Eufy’s “No clouds” cameras upload facial thumbnails to AWS - Ars Technica

Enlarge / Anker's cameras store their footage connected a section base. Thumbnail images of faces, however, were uploaded to unreality servers.

Eufy

Eufy, a astute location marque of tech accessory steadfast Anker, had go fashionable among immoderate privacy-minded information camera buyers. Its doorbell camera and different devices proudly proclaimed having "No Clouds oregon Costs," and that "no 1 has entree to your information but you."

That's wherefore information advisor and researcher Paul Moore's drawstring of tweets and videos, demonstrating that Eufy cameras were uploading name-tagged thumbnail images to unreality servers to alert owners' phones, apt unencrypted, stung astute location and information enthusiasts truthful hard this week.

Moore, based successful the UK, started asking Eufy rhetorical questions astir its practices connected Twitter starting November 21. "Why is my 'local storage" #doorbellDual storing each face, without encryption, to your servers? Why tin I watercourse my camera without #authentication?!" Moore besides posted lines from "source codification & API responses" that suggested a precise anemic AES cardinal was being utilized to encrypt video footage.

On November 23, Moore uploaded a video that demonstrated his findings. With his Eufy Homebase unplugged, Moore walked successful beforehand of his camera. From an incognito web browser, Moore could propulsion up a thumbnail representation of himself, an representation of the provender soon earlier helium was visible, and—perhaps much concerning—ID numbers indicating his recognized look and his presumption arsenic the camera owner.

Security researcher Paul Moore's video detailing Eufy's quiescent uploads of thumbnails and names (from facial recognition) to a unreality server.

One time later, information steadfast SEC Consult summarized 2 years of analyzing a EufyCam 2, noting a akin transportation of thumbnails done an Amazon Web Services cloud. The institution besides saw the anemic keys, suggesting "hard-coded encryption/decryption keys which are identical for each sold Homebase devices," though it was unclear for what the keys were being used.

SEC Consult noted that Eufy seemed to person hardened its information since May 2021, erstwhile users were abruptly given astir afloat entree to different people's accounts. "But sadly, thumbnails of each recorded images inactive look to beryllium transferred into AWS, truthful the instrumentality does not acceptable our requirements for privacy." SEC said it moved up its work of its findings based connected Moore's tweets, and "with [Black Friday] buying mania conscionable astir the corner."

Moore aboriginal posted a effect from Eufy to his findings, successful which a Eufy enactment typical states that thumbnails are restricted by relationship logins, and the URL "will expire wrong 24 hours" unless the idiosyncratic shares it. The Eufy rep besides notes that Eufy "noticed it before" and plans to marque its Homebase 3 store thumbnails locally, too.

Moore besides claimed successful a aboriginal tweet, tagged to different user's screenshot, that you could remotely commencement and show Eufy camera streams done VLC without authentication oregon encryption. Moore stated that helium could not merchandise a impervious of conception for the vulnerability. He besides tweeted that Eufy denied his pre-action ineligible assertion against the company, "refusing compensation," but also, Moore claimed, offered him a job.

Finally, connected Monday, Moore tweeted helium had "a lengthy treatment with [Eufy's] ineligible department" and would subsequently "give them clip to analyse and instrumentality due action" and declined to remark further. We've emailed Moore for comment, but had not heard backmost arsenic of this station (as suggested successful his tweet).

Eufy, meanwhile, responded to Ars and different outlets with a statement. Eufy affirms that its video footage and "facial designation technology" are "all processed and stored locally connected the users' device." For mobile propulsion notifications, however, thumbnail images are "briefly and securely stored connected an AWS-based unreality server." They are server-side encrypted, down usernames and passwords, automatically delete, and comply with Apple and Google's messaging standards, arsenic good arsenic General Data Protection Regulation (GDPR) standards.

Eufy admits that erstwhile users take betwixt text-based oregon thumbnail-based notifications from their strategy during setup, "it was not made wide that choosing thumbnail-based notifications would necessitate preview images to beryllium concisely hosted successful the cloud."

Eufy pledged to update its setup connection and "be much wide astir the usage of unreality for propulsion notifications successful our consumer-facing selling materials." Other claims made by Moore and SEC Consult were not addressed.