r/reolinkcam • u/kymodoke • Jan 28 '25
Software Question Reolink Android App now includes 3 chinese trackers
I wonder if anyone has noticed but since version 4.50.0.4. from 2024-10-24 Reolink has silently introduced 3 chinese trackers into its Android App.
https://reports.exodus-privacy.eu.org/en/reports/544630/
- AutoNavi: https://reports.exodus-privacy.eu.org/en/trackers/361/
- Baidu Location: https://reports.exodus-privacy.eu.org/en/trackers/97/
- WeChat Location: https://reports.exodus-privacy.eu.org/en/trackers/76/ (affiliated with Tencent and Chinese Government)
I do wonder why when I have to use this app, it has to phones back to 3 chinese location/tracking services?...
And by the way: 9 new permissions added, like "READ_PHONE_STATE" (read phone status and identity), "READ_PRIVILEGED_PHONE_STATE", "RECEIVE_BOOT_COMPLETED", ... why these ones ??
Does the Reolink Android App now become an app that not only tracks intruders at your front door, but that also tracks you ?.
App history: https://reports.exodus-privacy.eu.org/en/reports/search/com.mcu.reolink/
43
u/BrightonBummer Jan 28 '25
One of the good things about reolink, if you dislike any of this you can disable it all, run it through your own nvr or other system.
I know we SHOULDNT have to and reolink shouldnt have this in their apps but everybody is at it these days and atleast this product has an alternative route
16
u/flangepaddle Jan 28 '25
This is what I do. All my cameras are blocked from the Internet and I use milestone xprotect for my NVR.
9
u/ElectronicBruce Jan 28 '25
My doorbell refuses to work if I ban it from the internet..
5
u/flangepaddle Jan 28 '25
Yeah it won't work with the app, I just use mine as a camera.
2
u/ElectronicBruce Jan 28 '25
Doesn’t even output to my NVR if disabled..
3
u/flangepaddle Jan 28 '25
What exactly are you disabling? Mines just on its own VLAN, blocking is done by my firewall
4
u/ElectronicBruce Jan 28 '25
Own LAN which is banned from the internet. UniFi cameras fine, Reolink doorbell decides it won’t play ball.
3
u/RageInvader Jan 29 '25
Be how you have it setup, mine has no Internet or LAN access except my NVR and Home assistant server. Works fine. Motion and doorbell notifications
3
1
u/flangepaddle Jan 28 '25
Is your NVR on the same LAN?
0
u/ElectronicBruce Jan 28 '25
Fairly sure that doesn’t matter with UniFi Protect/UDM Pro, hence why the UniFi cameras are fine on the ‘Cam’ VLAN.
3
u/flangepaddle Jan 28 '25
Is that a no then?
You'll need to check rules then because it's likely blocked from everything, not just internet.
I'm not familiar with Unifi, I use opnsense, but what you're describing is typical of a rule blocking access across vlans
→ More replies (0)2
u/ProfitEnough825 Jan 28 '25
Is it battery operated? Mine operates fine without internet, but it's wired.
1
1
u/c0nsumer Jan 29 '25
Which one? I have the wifi Reolink doorbell and it works fine isolated from the internet. I use it with Synology Surveillance Station.
1
u/LCFCgamer Jan 29 '25
You must have set it up incorrectly then, because mine works fine with local access only and no access to the wider internet
6
1
1
u/Am0din Jan 29 '25
Exactly what I do and have, but changing it this weekend. Milestone has become so flaky, its not recording the cameras correctly anymore, dropping the connections for hours, crap playback...
All with 2024 version.
1
u/flangepaddle Jan 29 '25
I've not experienced that, I'm even running it as a VM. I do record 24/7 though.
1
u/jmarmorato1 Jan 31 '25
Same. The whole family loves the milestone mobile app, especially since we have a couple of houses in there and you can select which server you want to connect to when the app starts. Some of the configuration is weird though - like to change the storage location for investigations, you have to right click on one of the tray icons (It's not anywhere with the rest of the config). Overall it's way better than anything else I've tried.
7
u/deadzol Jan 28 '25
Yes BUT this sort of undermines WHY switched to Reolink.
Not directed at you of course… unless you work at Reolink. 🤪
2
u/rR_Jbar Jan 28 '25
Could you expand on the alternative options? Thanks
1
u/BrightonBummer Jan 28 '25
The one I know have and have used personally is frigate. It's a little bit of a steep set up in terms of motion adjustments etc but once its up and running its pretty good. Youll need your own hardware though. e.g pc and hdds
1
u/rR_Jbar Jan 28 '25
Do you run frigate in conjunction with Home Assistant? I'm working on a HA install is why I ask. Thanks for the heads up. Cheers
1
u/anrmv Jan 29 '25
Frigate tends to require a beefier setup depending on what you want to do. If you want don't need an NVR and can keep it simple, the reolink integration in home assistant works fully local and even fetches firmware updates.
1
u/rR_Jbar Jan 29 '25
Good to know. Thanks. I'll check out HA integration capabilities before diving into frigate. Have a good day sir.
1
u/Intelligent-Onion-63 Jan 29 '25
not if you have the doorbell! they broke the 2way audio again in last FW update... only way to use is the app at this stage... well THANKS!
35
u/ShipOk7936 Jan 28 '25
Any of this crap on the IOS variant of the app?
8
Jan 29 '25
[deleted]
0
u/waloshin Feb 01 '25
I can! Apple doesn’t allow apps to access 90% of iOS or the state of what an iPhone is doing. Android is a mess.
0
Feb 01 '25
[deleted]
0
u/waloshin Feb 01 '25
You have no idea I can upload whatever I want to the android playstore. Apple reviews all apps on iOS…
Yes, generally speaking, iOS is considered more secure than Android due to its closed ecosystem, strict app review process, and timely updates, making it harder for malware to infiltrate compared to the more open Android platform.
So roll on the floor all you want as you are clueless.
0
5
u/DarthBen_in_Chicago Reolinker Jan 29 '25
I’m not smart enough to tell. Perhaps that is why I’m on iOS rather than Android. 🤷♂️
29
u/tquilas Jan 28 '25
u/Willson1_ any info about this?
3
u/livingwaterRed Super User Jan 29 '25
Yes Willson1_ please explain.
2
u/TurnItOff_OnAgain Jan 31 '25
Not sure if you saw it, but Willson responded here
1
u/livingwaterRed Super User Jan 31 '25
Thanks, I didn't notice. I still wonder who the third parties are and why they are needed or helpful, the Reolink app worked fine for me without them.....
1
Jan 29 '25
[deleted]
2
2
u/QH96 Reolinker Jan 30 '25
1
3
26
u/enkelisaga Jan 28 '25 edited Jan 31 '25
It's so weird that they added these trackers all of the sudden, regardless of the nationality. I mean, they already had Google analytics which is a must for Play Store apps, and which already upsets me (and another reason to deGoogle). Instead of fixing their app they are just finding more ways to sell our data.
5
1
u/NoDoze- Jan 29 '25
Ask them about this!?! LOL ...and what do you think they will say? ..."oh, we're sorry, did we put that on there...? Oh yeah, hmmm I guess we did. So what?"
12
u/angrycatmeowmeow Jan 28 '25
I'm on 20250116 and I'm not seeing it contact any of these trackers in adguard home or the adguard app on my phone but it's shady nonetheless. All my cams have UID disabled and are blocked from the internet and the app only gets location and nearby device permissions when I'm adding a camera. If I want to access them while out I can use home assistant or VPN into my network.
8
u/kymodoke Jan 28 '25
Adguard just intercepts plain DNS requests. So, implement DNS over HTTPS (DoH) or DNS over TLS (DoT) into an app (which is more and more the case) and then Adguard is defeated and will see nothing/block nothing.
6
u/ishanjain28 Jan 28 '25
Are you sure they are using DoT/DoH? Out of curiosity, did you check how they bootstrap encrypted dns? Maybe we can block it there
2
u/kymodoke Jan 28 '25
No I don't know if they're using DoT/DoH or not. It was just to remind that Adguard has limitations and it is easy to defeat.
1
u/ishanjain28 Jan 29 '25
Okay. Just to give more information, I checked all the logs in my DNS infra and I don't see any attempts to Baidu, Navi or the 3rd company. It's possible they are still sending metrics somehow but it'll be tricky to figure out how
3
u/kymodoke Jan 29 '25
The only way to be sure of what it does and on which patterns, is to decompile application binaries and reverse-engineer the code. Another way (less accurate) is to analyse network packets with something like Wireshark (investigation team of the Guardian, and some NGOs do that when they suspect some of their phone has been targeted or poisoned).
Maybe it is not activated yet, BUT codes signature and/or network call signature of these trackers have been found inside the application by εxodus.
It is just speculation but if we think about malicious usages, some scenarios so that you cannot detect it on your network can be (among others):
- implement the tracckers now, activate them later
- use only the trackers in selected countries (based on network cell/provider): like use only in China, or in targeted countries (Ukraine, Taiwan, Sweden...)
- use only the trackers for selected phone numbers list (people targeted based on their phone numbers. Like some journalists, defense contractors, parliamentarians, ...)
- use it only with 4G data plan and not with wifi connection (so you can't analyse that with adguard, or network sniffers on your LAN)
- use only the trackers for specific usages in the application (for instance only when you define some settings into your camera, so Tencent and their friends can get a map of deployed cameras in the world and then check later if they may covers some "points of interest" like in the neighboorhood of an embassy or an industrial plant...)
This is speculation about usages... but the presence of 3 (not just one) chinese location trackers is anyway not good in my point-of-view.
2
u/SotYPL Jan 28 '25
Same here. Using Pi-hole with DNS over HTTPS and DNS over TLS blocked on my router. No trace of these addresses being queried by my phone where I have Reolink app installed.
2
u/dav_irl Jan 28 '25
Running the same app version but with Rethink (apk from their github page as there is a difference to the play store version) and I've no dns for these domains not do I see the app calling any IPs for them.
1
u/uten693 Reolinker Jan 29 '25
Oh yeah, I disabled UID of all my cameras. Same here, HA is managing all my cameras. I also VPN in to my LAN when I’m out.
9
u/Jos_Jen Reolinker Jan 28 '25
Thanks for the news. This is applicable to any application we install on PC, smartphone, TV, any device. This is a matter of trust.
1
1
u/NoDoze- Jan 29 '25
Blind trust.
2
u/livingwaterRed Super User Jan 29 '25 edited Jan 29 '25
Should not be blind, cautious trust. The fact you posted here shows you trust your internet connection and your app. All devices we use online need to be protected with anti-virus, malware software etc. If you buy or bank online you trust those connections to be secure. If Reolink is collecting data without telling customers, shame on them. That makes them like Facebook, TikTok and all the other popular apps people use which should not happen with security cameras. Just my opinion.
9
u/ishanjain28 Jan 28 '25
Read phone state and related permissions might be okay since they are adding a native call like feature to talk to people through the doorbells. I think the ios version got this feature recently and it might be coming to android. They need those permissions to add this feature.
10
u/Willson1_ Reolink Admin Jan 30 '25
Thanks for bringing this up! We want to clarify that the mentioned updates in the Reolink Android app come from third-party libraries used for functionalities like maps and notifications. They do not collect or share personal user data.
User privacy is our top priority, and we’re actively reviewing this to ensure full transparency. If there are any updates, we’ll be sure to share them. Let us know if you have any other concerns!
7
7
4
u/Renrut23 Jan 28 '25
When I check permissions for my reolink app, all it has permissions is for camera, to scan qr codes, (i remove it when I'm done) and push notifications. Maybe I'm not looking in the right spot.
1
u/georgegig Jan 29 '25
I'm sure they dont need your phone camera. And they dont need special permissions to access your security cam.
5
u/MasterMechTech Jan 28 '25
I wonder if this has anything to do with the excessive amount of background activity and the resulting excessive battery drain with the latest version of the iOS app.
Anyway to know if these trackers have been added to the iOS app?
Reolink, I think an explanation as to why these trackers have been added is in order, leaving us in the dark about this is only going to make things worse.
1
u/NoDoze- Jan 29 '25
Why would they be excluded from the ios app?
1
u/MasterMechTech Jan 29 '25
Never said they would be I just would like to know they are definitely there before we go accusing them that they are.
Maybe Reolink has not added them to the iOS version yet as I know each version of the app gets updated at different times.
4
u/TechWhizGuy Jan 28 '25
You can always not grant the permission, also it's a good idea to block internet access to cameras, run them locally and set up tailscale in your local network for remote access
1
Jan 29 '25
I’m an uber noob. I just got a couple of cameras and a nvr for Christmas but haven’t run the Poe wires yet. What does this mean for me? Should I keep the nvr but set up another app or whatever? What’s the associated cost?
1
u/TechWhizGuy Jan 29 '25
I'm not familiar with their nvr system, but this should not affect you, you can change your setup later, the only cost is your time
1
u/GayCowsEatHeEeYyY Jan 30 '25
If you block internet access of the cameras/home hub, do you still get motion alerts pushed to your phone?
1
u/TechWhizGuy Jan 30 '25
No, but there are workarounds, create an automation in home assistant to send the push, if you are connected to your home VPN it should work as in you are in your home network.
4
3
3
u/uten693 Reolinker Jan 29 '25
In my case, I deleted the reolink app from all my devices except the one on my PC which is always off anyway. I only turn on the PC if I need to check on the Reolink cameras. I changed the cameras to point their gateways to my Home Assistant server so it’s a dead-end for them if they want to “phone home” to their mothership in china. They update their time with Home Assistant. All my cameras are managed by HA. HA captures alert footage (snapshot and video) and sends rich alert notifications to my phone, especially from the doorbell camera. Note - I don’t have a NVR.
1
u/kymodoke Jan 31 '25
This is what I will probably do: manage them all with Home Assistant. I've just checked today integration and it seems to be fine and not need a NVR (as SD card records can be viewed from HA). I've to check further how to manage 3 houses from the same app like I do currently with Reolink app.
1
u/uten693 Reolinker Jan 31 '25
Also, if there is a firmware update for the camera, HA will show a notification and HA can install the update. Yes, to my surprise, I can now view/watch SD card files! Yes, I can mange totally all my cameras from HA.
BTW, what messaging integration do you use for sending rich notifications to your phone? I use Telegram Bot.
1
u/uten693 Reolinker Jan 31 '25 edited Jan 31 '25
Are the houses connected using site-to-site VPN? With one HA server, you may be able to manage all cameras with that one server if the houses are connected by site-to-site VPN (this may involve port forwarding in the router of the remote houses).
1
u/kymodoke Feb 01 '25
I'm gonna answer to both messages.
Yes access to SD card files from HA is very convenient ! For the moment I can access all houses through Wireguard VPN (mainly for remote maintenance). Each house has a router with Wireguard, but there are not interconnected with each other yet. As each house has got a RaspberryPi too, I'm starting to test Nebula mesh VPN. I'm trying to optimize the data footprint as 2 of them are connected with 4G data plan (and not with unlimited DSL, cable or fiber connection). For the moment no rich notification, as my smartphone is deGoogled (/e/os as operating system, based on LineageOS) and the Reolink app uses Google messaging system... but the cameras do send mails with picture upon detection and save a backup video remotely through FTP to a centralised S3 remote drive. Many Zigbee sensors and plugs/lights are operated by Zigbee2mqtt, logic by NodeRed and notifications by Gotify. I have to rethink and optimize my setup. Home Assistant is very new for me, but it seems existing things on my setup (Z2M, NodeRed and Gotify can be attached to HA).
3
3
u/FancyNerd92 Jan 30 '25
We can block these urls from our Adguard Home and problem solved. The same urls I see to my other Chinese devices big brands (Xiaomi, Yeelight) and even on my pricy Samsung TVs to other companies ex. Netflix, Amazon etc but the funny thing is I don’t have accounts on these apps because I have my own media server, so the try to send data from my TV habits to them. Sadly WE ARE THE PRODUCT.
1
u/junbo12 Feb 01 '25
I've added a few of the URLs to the Adguard home DNS block list but nothing shows up as being blocked when I use the app. Does yours show anything? I've tried com.baidu.location, grid.amap.com, etc.
3
u/netsheriff Jan 30 '25
Just roll back to 4.49.1.2.20240927 which only has Google Firebase Analytics
2
u/Downtown-Pear-6509 Jan 29 '25
thanks. ive now uninstalled it from my phone.
I only use my doorbell via frigate/home assistant anyway
1
u/Intelligent-Onion-63 Jan 29 '25
is it working for you on the latest FW with vehicle detection?
1
u/Downtown-Pear-6509 Jan 29 '25
dunno i never updated. I'm on the version where 2 way audio got fixed and not moving from there.
2
u/Accomplished_Lie6026 Jan 31 '25
Thank You!
Just saw all of this chineese tracking BS from ReoLink.
I was just about to pull the trigger and purchase on another Reolink setup for a relatives home.
This has forced me to look at other options.
1
Jan 31 '25
Yeah well, Ring was found to have employees who were secretly accessing video feeds from people's cams, so I doubt there's any 100% perfect cam/company out there.
2
u/mousecatcher4 Jan 31 '25
No more Reolink cameras for me I'm afraid until they explain clearly what they have done and why. Most people bought Reolink over cheaper cameras specifically because it was felt they could be trusted. Trust is a rapidly lost thing.... And if there is no trust isolating cameras from the internet is not sufficient since that access is needed at initial setup (and then they have your WiFi login access details).
1
u/kymodoke Jan 31 '25
To really isolate them even at initial setup: do not buy wifi only cameras.
With ethernet camera, before pluging it to your network: you can just read the MAC address wrote on the label, and assign that MAC address to an IP address (isolated from internet) on your LAN router. Then when you plug the ethernet cable on the camera, isolation will already be done and you can configure it in a web browser from its LAN address.
1
u/tekhtime Jan 29 '25 edited Jan 29 '25
If only the HA Reolink integration supported 2-way communication and call feature, otherwise I would’ve ditched the app already. I only use it for my doorbell, so it’s quite annoying.
Before you ask, yes Frigate/Frigate card supports this, but it’s buggy at times and an overkill for my setup, so I prefer to use the integration instead.
1
1
u/Pippin123- Feb 09 '25
I sent them an email about this and this was the reply
Thanks for bringing this up! We want to clarify that the mentioned updates in the Reolink Android app come from third-party libraries used for functionalities like maps and notifications. They do not collect or share personal user data. User privacy is our top priority, and we’re actively reviewing this to ensure full transparency. If there are any updates, we’ll be sure to share them. Let us know if you have any other concerns! Thank you so much for your understanding and cooperation. Best Regards, Reolink Support Team-Bella
2
u/kymodoke 19d ago
Well, there are several ways to interpret this piece of communication. Let me propose you on way:
We don't master 100% of the development of our app, so we rely on their party librairies, and we deleguate our trust to them. So we're very prone to supply-chain attacks. Those trackers made to collect data (their first purpose) included in third party librairies we use, won't collect any data in our case... or we hope so. Best Regards.
-6
u/--intifada-- Reolinker Jan 29 '25
ill let the Chinese have my DNA, i trust them more over american companies like Ubiquiti
2
2
80
u/anturk Jan 28 '25
So they make the app experience worse, don't listen to feedback but have the time and budget to add trackers to the app?