers are feeding grounds for botnets within a few years after release.
  - Godel_unicode 4y ago
    Sounds like you have the same misunderstanding that Linus has. Shellshock would like a word with you. Imagemagick is in line behind it, and after that are the majority of IoT devices (including several camera manufacturers).
  - moistly 4y ago
    Given the hourly updates from CVE, I am exceedingly sceptical that an online device, let alone a cloud system, can be invulnerable. https://twitter.com/CVEnew/ https://twitter.com/CVEnew/
  - wackadack 4y ago
    Did you know Microsoft Defender had a wormable RCE not long ago? It executed things it thought looked like javascript. Oh and by the way, it runs with the highest privilidges in Windows :)
alphabettsy 4y ago
Linus was out of his depth with this discussion. When it was brought up on the WAN show it was clear to me he didn’t understand enough to offer an educated opinion.

icehawk 4y ago

I mean it's not that debunked, I was able to confirm that the homebase will send unencrypted video to mediaserver-usa3.eufylife.com (hosted in ec2 at the time of writing) when I request a video stream while logged into mysecurity.eufylife.com in about half an hour most of which was deciding the best place to packet capture. Its very much sending video data to the cloud upon request.

jeroenhd 4y ago

This video is full of questionable stuff. Images within notifications don't need to be hosted on an internet-facing service without authentication, for example, they can use authentication just fine. They don't even need the cloud for anything but basic signalling (thanks, Apple and Google, for forcing your proprietary notification servers on every app). Authenticated peer to peer protocols (and failing that, end-to-end encrypted protocols) are everywhere and most of us use them every day. The reliance on cloud stuff isn't because it's impossible to live up to the claims on their website, it's because doing what they claim to be doing is hard and piping everything through Amazon is easy. The video also seems to confirm that content is in fact mirrored on the internet, which Eufy promised not to do. It also claims that Eufy chose to not do local-only processing for facial recognition for performance reasons, which is entirely valid were it not for the local-only promises. The GDPR regulations do not necessarily apply to user content in the context of account deletion; content, which by the promises of the seller's website, should've never left the device in the first place. The 30 day limitation of deletion requests is not related to deleting files, it's merely the maximum response time for the company upon receiving a correction or deletion request. If the GDPR were involved at all, Amazon should be listed as a data processor in the privacy policy, which it isn't, so that would be illegal. Even still, "we legally have the right to keep your data even longer" is a dickish excuse for not quickly throwing out the access keys/encryption keys/data for deleted accounts/files. The video completely glosses over the complete breach of trust Eufy committed by saying "some parts of the initial reporting are exaggerated". Eufy did in fact lie about the security of its product and they lied about how it works. This is a huge blemish on the good name of Anker.