Eufy Security Camera (EufyCam)
From Wiki-IoT
| Eufy Security Camera (EufyCam) | ||
|---|---|---|
|
Security Grade
Calculator v1
|
Eufy Security Camera (EufyCam)
Brand: Eufy (Parent: Anker Innovations) Category: Smart Camera • Model / Gen: EufyCam 2 Release Date: 2019-10-01 • Status: In sale Classification Date: 2026-10-28 • Official Website | |
Contents
Security Evaluation
1. Device Security
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Known hardware tampering | None | 🔗 Proof | Physical tampering not documented. |
| Known vulnerabilities | Rare | 🔗 Proof | 2022 unencrypted live-stream access via VLC; facial data uploaded unencrypted. |
| Prior attacks | Rare | 🔗 Proof | Paul Moore disclosure led to lawsuits; no mass exploit campaign. |
| Updatability | Rare | 🔗 Proof | Anker pledged fixes but rollout was slow. |
| Category Score | Score: 2 / 3 | ||
2. System Security
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Authentication with other systems | No | 🔗 Proof | Stream URL = serial + timestamp + brute-forceable token. |
| Communications | No encryption | 🔗 Proof | Claimed AES-256 E2E but live streams were unencrypted. |
| Storage | No encryption | 🔗 Proof | Thumbnails and facial-recognition data uploaded unencrypted to AWS. |
| Category Score | Score: 3 / 3 | ||
3. User Authentication
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Account management | Full | 🔗 Proof | Eufy account management. |
| Authentication | Basic | 🔗 Proof | Account auth exists but stream auth was bypassable. |
| Brute-force protection | Exist | 🔗 Proof | Login rate limiting present. |
| Event logging | Partial logging | 🔗 Proof | Motion events visible; no full audit trail. |
| Passwords | Require change after setup with complexity requirements | 🔗 Proof | Account password complexity. |
| Category Score | Score: 2 / 3 | ||
Technical Specifications
| Property | Details |
|---|---|
| Operating System & App | Eufy embedded firmware (Companion App: Eufy Security app) |
| Hardware (CPU / GPU) | CPU: • GPU: |
| Memory & Storage | Memory: • Storage: HomeBase local storage + cloud |
| Power, Battery & Charging | Battery: • Power: Rechargeable battery • Charging: |
| Display & Camera | Display: • Camera: |
| Sound & Connectivity | Sound: • Connectivity: Wi-Fi, HomeBase hub |
| Physical (Dimensions & Mass) | Dimensions: • Mass: |
Eufy marketed its cameras as end-to-end encrypted, but a 2022 disclosure showed unencrypted streams and facial data accessible without proper authentication. Account layer is solid, but the core 'no cloud, encrypted' promise failed.
