Security researcher says Eufy has a big security problem - Android Central

What you request to know

• Security researcher Paul Moore has discovered respective information flaws successful Eufy's cameras.
• User images and facial designation information are being sent to the unreality without idiosyncratic consent, and unrecorded camera feeds tin purportedly beryllium accessed without immoderate authentication.
• Moore says immoderate of the issues person since been patched but cannot verify that unreality information is being decently deleted. Moore, a U.K. resident, has taken ineligible enactment against Eufy due to the fact that of a imaginable breach of GDPR.
• Eufy enactment has confirmed immoderate of the issues and issued an authoritative connection connected the substance saying an app update volition connection clarified language.

Update Nov 29 11:32 am: Added Paul Moore's effect to Android Central.

Update Nov 29 3:30 pm: Eufy issued a connection explaining what's going connected which tin beryllium seen beneath successful Eufy's mentation section.

Based connected Eufy's connection below, galore of the issues Mr. Moore encountered volition not look truthful agelong arsenic users don't alteration thumbnails for camera notifications. It's these thumbnails that are being sent to the unreality for propulsion notification purposes. No existent video footage is being sent to Eufy's AWS cloud.

For years, Eufy Security has prided itself connected its mantra of protecting idiosyncratic privacy, chiefly by lone storing videos and different applicable information locally. But a information researcher is calling this into question, citing grounds that shows immoderate Eufy cameras are uploading photos, facial designation imagery, and different backstage information to its unreality servers without idiosyncratic consent.

A series of Tweets (opens successful caller tab) from accusation information advisor Paul Moore seems to amusement a Eufy Doorbell Dual camera uploading facial designation information to Eufy's AWS unreality without encryption. Moore shows that this information is being stored alongside a circumstantial username and different identifiable information. Adding to that, Moore says that this information is kept connected Eufy's Amazon-based servers adjacent erstwhile the footage has been "deleted" from the Eufy app.

Furthermore, Moore alleges that videos from cameras tin beryllium streamed via a web browser by inputting the close URL and that nary authentication accusation needs to beryllium contiguous to presumption said videos. Moore shows grounds that videos from Eufy cameras that are encrypted with AES 128 encryption are lone done truthful with a elemental cardinal alternatively than a due random string. In the example, Moore's videos were stored with "ZXSecurity17Cam@" arsenic the encryption key, thing that would beryllium easy cracked by anyone truly wanting your footage.

Moore has been successful interaction with Eufy enactment and they corroborate the evidence, citing that these uploads hap to assistance with notifications and different data. Support doesn't look to person provided a valid crushed wherefore identifiable idiosyncratic information is besides attached to the thumbnails, which could unfastened up a immense information spread for others to find your information with the close tools.

Moore says that Eufy has already patched immoderate of the issues, making it intolerable to verify stored unreality information status, and has issued the pursuing statement:

"Unfortunately (or fortunately, nevertheless you look astatine it), Eufy has already removed the web telephone and heavy encrypted others to marque it astir intolerable to detect; truthful my erstwhile PoCs nary longer work.  You whitethorn beryllium capable to telephone the circumstantial endpoint manually utilizing the payloads shown, which whitethorn inactive instrumentality a result."

Android Central is successful treatment with some Eufy and Paul Moore and volition proceed to update this nonfiction arsenic the concern develops. Read beneath to spot Eufy's authoritative connection and mentation and further connected if you privation to larn much astir what Moore did successful his probe connected Eufy's imaginable information issues.

Eufy's explanation

Eufy told Android Central that its "products, services and processes are successful afloat compliance with General Data Protection Regulation (GDPR) standards, including ISO 27701/27001 and ETSI 303645 certifications."

GDPR certification requires companies to supply impervious of information information and absorption to the EU. Acquiring a certification isn't a rubber stamp and needs support by a due governing assemblage and is regulated by the ICO.

By default, camera notifications are acceptable to text-only and bash not make oregon upload a thumbnail of immoderate kind. In Mr. Moore's case, helium enabled the enactment to show thumbnails on with the notification. Here's what it looks similar successful the app.

Eufy says that these thumbnails are temporarily uploaded to its AWS servers and past bundled into the notification to a user's device. This logic checks retired since notifications are handled server broadside and, normally, a text-only notification from Eufy's servers would not see immoderate benignant of representation information unless different specified.

Eufy says that its propulsion notification practices are "in compliance with Apple Push Notification work and Firebase Cloud Messaging standards" and auto-delete but did not specify a timeframe successful which this should occur.

Moreover, Eufy says that "thumbnails utilize server-side encryption" and should not beryllium disposable to users who are not logged in. Mr. Moore's impervious of conception beneath utilized the aforesaid incognito web browser league to retrieve thumbnails, thereby utilizing the aforesaid web cache helium antecedently authenticated with.

Eufy says that "although our eufy Security app allows users to take betwixt text-based oregon thumbnail-based propulsion notifications, it was not made wide that choosing thumbnail-based notifications would necessitate preview images to beryllium concisely hosted successful the cloud. That deficiency of connection was an oversight connected our portion and we sincerely apologize for our error."

Eufy says it's making the pursuing changes to amended connection connected this matter:

1. We are revising the propulsion notifications enactment connection successful the eufy Security app to intelligibly item that propulsion notifications with thumbnails necessitate preview images that volition beryllium temporarily stored successful the cloud.
2. We volition beryllium much wide astir the usage of unreality for propulsion notifications successful our consumer-facing selling materials.

I person sent Eufy respective follow-up questions asking astir further issues recovered successful Paul Moore's impervious of conception beneath and volition update the nonfiction erstwhile those are answered.

Paul Moore's impervious of concept

Eufy sells 2 main types of cameras: cameras that link straight to your home's Wi-Fi network, and cameras that lone link to a Eufy HomeBase via a section wireless connection.

Eufy HomeBase's are designed to store Eufy camera footage locally via a hard thrust wrong the unit. But, adjacent if you person a HomeBase successful your home, purchasing a SoloCam oregon Doorbell that connects straight to Wi-Fi volition store your video information connected the Eufy camera itself alternatively of the HomeBase.

In Paul Moore's case, helium was utilizing a Eufy Doorbell Dual which connects straight to Wi-Fi and bypasses a HomeBase. Here's his archetypal video connected the issue, published connected November 23, 2022.

In the video, Moore shows however Eufy is uploading some the representation captured from the camera and the facial designation image. Further, helium shows that the facial designation representation is stored alongside respective bits of metadata, 2 of which see his username (owner_ID), different idiosyncratic ID, and the saved and stored ID for his look (AI_Face_ID).

What makes matters worse is that Moore uses different camera to trigger a question event, past examines the information transferred to Eufy's servers successful the AWS cloud. Moore says that helium utilized a antithetic camera, antithetic username, and adjacent a antithetic HomeBase to "store" the footage locally, yet Eufy was capable to tag and nexus the facial ID to his picture.

That proves that Eufy is storing this facial designation information successful its unreality and, connected apical of that, is allowing cameras to readily place stored faces adjacent though they aren't owned by the radical successful those images. To backmost that assertion up, Moore recorded different video of him deleting the clips and proving that the images are inactive located connected Eufy's AWS servers.

Additionally, Moore says that helium was capable to watercourse unrecorded footage from his doorbell camera without immoderate authentication but did not supply nationalist impervious of conception owed to the imaginable misuse of the maneuver if it were to beryllium made public. He has notified Eufy straight and has since taken ineligible measures to guarantee Eufy complies.

At the moment, this looks precise atrocious for Eufy. The institution has, for years, stood down lone keeping idiosyncratic information section and ne'er uploading to the cloud. While Eufy also has unreality services, nary information should beryllium uploaded to the unreality unless a idiosyncratic specifically allows specified a practice.

Furthermore, storing idiosyncratic IDs and different personally identifiable information alongside a representation of a person's look is simply a monolithic information violation, indeed. While Eufy has since patched the quality to easy find the URLs and different information being sent to the cloud, there's presently nary mode to verify that Eufy is oregon is not continuing to store this information successful the unreality without idiosyncratic consent.