{"id":21701,"date":"2022-12-07T17:27:12","date_gmt":"2022-12-07T17:27:12","guid":{"rendered":"https:\/\/mailinvest.blog\/index.php\/2022\/12\/07\/anker-tries-to-bullshit-the-verge-about-security-problems-in-its-eufy-smart-camera\/"},"modified":"2022-12-07T17:27:12","modified_gmt":"2022-12-07T17:27:12","slug":"anker-tries-to-bullshit-the-verge-about-security-problems-in-its-eufy-smart-camera","status":"publish","type":"post","link":"https:\/\/mailinvest.blog\/index.php\/2022\/12\/07\/anker-tries-to-bullshit-the-verge-about-security-problems-in-its-eufy-smart-camera\/","title":{"rendered":"Anker Tries To Bullshit The Verge About Security Problems In Its Eufy \u2018Smart\u2019 Camera"},"content":{"rendered":"

<\/a>\n
<\/p>\n

\n

from the I-always-feel-like-somebody’s-watching-me.<\/i> dept<\/h3>\n

Anker, the popular maker of device chargers and the Eufy smart camera line,\u00a0proudly proclaims on its website<\/a>\u00a0that user data will be stored locally, \u201cnever leaves the safety of your home,\u201d footage only gets transmitted with \u201cend-to-end\u201d military-grade encryption, and that the company will only send that footage \u201cstraight to your phone.\u201d<\/p>\n

Yeah, about that. <\/p>\n

Security researcher Paul Moore and a hacker named Wasabi have discovered that few if any of those claims are true, and that it\u2019s possible to stream video from a Eufy camera, from across the country, with no encryption at all<\/a> simply by connecting to a unique address at Eufy\u2019s cloud servers using the free VLC Media Player.<\/p>\n

Both clearly demonstrated the problem on Twitter<\/a>, but, when contacted by The Verge, Anker tried to claim that what the security researchers had clearly, repeatedly demonstrated wasn\u2019t possible<\/a>:<\/p>\n

\n

When we asked Anker point-blank to confirm or deny that, the company categorically denied it. \u201cI can confirm that it is not possible to start a stream and watch live footage using a third-party player such as VLC,\u201d Brett White, a senior PR manager at Anker, told me via email.<\/em><\/p>\n<\/blockquote>\n

Except it\u2019s not only possible, it\u2019s been repeatedly proven (though there\u2019s no evidence yet of this having been exploited in the wild and it only works on cameras that are in an awakened state). Users really only need a camera\u2019s serial number, which they can obtain from the box or sometimes guess. An attacker could also exploit and access cameras he donated to Good Will or other thrift stores. <\/p>\n

The discovery comes after a decade of \u201csmart\u201d hardware device makers having a fairly abysmal track record on security and privacy despite websites that routinely claim the opposite. From TVs that fail to encrypt your home conversations to refrigerators that leak your email credentials, the sector is rife with problems that somehow still don\u2019t get the kind of scrutiny they deserve. <\/p>\n

Moore claims Anker\u2019s problems go deeper, claiming<\/a> that Eufy had violated numerous additional security promises, including uploading camera thumbnail images, including captured users\u2019 faces to the cloud without permission and\u00a0failing to delete stored, private consumer data<\/a>.<\/p>\n

Despite Anker being a Chinese-based company, you won\u2019t hear any of the same national security hyperventilation over these kinds of issues routinely found in this and other Chinese-made \u201csmart\u201d home technologies. Those kinds of freak outs are, apparently, singularly reserved<\/a> for social media services like TikTok, and only if such complaints can get you on television<\/a>. <\/p>\n

\nFiled Under: chinese<\/a>, encryption<\/a>, eufy<\/a>, privacy<\/a>, security<\/a>, streaming<\/a>, video<\/a>
\n
Companies: anker<\/a>\n<\/p>\n<\/div>\n