Major Privacy Breach as Eufy Security Camera Owners Report Seeing Other Users' Video Feeds

[MacRumors]

Owners of Eufy home security cameras are this morning reporting seeing live and recorded feeds show up in the Eufy app from other users' cameras, in what appears to be a disturbing breach of privacy and a major malfunctioning of the company's service.

As with many connected domestic security cameras, Eufy cameras offer users the ability to view real-time and recorded streams of video feeds from the devices set up in and around the home. However, many Eufy owners are reporting seeing video feeds from cameras that are clearly not their own, while some users are claiming they are even able to pan and zoom strangers' cameras.

Eufy users on Monday took to Reddit to express their disbelief:

"I am seeing someone else's security camera feeds on my phone.
Seemed to happen a couple of hours ago. I am seeing someone else's camera feeds using the app on Android. My wife who also has full access under her own email can see another person's feed (2 devices, 2 different feeds) on her iPhone."

"Having the same issue in Melbourne... can view someone internal/external cameras in Florida, USA Massive security breach and with no way to tell if yours have been breached. EUFY please explain!!!"

"I'm having the same issue. I could access everything on somebody else's account, including the live feed and I was controlling their camera (pan, tilt, rotate). I was able to take video recordings, using the in-app record button, which saved to my phone. The camera I had access to was in the Los Angeles time zone."

"This is EXTREMELY EXTREMELY concerning. I have had my eufy front door camera for just over a month now. I wanted my partner to also have access to the account, so instead of making her a separate account and inviting her, I just logged into my account on her phone. Now here is the troubling part.... Now on her phone she is seeing someone elses front and backyard camera... We can see it live, we have full control over it... Wtf!? This is concerning because if this is happening then how do we know our account isn't somehow being seen by someone else.... Anyone have ANY idea why this would happen?"

Other users have reported similar experiences in the last few hours, and the issue appears to be widespread. Some owners affected by the issue are in the United States, but others are located as far afield as New Zealand, suggesting the breach is global.

On a positive note, the issue doesn't seem to be affecting streams set up using Apple's ‌HomeKit Secure Video‌, which encrypts video footage and stores it in iCloud rather than on servers handled by a third party.

It's not yet clear what's caused the issue, but the best advice for Eufy camera owners right now is to disconnect the devices at least until the breach is resolved. We've asked Eufy for comment and we'll update this article as soon as we learn more.

Article Link: Major Privacy Breach as Eufy Security Camera Owners Report Seeing Other Users' Video Feeds

 

[matrix07]

On a positive note, the issue doesn't seem to be affecting streams set up using Apple's ‌HomeKit Secure Video‌, which encrypts video footage and stores it in iCloud rather than on servers handled by a third party.

One major selling point for HSV then.

This is so creepy.

 

[Picklefoot]

People not set up for Apple HomeKit deserve getting their privacy breached because they haven’t done their homework.

You either keep your data local with HomeKit or you accept your privacy being breached by having the feeds on the cloud.

 

[steevn]

I have both of the cameras shown and now glad I did setup HomeKit Secure Video. HKSV needs some improvements but it’s nice knowing we should all be protected from stuff like this for the most part.

 

[steevn]

People not set up for Apple HomeKit deserve getting their privacy breached because they haven’t done their homework.

No one deserves that.

 

[RedTheReader]

This right here is why I'm so hesitant to embrace IoT products. Seeing things like this happen is extremely creepy.

 

[edolecki]

Security is not easy and one of the huge failings of IoT devices. HomeKit can make this easier if you’re lucky. I have a Eufy scale that doesn’t go through HomeKit. I don’t care, but some might if that data became available on the web.

 

[profets]

I have both of the cameras shown and now glad I did setup HomeKit Secure Video. HKSV needs some improvements but it’s nice knowing we should all be protected from stuff like this for the most part.

Yup. And a step further would be to enabled Homekit Accessory Security for those with routers that support Homekit. My Eufy cameras show as offline when I try to connect to them from my Eufy account.

 

[sirozha]

People not set up for Apple HomeKit deserve getting their privacy breached because they haven’t done their homework.

You either keep your data local with HomeKit or you accept your privacy being breached by having the feeds on the cloud.

HomeKit secure video keeps the recordings in the cloud.

 

[matthewadams]

Having briefly used their app this comes as no surprise. I have a general distrust for apps and companies like Eufy or Aqara when it comes to this. The low prices probably come at cost of not just user experience but also security.

Having said that I have some trust in apples rigid homekit certification program. There's a good reason you can only either opt in for homekit OR use the proprietary apps but not both at the same time.

 

[I7guy]

I hope Eufy gets this figured out. But it's a good lesson on how fast cloud based product security can go south.

 

[NightFox]

People not set up for Apple HomeKit deserve getting their privacy breached because they haven’t done their homework.

You either keep your data local with HomeKit or you accept your privacy being breached by having the feeds on the cloud.

I think you might need to do a bit of your own homework on HomeKit Secure Video if you think it's storing your data locally. Your data still sits in the cloud - the difference is it's encrypted locally.

 

[Dwalls90]

This is why we should all be careful about which companies we allow into our homes. Apple isn't perfect, but HSV certainly solves this problem.

 

[Dwalls90]

I think you might need to do a bit of your own homework on HomeKit Secure Video if you think it's storing your data locally.

Fair, but HSV is hooked into iCloud, which has 2FA and is backed by Apple's approach to privacy. iCloud isn't perfect, but when have you heard of Apple having issues related to privacy like this that weren't user error (e.g. someone sharing their password and not having 2FA).

 

[JosephAW]

People not set up for Apple HomeKit deserve getting their privacy breached because they haven’t done their homework.

You either keep your data local with HomeKit or you accept your privacy being breached by having the feeds on the cloud.

Exactly, all our cameras are on intranet.

 

[satchmo]

Who’s surprised?

 

[cmaier]

Meanwhile there are people who argue that Apple should be forced to allow every app to use whatever servers for whatever purpose the developers want, because there can’t possibly be any security or privacy implications of that.

 

[moiety]

We have this cam. It’s a GREAT cam, especially for $40 or whatever it was on Amazon. The microphone is amazing. I can hear the neighbors chatting 20 feet away.

Set ours to HomeKit Secure Video the day I took it out of the box. No problems here. 👍

It’s almost like Apple knows what they’re doing?? 🙄

 

[DJLC]

Glad I dumped my Eufy doorbell for the Logitech Circle when it came out... I was hoping Eufy's doorbell would get HSV, but no such luck. TBH I'm not terribly surprised; the Eufy doorbell is very much a black box, and the app ain't great either.

 

[jk1221]

Exhibit A why you NEVER put cameras INSIDE your house that go to the cloud.

Outside, meh. People could state at my porch, no loss there really its publicly viewable space anyway really (in my case) 🤷‍♂️

IMHO "security" cameras are meant for outside- security of the home perimeter. Once someone is inside it is FAR too late (and you already caught them on the outside cams) for inside cams to do anything.

 

[Jamie0003]

People not set up for Apple HomeKit deserve getting their privacy breached because they haven’t done their homework.

You either keep your data local with HomeKit or you accept your privacy being breached by having the feeds on the cloud.

You do realise HomeKit video IS stored in the cloud right? iCloud?

 

[jk1221]

You do realise HomeKit video IS stored in the cloud right? iCloud?

🤦‍♂️ I REALLY do think some people truly believe Apple is somehow infallible versus the rest and not subject to data breaches. It is terrifying people really believe that and believe Apple is security godly to blindly trust them.

While not a cloud issue, https://www.securitymagazine.com/ar...-incident-affecting-128-million-users-in-2015

You just dont hear about it because Apple doesnt tell its users. Apple has a problem EVER admitting fault- likely for reputation and stock reasons.

 

[maverick808]

People not set up for Apple HomeKit deserve getting their privacy breached because they haven’t done their homework.

You either keep your data local with HomeKit or you accept your privacy being breached by having the feeds on the cloud.

HomeKit video is not local. It's encrypted if you are using HomeKit Secure Video, but it's definitely not local and goes over the Internet to first go to and then come back from Apple's cloud.

 

[seme332]

I just purchased a Eufycam two days ago, it’s supposed to arrive tomorrow. Will set it up using HomeKit Secure Video then. Does this also let me record the video and watch it back later? If so, how long can recordings be stored?

We bought the Eufy because we had some strange happening on our terrace, where things randomly seem to be misplaced during the night and nor me or my partner did it. We live in a building with multiple apartments and neighbors could theoretically have access to our terrace, so we want to see if we can figure out how this is happening. Therefore I need to be able to record video at night and potentially review it later if anything strange happens again.

 

[chfilm]

Surpriiiiiiise. Who puts cameras like this into their homes shouldn't be surprised.