Here’s Why You Want To Stay Away From Eufy Security Cameras – SlashGear

Things began towards the end of November 2022 after Moore, who had been testing Eufy’s Doorbell Dual Camera system for a while, noticed something amiss with a security camera he purchased. Moore said his security cameras that supposedly had nothing to do with the Cloud — and stored all information locally — were actually uploading some data to Eufy’s AWS (Amazon Web Services) cloud servers in complete contrast to Eufy’s claims.

Moore posted a series of tweets on November 21, 2022, asking Eufy about how its camera system sent facial recognition data to its servers. Shortly thereafter, another Twitter user made a startling revelation. He claimed that accessing the live feed from a Eufy camera was possible without any form of authentication — by simply using VLC player. The Verge was able to independently verify this claim.

In both these cases, it is pertinent to note that they could only access their own camera streams. While it is still theoretically possible for hackers to use brute force techniques to generate a direct link to a stream, there has not been a recorded instance of this happening. Additionally, it is also necessary for the user to log in to Eufy’s web interface for them to generate the live stream link in the first place. Still, these did not wholly explain why Eufy’s servers were storing facial recognition data on its servers, and why that was done in the first place, given that Eufy made claims about its cameras having nothing to do with the Cloud.