Eufy caught lying about local-only security cameras with footage sent to cloud, accessible in unencrypted streams - 9to5Google

Home security cameras have gotten a lot better in recent years, but the security of your footage has always been a concern.

Anker’s Eufy brand claims to keep data local, but a security researcher has exposed that the claim is far from true, with footage not only going to the cloud, but remaining visible even after it was supposed to be deleted.

Eufy sells several of its security cameras with the promise that video footage and other data are local only, explicitly saying “no one has access to your data but you” on its website.

Paul Moore, a security researcher, posted on Twitter last week a frightening security situation with Eufy home security products including camera-equipped doorbells.

In the thread and accompanying videos, Moore shows proof that Eufy cameras are sending data that is said to be “stored locally” to the cloud, even when cloud storage is disabled.

The doorbell’s camera was uploading facial recognition data from the camera to Eufy’s cloud servers with identifiable information attached, and that this data wasn’t actually removed from Eufy’s servers when the related footage had been deleted from the Eufy app.

In the video below, Moore also notes that Eufy used the facial recognition data from two different cameras on two completely different accounts to link data from each, and points out that Eufy never notifies the user that this is happening – the company’s market rather implies just the opposite.

It’s not clear how many of Eufy’s home security cameras and products are affected by this.

Moore offered an update to the situation yesterday, saying that Eufy has removed the “background call” which shows stored images, but not the underlying footage, and that the company has also encrypted other calls to cover its tracks