Data from Police Body Camera Apps Routed to Chinese Cloud Servers Over TLS Port 9091

According to brownfinesecurity[.]com, a budget-friendly body camera system’s companion mobile app, Viidure, transmits sensitive device identifiers and user data to cloud servers based in China over a nonstandard TLS port. The investigation found the most noteworthy endpoint to be app-api.lufengzhe[.]com:9091, which WHOIS records tie to Huawei International Pte. Ltd. in China, and the app also communicates over standard TLS port 443 to Baidu mapping services for geolocation features.

A man-in-the-middle analysis showed TLS validation within Viidure was inadequate, with an attack proxy able to intercept and log HTTP contents, including a version-check request that exfiltrated the device’s IMEI and the operator’s email address in a JSON payload. These findings raise concerns about data privacy, chain-of-custody, and potential data-sovereignty violations if footage and metadata are exposed or manipulated.

The article emphasises the need for robust certificate pinning and restricted server locations, noting the risk of foreign government surveillance and unauthorised access to video-management commands. Agencies should demand transparency and independent security audits from vendors to safeguard evidentiary integrity.