Eufy Doesn’t Patch Potential Security Issue Affecting Its Video Doorbells, Instead Adds Disclaimer

Anker’s Eufy model of safety cameras has come beneath hearth just lately. It appears a number of of its safety digital camera merchandise are sending consumer photographs and data to the cloud with out their consent. The firm has since added a press release to its App Store itemizing and throughout the Eufy Security app. Rather than Eufy fixing the safety difficulty and stopping the uploads, it determined as an alternative to reveal when the cloud service will likely be used.

Eufy Will Continue Allowing Its ‘Local-Only’ Doorbells to Send Data to Cloud, But Now Admits the Upload

In late November, a security researcher discovered that Eufy safety cameras have been sending consumer photographs and data to the cloud with out the homeowners’ consent, even when they didn’t pay for a cloud subscription. In response, Eufy has added a statement to its App Store itemizing and throughout the Eufy Security app that discloses when the cloud service will likely be used when customers select sure notification choices.

The Eufy Security app affords a number of totally different choices for notifications. For occasion, customers can select to have notifications show solely textual content. Or, they’ll elect to show textual content and a thumbnail picture of the digital camera. If the consumer selects the thumbnail possibility, Eufy uploads the picture to the cloud.

An Understandable Concession, But One That Should Have Already Been Done

As I’ve stated previously, the difficulty isn’t that Eufy was importing photographs to the cloud. I by no means actually believed the corporate was doing something adverse with the info, like promoting it The downside was Eufy hadn’t been informing customers that it was doing so.

For those that personal an Eufy safety digital camera and don’t need their knowledge uploaded to the cloud, you possibly can forestall the cloud uploads by altering your notification sort throughout the Eufy Security app to “Most Efficient” as an alternative of “Full Effect” or “Include Thumbnail.”

Eufy Fails to Fix Security Issue, Latest Patch Only Addresses Half of the Problem

The firm nonetheless wants to handle the difficulty that will permit Eufy digital camera streams to be watched stay utilizing an app like VLC. The streams usually are not encrypted and could be accessed with out authentication. This isn’t Eufy’s first safety transgression both. In May 2021, Eufy digital camera homeowners found that cameras owned by different customers have been viewable of their app. This, clearly, was completely surprising. Even worse, these granted bogus entry may change settings on different folks’s cameras.

In a nutshell, this reinforces the significance of knowledge utilization transparency. Companies must be forthright and inform their clients how their knowledge will likely be use. Eufy’s lack of transparency and potential safety points are trigger for concern for customers of its safety cameras.