Comments

You must log in or register to comment.

cyber1kenobi t1_iyb1oh3 wrote

“Footage” aka video…? Or thumbnails? Not ok without consent either way but there’s a major difference

23

CimmerianX t1_iyb3k3q wrote

Not ok either way... To bad people don't know how to setup network border firewalls in their home.... Outbound traffic should be monitored as much as Inbound traffic.

15

CBus-Eagle t1_iyba0qo wrote

I have 6 Eufy cameras set up around my home. How do I get in on the impending class action lawsuit. Just kidding about the lawsuit, but I am disheartened to read this. I specifically chose Eufy because I didn’t want my videos stored on a cloud. I wanted complete control over where they are stored.

68

Bipolarbearingit t1_iybgohf wrote

Omg, something not related to Elon Musk. Holy cow!

−20

zholo t1_iybjaf1 wrote

Don’t know why people are surprised all these super cheap Chinese camera companies are doing shady stuff. There is a reason these cameras are dirt cheap. The consumer is indirectly the product.

−3

AMatofFact t1_iybn1gt wrote

Yeah, I suspected this. In the app where you see the list of your cameras and their thumbnails, every disconnected camera shows the last thing it 'saw'. I think it's the first frame of the last recording. So with the camera off, it's gotta be stored somewhere.

6

BlackGold09 t1_iybpc6z wrote

Updated Story with Eufy response:

https://www.macrumors.com/2022/11/29/eufy-camera-cloud-uploads-no-user-consent/

“Eufy Security is designed as a local home security system. All video footage is stored locally and encrypted on the user's device. With regard to eufy Security’s facial recognition technology, this is all processed and stored locally on the user's device.

Our products, services and processes are in full compliance with General Data Protection Regulation (GDPR) standards, including ISO 27701/27001 and ETSI 303645 certifications.

To provide users with push notifications to their mobile devices, some of our security solutions create small preview images (thumbnails) of videos that are briefly and securely hosted on an AWS-based cloud server. These thumbnails utilize server-side encryption and are set to automatically delete and are in compliance with Apple Push Notification service and Firebase Cloud Messaging standards. Users can only access or share these thumbnails after securely logging into their eufy Security account.

Although our eufy Security app allows users to choose between text-based or thumbnail-based push notifications, it was not made clear that choosing thumbnail-based notifications would require preview images to be briefly hosted in the cloud.

That lack of communication was an oversight on our part and we sincerely apologize for our error. This is how we plan to improve our communication in this matter:

  1. We are revising the push notifications option language in the eufy Security app to clearly detail that push notifications with thumbnails require preview images that will be temporarily stored in the cloud.

  2. We will be more clear about the use of cloud for push notifications in our consumer-facing marketing materials.

eufy Security is committed to the privacy and protection of our users' data and appreciates the security research community reaching out to us to bring this to our attention.”

46

ApprehensiveNews5728 t1_iybsxr8 wrote

Almost bought a ring until I leaned there was a subscription fee and non-local storage. What other options are there?

3

TheFriendliestMan t1_iyc9i7i wrote

Replying to zholo (#792,248)

It's not really shady stuff, it's just pure ignorance of cyber security. Afaik they don't use the data, they are just incomprehensibly unsafe with how they implemented the feature.

8

Puzzleheaded-Cod4909 t1_iyccfgt wrote

If your product connects in any shape way or form to a cloud, your data is not private and belongs to the government. People need to learn that cloud comes with a cost.

2

[deleted] t1_iyczgrl wrote

It's a Chinese company, surprised?

3

wedontlikespaces t1_iyd5lxp wrote

Replying to ZeroVDirect (#797,745)

Depends on how it's implemented, it may use different ports for different things.

If so, you could just close any port that it uses for streaming data. If the data is streamed via UDP it probably does use a different port than it does for updates, but you would have to look into it find out exactly what it uses.

3

medievalmachine t1_iydiv6y wrote

Replying to CimmerianX (#810,432)

You do have to opt in, otherwise how would they push it?

​

I'm not saying I know everything about this situation - I don't care to spend time to research a product I don't own.

But if you're getting email/text notifications it's not secret.

3

GetOutOfTheWhey t1_iyeri7i wrote

Replying to CimmerianX (#810,432)

In the article, the customer opted in for that function thats how he discovered the vulnerability.

The flaw of the function is that it needed the file to first be uploaded to their server and that the upload was unencrypted.

>Moore had enabled the option manually, which is how the security flaw was eventually discovered. By default, the Eufy app’s camera notifications are text-only and don’t have the same issue, since there’s nothing to upload.

1