#EUFY REMOTE BUTTONS EXPLAINED SERIAL NUMBERS#
#EUFY REMOTE BUTTONS EXPLAINED SERIAL NUMBER#

Wasabi also noted that the way the remote URLs are configured, there are only 65,535 combinations to try, 'which a computer can run through pretty quick.')

'It seems Eufy is trying to simply block people from viewing the data their (web) app sends instead of actually fixing the issue,' they wrote. (Update, 5:42 pm ET: Ars chatted with wasabi, who confirmed that they could view Eufy camera streams from systems outside their network without authentication or other Eufy devices on that system. Researcher Paul Moore, who initially raised concerns with Eufy's cloud access, tweeted on November 28 that he had 'a lengthy discussion with legal department' and would not comment further until he could provide an update. We've reached out to Eufy and wasabi and will update this post with any further information.

#EUFY REMOTE BUTTONS EXPLAINED SERIAL NUMBERS#

Eufy's serial numbers are typically 16 digits long, but they are also printed on some boxes and could be obtained in other places.

#EUFY REMOTE BUTTONS EXPLAINED SERIAL NUMBER#

'Typically,' that is, because the camera-feed URL appears to be a relatively simple scheme involving the camera serial number in Base64, a Unix timestamp, a token that The Verge says is not validated by Eufy's servers, and a four-digit hex value. Chiefly, you would typically need a username and password to reveal and access the encryption-free URL of a stream. The Verge notes some caveats, similar to those that applied to the cloud-hosted thumbnail. It also contradicts an Anker/Eufy senior PR manager who told The Verge that 'it is not possible' to watch footage using a third-party tool like VLC. This makes Eufy's privacy promises of footage that 'never leaves the safety of your home,' is end-to-end encrypted, and only sent 'straight to your phone' highly misleading, if not outright dubious. Last night, The Verge, working with the security researcher 'wasabi' who first tweeted the problem, confirmed it could access Eufy camera streams, encryption-free, through a Eufy server URL. It seems there's more understanding now, and it's not good.Įufy didn't respond to other claims from security researcher Paul Moore and others, including that one could stream the feed from a Eufy camera in VLC Media Player, if you had the right URL. When security researchers found that Eufy's supposedly cloud-free cameras were uploading thumbnails with facial data to cloud servers, Eufy's response was that it was a misunderstanding, a failure to disclose an aspect of its mobile notification system to customers. Finally, we encourage users to contact our dedicated customer support team with questions.' In addition, we comply with all appropriate regulatory bodies in the markets where our products are sold.

If a credible vulnerability is identified, we take the necessary actions to correct it. We frequently review and test our security features and encourage feedback from the broader security industry to ensure we address all credible security vulnerabilities. However, we understand that the recent events may have caused concern for some users. 'eufy Security adamantly disagrees with the accusations levied against the company concerning the security of our products. ET : Eufy has issued a statement in response to findings from The Verge and a security researcher: Enlarge / Eufy's camera footage is stored locally, but with the right URL, you can also watch it from anywhere, unencrypted.

Eufy remote buttons explained