Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CloudPets teddy bears leaked and ransomed, exposing kids' voice messages

troyhunt.com

Post reply on HN
Print view View original

71–80 of 175 posts

Re: CloudPets teddy bears leaked and ransomed, exposing kids' voice messages

#71

Post by simcop2387 »

cm2187 wrote: post #69

> The Germans had a good point: kids' toys which record their voices and send the recordings up to the web pose some serious privacy risks. It's not that the risks are particularly any different to the ones you and I face every day with the volumes of data we produce and place online (and if you merely have a modern phone, that's precisely what you're doing), it's that our tolerances are very different when kids are…

I think it's possibly a bit more that we rationalize it as an adult because we can make a choice to give up the privacy or not. For a child they haven't developed mentally yet to understand that choice. That said I agree that the child has less potential for revealing information.

Re: CloudPets teddy bears leaked and ransomed, exposing kids' voice messages

#72

Post by ourmandave »

gavman wrote: post #13
dTal wrote: post #5

Okay, first of all: >the average parent.. is technically literate enough to know the wifi password but not savvy enough to understand how the "magic" of daddy talking to the kids through the bear (and vice versa) actually works [or] that every one of those recordings... is stored as an audio file on the web. If it is not considered amazingly stupid, or at least ignorant to not understand that the magic talking bear h…

> Hardly identity thief material. True, but potentially very dangerous material in other ways. It's not hard to image kidnappers piecing together stolen audio clips to create fake messages as part of a ransom attempt. Or scammers creating audio clips to scare parents and extract money. A large bank of audio clips from a child could be used against that child's family in all sorts of ways, especially if the parents do…

I don't understand. If I got a call in my daughter's voice saying "Help! I'm being held for ransom! Send all the bitcoins!" And then I call her phone and she answers or she walks in the door having gotten home from school, how is anyone going to collect on that?

Re: CloudPets teddy bears leaked and ransomed, exposing kids' voice messages

#73

Post by dTal »

hornbaker wrote: post #41
nobodyorother wrote: post #28

Earlier quoted context omitted.

Of course, when somebody releases a proof of concept, it'll be called RansomBear.

BearBleed.

I was gonna say "CloudBear", after Cloudflare, but it's basically already called that.

Maybe just avoid anything with "cloud" in the name?

Re: CloudPets teddy bears leaked and ransomed, exposing kids' voice messages

#74

Post by tiglionabbit »

cm2187 wrote: post #69

> The Germans had a good point: kids' toys which record their voices and send the recordings up to the web pose some serious privacy risks. It's not that the risks are particularly any different to the ones you and I face every day with the volumes of data we produce and place online (and if you merely have a modern phone, that's precisely what you're doing), it's that our tolerances are very different when kids are…

There's always the possibility that the toy overhears adults.

Re: CloudPets teddy bears leaked and ransomed, exposing kids' voice messages

#75

Post by simplemath »

komali2 wrote: post #61
simplemath wrote: post #8

IoT should die a swift and permanent death. Alas, that wont happen.

Seriously? That's a fairly aggressive comment to just throw out there without any backing arguments. You really can't think of anything valuable about hooking up small devices/sensors to the internet? Do you really believe the potential for stronger security is so low that it's not worth investigating? I work at an IoT company and we take security far more seriously than some would say is necessary or even reasonable…

>I work at an IoT company and we take security far more seriously than some would say is necessary or even reasonable.

Then you are a member of a miniscule minority.

The backing argument is a ballooning threat surface that can never reliably be patched

Re: CloudPets teddy bears leaked and ransomed, exposing kids' voice messages

#76

Post by dexwiz »

simcop2387 wrote: post #71
cm2187 wrote: post #69

> The Germans had a good point: kids' toys which record their voices and send the recordings up to the web pose some serious privacy risks. It's not that the risks are particularly any different to the ones you and I face every day with the volumes of data we produce and place online (and if you merely have a modern phone, that's precisely what you're doing), it's that our tolerances are very different when kids are…

I think it's possibly a bit more that we rationalize it as an adult because we can make a choice to give up the privacy or not. For a child they haven't developed mentally yet to understand that choice. That said I agree that the child has less potential for revealing information.

Even calling it a choice is rationalizing the loss of privacy. Most services are a binary choice of giving up privacy or not using the service. Some services can be done without, but many are required to operate in a modern society.

Re: CloudPets teddy bears leaked and ransomed, exposing kids' voice messages

#77

Post by ourmandave »

bigiain wrote: post #32
lvh wrote: post #9

Earlier quoted context omitted.

A device connecting to your WiFi could just be talking to devices on your network, not necessarily be sending all of your data to the Internet.

Sure - they _could_, but I've got lightbulbs and power switches that "helpfully" connect to some un branded Chinese "cloud" service - without any normal-user way to even know about it never mind turn it off. I suspect some of it is so I've got the amazingly useful (nb: may not be useful at all) feature of being able to turn my lounge room lights on and off from my phone while not at home. Cynical me suspects it's als…

Damn! Had to stop and double check the settings on my router firewall after reading Pessimist-You.

Re: CloudPets teddy bears leaked and ransomed, exposing kids' voice messages

#78

Post by mirimir »

cm2187 wrote: post #69

> The Germans had a good point: kids' toys which record their voices and send the recordings up to the web pose some serious privacy risks. It's not that the risks are particularly any different to the ones you and I face every day with the volumes of data we produce and place online (and if you merely have a modern phone, that's precisely what you're doing), it's that our tolerances are very different when kids are…

First, it's not just about "get [them] in trouble". Think about ten years later. Do we want adversaries to have logs of children's conversations?

Also, It's not just recordings. Once an adversary has account access, they can talk to children. I can't imagine that being a good thing.

Re: CloudPets teddy bears leaked and ransomed, exposing kids' voice messages

#79

Post by nickpsecurity »

Cyph0n wrote: post #56
0xfeba wrote: post #20

Earlier quoted context omitted.

The "S" in IoT stands for Security.

I took a grad course last semester where one of the groups analyzed a Nest cam and the other analyzed the Mother sensor device. Both were surprisingly quite secure, especially the Mother, which had security features all the way down the stack.

There's security features then assurance. Features without assurance of correctness are often bypassed. Im curious what was in those you talk about down the stack.

Re: CloudPets teddy bears leaked and ransomed, exposing kids' voice messages

#80

Post by deathanatos »

f_allwein wrote: post #66
Taek wrote: post #63

Is there a fine for this? Some sort of punishment? Companies need to be taking security seriously, we are all paying the price. Internet-of-Shit will remain exactly that until neglecting security is a substantial threat to the bottom line of a company. They ignored multiple warnings? Got hacked multiple times? This is negligence, and this company should be fined out of business.

Judging from other comments, it seems they're on the way out anyway. But the question of fines etc. is interesting...

The corporation might be, but this seems like the level of gross criminal negligence that a person should be held liable for.
Post reply on HN