Xiaomi security cameras sent private images to stranger’s Google Home Hub
Chinese tech company temporarily blocked from communicating with Google Assistant and Nest platform.
Google has blocked Xiaomi devices from working with its Home and Nest Hubs, as well as the Google Assistant, after images from strangers' security cameras appeared on someone else's Home Hub display.
The issue was discovered earlier this week by a Reddit user known as Dio-V. They posted to the discussion forum on January 2 to say their Google Home Hub (now known as the Nest Hub) was showing images from strangers' security cameras, instead of their own.
Although not moving footage, the images were clearly a breach of the users' privacy, as Dio-V's Google Hub showed the insides of other people's homes. One image showed a small child sleeping.
The poster owns a Xiaomi Mijia 1080p Smart IP Security Camera purchased from AliExpress, which can be linked to a Google account and broadcasts its video feed to the owner's Google or Nest smart display. The video feed can be summoned by tapping at the display, or asking Google Assistant.
Echo Show 5 - Compact smart display with Alexa - Charcoal
But instead of seeing their own camera feed, Dio-V was shown random still images from cameras belonging to strangers, and seemingly living in a different timezone, given the time stamp on each image.
Google responded quickly to the privacy breach, telling Android Police: "We're aware of the issue and are in contact with Xiaomi to work on a fix. In the meantime, we're disabling Xiaomi integrations on our devices."
This move means Xiaomi's Mi Home devices can no longer be used in conjunction with Google or Nest accounts and devices, and cannot be controlled using Google Assistant.
Xiaomi later added its own statement, saying the issue was due to a cache update rolled out on December 26, which wrongly caused the still and sometimes corrupted images to appear on the wrong device. The company said this only happened if someone had the Google Home Hub and Xiaomi Mijia camera operating "under poor network conditions."
Xiaomi said it had found 1,044 users with the two products connected in the same way as Dio-V, and that "only a few with extremely poor network conditions might be affected". It also added that the problem would not have occurred if the camera had been linked to Xiaomi's own Mi Home app, instead of using Google.
The company added: "Xiaomi has communicated and fixed this issue with Google, and has also suspended this service until the root cause has been completely solved, to ensure that such issues will not happen again."
Although the number of affected users here appears to be relatively small, the problems here are clear. Without the correct safeguards in place, smart home devices like security cameras can expose extremely private parts of our lives - and, in this case, our sleeping children - to strangers. The more technology companies ask us to place cameras inside our homes, the more they must keep a tight lid on security lapses like this.
Introducing Echo Show 8 - HD 8" smart display with Alexa - Charcoal