Amazon Web Services (Reolinks cloud service provider) breached by hackers

clarkemr

Can Reolink advise its customers whether the breach of AWS involved Reolink Cloud Services?

Can Reolink please advise whether AWS has conducted a full security audit of all it's clound service customers such as reolink Cloud Service? Have any further backdoors been searched for by AWS, specifically in Reolink Cloud Storage Servers?

Can Reolink kindly advise its cloud storage customers what steps Reolink Cloud Service has taken to protect customer's data and personal information from future breaches of AWS?

Kindly refer to KrebsonSecurity for detailed information on the AWS breach.

Thank you

Mick

Cynthia

Reolink will store the video and audio-only when users enable Reolink Cloud storage service and configure it to upload videos to the cloud. Otherwise, Reolink will not save any video or audio information from users.

When users access Reolink cameras/NVR via Reolink App/Client, 2 servers could be involved: the P2P server and the Relay server. Rest assured that neither server will save your personal information. And here is how the servers work in details:

After the user inputs the UID, the P2P server will help Reolink Client/App to find the device and try to set up a Peer-to-Peer connection between them. Once the P2P connection is created, the Reolink camera/NVR will communicate with the Reolink Client/App directly to enable live view, playback, configuration and other functions. The Reolink Relay server will not get involved at all during the process.

In rare cases that the P2P connection fails, the Relay server will act as the middleman to help forward the information to the Reolink Client/App, but the Relay server will not save any information from users.

The video and audio are also secured by the password. Without the correct username and password, no one will be able to access the device and view the video. Please keep your password secret to others for safety concerns.

clarkemr

Dear Cynthia,
Thank you for your reply but it has not answered the critical questions. My questions relate to the data breach at Amazon Web Services - Reolink's cloud storage provider. I have not asked anything about how Reolink devices connect to the app. Could you please answer:

Amazon Web Services suffered a major data breach for two months between December 2019 and January 2020. Was Reolink customer's cloud stored data accessed?

Has Reolink or AWS undertaken conducted a security audit to confirm no 'backdoors' were left by the hackers in AWS / Reolink could storage servers?

As a regular subscriber of Reolink cloud storage service, I am entitled to be confident that my video data has not been accessed in the massive Amazon Web Services hack and that Reolink is undertaking measures to provide complete security in the future.

Thank you

Cynthia

Thank you for your feedback. We have not received any feedback or discovery of the data breach yet, but we will inform our research and development team and pay close attention to this matter.