A security researcher has claimed Eufy security cameras are uploading photos containing personally identifiable data to its servers, breaching not only its own key selling proposition but also the EU’s General Data Protection Regulation (GDPR).
According to a report by Android Central (opens in new tab), security researcher Paul Moore discovered that the Eufy Doorbell Dual camera uploads facial recognition data to the company’s AWS cloud, without encryption.
The company, on the other hand, says it’s fully compliant with the data protection regulation and that the data collected is only used for notifications.
Compliant with GDPR?
In a series of tweets (opens in new tab), Moore claimed the data was being stored together with usernames and other information that could be used to identify people whose images were taken. What’s more, Eury keeps the data even when the user deletes it from the Eufy app, he claims.
Moore has also said video feed can be accessed via a web browser, simply by knowing the right URL, with no passwords required. Camera videos encrypted with AES 128 are using a simple key which can be broken relatively easily, he said.
Since breaking the news, the company claims to have patched “some of the issues”, but are being no more transparent than that, so verifying whether the issue is ongoing is impossible.
“Unfortunately (or fortunately, however you look at it), Eufy has already removed the network call and heavily encrypted others to make it almost impossible to detect; so my previous PoCs [proof of concept exploits] no longer work. You may be able to call the specific endpoint manually using the payloads shown, which may still return a result,” Moore later added.
Eufy, on the other hand, told the publication that its products are “in full compliance with General Data Protection Regulation (GDPR) standards, including ISO 27701/27001 and ETSI 303645 certifications.” The problem seems to be when a user decides they want thumbnails with their notifications.
Notifications from the camera are text-only by default, meaning no thumbnails get uploaded unless, as was the case with Moore, users enable the feature manually.
Eufy also said the thumbnails are “temporarily” uploaded to its servers, before being sent as a notification. Furthermore, the company said its push notification practices are “in compliance with Apple Push Notification service and Firebase Cloud Messaging standards” and auto-delete. It didn’t say when.
Thumbnails also utilize server-side encryption, the company added, saying they shouldn’t be visible to unauthorized users.
“Although our Eufy Security app allows users to choose between text-based or thumbnail-based push notifications, it was not made clear that choosing thumbnail-based notifications would require preview images to be briefly hosted in the cloud. That lack of communication was an oversight on our part and we sincerely apologize for our error,” the company concluded.
Going forward, Eufy claims that it will change its push notification option language, as well as the use of cloud for push notifications.
