Security breach @ Eufy

#13

Been checking mine on/off since the reports and so far have not received anyone else’s cameras (though whether anyone else has got mine at some point remains to be seen :open_mouth: )…both my homebase’s have dropped offline for a few minutes though several times throughout the day.

Luckily they only cover the front / back gardens, so if someone has got mine today they will likely only see the grass getting a nice watering from the rain showers we are having :wink:

Will be powering them down though until some official response is given…

1 Like
#14

Screenshot_20210517-150325
Screenshot_20210517-150325.jpg1080×400 31 KB

I like your garden.

:wink:

#15

Watering only?
May be the spies know now where you are hiding your Whisky-bottles! :rofl:

39274328_303

#16

Nah, they are safe and sound :grin:

image

Did you see the big fat pigeon land for his morning feed :rofl:

2 Likes
#17

Is it well done now?

taube-im-speckmantel-rezept
taube-im-speckmantel-rezept.jpg1200×902 65.2 KB

:rofl:

( Dont forget to wrap it in some bacon)

1 Like
#18

All good now, this has been fixed

Dear user,
The issue was due to a bug in one of our servers. This was quickly resolved by our engineering team and our customer service team will continue to assist those affected. We recommend all users to:
1.Please unplug and then reconnect the home base.
2.Log out of the eufy security app and log in again.
Contact support@eufylife.com for enquiries.

#19

I was reading reports where people were getting talked to or hearing obscene noises through their cameras.

I don’t think “it’s all good”

I think there is an issue that occurred that needs to be fully explained and also what eufy plans to do so it will never happen again

#20

Yes it has been addressed and fixed, Eufy will be releasing a statement addressing the issue as well as an apology

1 Like
#21
#22

:thinking:

#23

Hmm, the next few hours and days are going to be interesting…must have been quite a bug…

3 Likes
#24

People, Processes. Technology.

They’ve only fixed the Technology.

What Process allowed the bug?

How do anyone remote from home unplug?

#25

There is nobody who can answer that.
All systems got so complex meanwhile.
If you “repair” something here, another bug shows up there.

Do you know that there are still old COBOL programs working properly.
Nobody dares to touch these.

Have you ever written COBOl-programs?
If so, you could get a high paid specialist!
Not me too old!

#26

In security world… trust is everything (or zero trust)… its going to be hard for customers to trust …

even before I saw this thread on anker, had seen the news and had checked the security app, and saw some other feeds, have since powered off the 2 pan and tilt cams i have.

#27

Agree, now it’s even harder to regain that “trust”

1 Like
#28

Testing reduces risk. A new release goes to some test cameras and once tested then released.

Not saying no bugs, saying you test!

#29

Just saw this - power cycled my one cam, but apparently it was all over before I noticed. But the app still has thumbnails of the captures, etc even though the data is stored on my local SD card. So you could get something even with the camera off.

But this is why all cameras are limited to a focus on exterior access points, and not in any private areas. Security limitations always exist, on every product that connects to the outside world.

#30

Back in the days of COBOL, you had one mainframe and a few seconds of computer time was expensive.

Now in the era of virtualisation and VMs, cloning of disk images and machine images, you can do a lot of testing using a clone of data. There’s far fewer excuses for errors now.

So the issue is not bugs are created, it is they are allowed to be promoted to production. That implies a process error, rushed untested code released, so a process error, and failed processes just cause bugs released again in the future.

One way to stop this is an encryption key per account / user which is generated in the device, and so you cannot see anyone else’s feed. This looks like the data is unencrypted when it leaves the device and then can be accessed by anyone not just the owner.

Testing and high availability (HA) and failover all use similar technology. The only difference between testing is its a virtual snapshot you test on and discard, HA is you have a sync mirror locally and an async mirror remotely and DR is a planned switchover to the mirror.

1 Like
#31

Skilled programmer time has remained the most significant resource constraint as the others have fallen away. A culture of strong processes, good systems and quality control pays for itself in the long run. But it costs up front, and “we’ll get the software out now and improve later” has eaten a lot of companies.

Everything you are saying makes perfect sense, and I bet they even have competent programmers who could do the job. But probably not enough of them at the right times to have that entire testing flow fully utilized every time.

#32

Architects are expensive, as it takes 20+ years of experience of assuming what can go wrong will go wrong.

A distributed encryption key would have helped in this case, so each user generates their own key in their account and only when they login is the key then decrypting. If there was a network routing error, you’d see nothing.

The way they Architected, one key for all cameras, so the only thing stopping Anker seeing everyone’s camera is either they don’t want to or haven’t accidentally done it yet. They just today proved they or someone else can access any Eufy camera.