The IT Nerd

Over the weekend I posted a story about Eufy and the fact that they have lied about the security that their had for years. And that my belief is that they should be banned from sale because this isn’t the first time that this has happened. Part of my belief that they should be banned comes from the fact that I don’t believe that Eufy is serious about gaining the trust of their users. This is being reinforced by the news that Eufy isn’t patching out a potential security issue in the Eufy Security app. Instead Eufy is just telling users that their thumbnails will be uploaded to the cloud when they choose specific notification settings in the app;

As of Monday, an update has been rolled out to the Eufy Security app to add a statement disclosing that thumbnail images will be uploaded to the company’s cloud servers. 

For you to get notifications with thumbnails in them from a security camera, a thumbnail has to be uploaded someplace. That’s true for any camera system. And part of the problem is that Eufy sells these cameras with the expectation that they are completely private. Which clearly they are not. Now that Eufy has clarified this, I am guessing that they hope that this issue will go away. But it won’t because this doesn’t do anything about the ability for a threat actor to stream video. Eufy hasn’t commented on this as far as I know. And there’s no sign that they will do anything about it.

Thus if Eufy was hoping to make this issue go away, I don’t think that this will do it.

This week it came to light that Eufy has been lying about the security of their cameras. That’s not a surprise to me as when I reviewed their cameras last year, they were dealing with similar issue where users could see other people’s cameras without any effort. The issue was corrected quickly. But it wasn’t the first time something like this has happened.

Now in case you didn’t want to read any of that, here’s the TL:DR (too long, didn’t read) on this: Eufy’s cameras aren’t as secure as they have claimed for years. Threat actors with the right information can watch video from your Eufy camera. If that’s not bad enough, Eufy also uploads some data to the cloud that customers were previously unaware of. Now the company has issued an apology and has updated its product language in the Eufy app to better clarify which settings will trigger a cloud upload. Though, in a bizarre twist, Eufy issued a second statement on December 2 that from a PR and customer confidence standpoint sucks:

“eufy Security adamantly disagrees with the accusations levied against the company concerning the security of our products. However, we understand that the recent events may have caused concern for some users. We frequently review and test our security features and encourage feedback from the broader security industry to ensure we address all credible security vulnerabilities. If a credible vulnerability is identified, we take the necessary actions to correct it. In addition, we comply with all appropriate regulatory bodies in the markets where our products are sold. Finally, we encourage users to contact our dedicated customer support team with questions.”

Now where I sit, I can’t say if Eufy is just lazy when it comes to security, or if they are trying to do something nefarious. But seeing as they are a Chinese company, issues like these have to be treated with some degree of extra suspicion. And seeing as this has happened more than once, I think we’re at a point where retailers should not only stop selling their gear, but I would argue that governments should ban this company from being able to sell their gear. Just like Huawei has been banned from many telcom networks.

Eufy keeps saying that that they will do better going forward. But we’re not seeing evidence of that seeing as this keeps happening. At this point I am through giving them chances. And so should governments around the world because there is no way that this sort of behavior by Eufy should be tolerated. A ban will send the message to Eufy and others that they need to talk the talk and walk the walk when it comes to security. Plus if Eufy or others really want to have the confidence of consumers, they need to have their claims validated by a third party. But I suspect that Eufy won’t subject themselves to that level of scrutiny. Thus they need to be banned. And the sooner the better.

Now if you ask me what you should do if you have an Eufy camera? My advice would be to rip them out because your privacy and security is invaluable. That is true for both indoor cameras and outdoor ones too. I would even go as far as to say that you shouldn’t even resell them as you’re just passing along a major problem to someone else which is not fair on that person. My advice is to recycle them at your local electronics recycling facility and take these security and privacy nightmares out of circulation forever.

Finally, if Eufy is reading this, I have to say that you’ve created this mess and it’s way too late for you to say sorry for it. Consumers put a lot of trust in the vendors of this sort of gear and you’ve burned through that trust. And since you can’t fix your issues, hopefully governments around the world will fix it for you by banning you out of existence.

Game over Eufy.