Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CloudPets teddy bears leaked and ransomed, exposing kids' voice messages

troyhunt.com

Post reply on HN
Print view View original

81–90 of 175 posts

Re: CloudPets teddy bears leaked and ransomed, exposing kids' voice messages

#81

Post by kageneko »

cm2187 wrote: post #69

> The Germans had a good point: kids' toys which record their voices and send the recordings up to the web pose some serious privacy risks. It's not that the risks are particularly any different to the ones you and I face every day with the volumes of data we produce and place online (and if you merely have a modern phone, that's precisely what you're doing), it's that our tolerances are very different when kids are…

Yeah, I'm not worried about my kid saying things that will get him in trouble. However... he repeats literally everything that he hears, sometimes verbatim. Sometimes hours or days layer. To be honest, it's really creepy at times. Plus, he doesn't really have a filter, so he'll talk about everything he sees at school or on the playground, just chattering about all day to himself.

So I'm worried about my kid saying things that could get other people into trouble.

Re: CloudPets teddy bears leaked and ransomed, exposing kids' voice messages

#82

Post by M_Grey »

orf wrote: post #4

A guy I work with did a presentation on this product, he is big into reverse engineering bluetooth devices. I can assure you the toys themselves are just as insecure as apparently their infrastructure is. Seeing it light up and say "destroy all humans" was pretty funny, moreso because there is pretty much zero authentication on them so you could do it from anywhere from your mobile, and the mic can turn on and record…

Meanwhile police in a murder case are preparing to take Amazon to court for Echo records. On the privacy front, there's just no saving people, but the IoT brings the magic of invading privacy together with furnishing botnets with millions of new bots!

We're screwed coming and going, and the vast majority still look at you like a woodland hermit if you suggest that you shouldn't have anything listening to you in your home.

Re: CloudPets teddy bears leaked and ransomed, exposing kids' voice messages

#83

Post by mulmen »

elorant wrote: post #55
Crosseye_Jack wrote: post #30

Earlier quoted context omitted.

Some of us do give a shit about security. It's just a shame that it feels like we are the exception to the rule.

We do because we realize what the lack of it entails. So will the general public, eventually. And the only way to get there is if more cases like this start happening. It's a shame they have to learn the hard way but there's no other way. That, or we as an industry act up (in ways I can't even fathom).

The fact that you allude to it suggests you can fathom it in some way. Maybe you don't want to but clearly bad actors can exploit insecure systems and that's especially easy from the inside.

Re: CloudPets teddy bears leaked and ransomed, exposing kids' voice messages

#84

Post by mulmen »

M_Grey wrote: post #82
orf wrote: post #4

A guy I work with did a presentation on this product, he is big into reverse engineering bluetooth devices. I can assure you the toys themselves are just as insecure as apparently their infrastructure is. Seeing it light up and say "destroy all humans" was pretty funny, moreso because there is pretty much zero authentication on them so you could do it from anywhere from your mobile, and the mic can turn on and record…

Meanwhile police in a murder case are preparing to take Amazon to court for Echo records. On the privacy front, there's just no saving people, but the IoT brings the magic of invading privacy together with furnishing botnets with millions of new bots! We're screwed coming and going, and the vast majority still look at you like a woodland hermit if you suggest that you shouldn't have anything listening to you in your…

I wonder how much infrastructure is really required to properly support Alexa like capabilities for an individual. Does Amazon really need all of our recordings on their hardware in their data centers? Is it conceivable that we could own that hardware as well?

I realize that training data is important and I assume the recorded data gets used for that purpose but does Amazon need to keep it forever? How long do they need it? Can I own and posses the hardware and pass off the learning alone?

Re: CloudPets teddy bears leaked and ransomed, exposing kids' voice messages

#85

Post by mulmen »

mirimir wrote: post #78
cm2187 wrote: post #69

> The Germans had a good point: kids' toys which record their voices and send the recordings up to the web pose some serious privacy risks. It's not that the risks are particularly any different to the ones you and I face every day with the volumes of data we produce and place online (and if you merely have a modern phone, that's precisely what you're doing), it's that our tolerances are very different when kids are…

First, it's not just about "get [them] in trouble". Think about ten years later. Do we want adversaries to have logs of children's conversations? Also, It's not just recordings. Once an adversary has account access, they can talk to children. I can't imagine that being a good thing.

Additionally, what benefit do we have to gain by preserving these recordings? The whole thing seems massively risky for no reason other than to make a few bucks.

Re: CloudPets teddy bears leaked and ransomed, exposing kids' voice messages

#86

Post by mulmen »

ourmandave wrote: post #72
gavman wrote: post #13

Earlier quoted context omitted.

> Hardly identity thief material. True, but potentially very dangerous material in other ways. It's not hard to image kidnappers piecing together stolen audio clips to create fake messages as part of a ransom attempt. Or scammers creating audio clips to scare parents and extract money. A large bank of audio clips from a child could be used against that child's family in all sorts of ways, especially if the parents do…

I don't understand. If I got a call in my daughter's voice saying "Help! I'm being held for ransom! Send all the bitcoins!" And then I call her phone and she answers or she walks in the door having gotten home from school, how is anyone going to collect on that?

I might watch too many spy movies but maybe they wait for a time she will be away from her phone, like the camping trip she has been talking about for weeks or a school field trip that can be easily learned and googled from conversations about class or sports competitions based on googling team names. These are all things that are likely to come up in regular, routine conversation.

The real question is why you wouldn't already be terrified about having a microphone in your house that is open to the internet.

Re: CloudPets teddy bears leaked and ransomed, exposing kids' voice messages

#87

Post by pessimizer »

Crosseye_Jack wrote: post #30
0xfeba wrote: post #20

Earlier quoted context omitted.

The "S" in IoT stands for Security.

Some of us do give a shit about security. It's just a shame that it feels like we are the exception to the rule.

Computer/network security will never be important until governments start regulating this stuff through specialized agencies. It's the opposite of profitable to care, so businesses who do care are disadvantaged.

Re: CloudPets teddy bears leaked and ransomed, exposing kids' voice messages

#88

Post by mulmen »

nitemice wrote: post #45
rm_-rf_slash wrote: post #21

Earlier quoted context omitted.

Or worse, they could train a neural network to mimic the child's voice and create a fake message to send to the police alleging child abuse, with a ransom note at the end - in the child's voice.

You don't even need it. Adobe's working on a product that allows you to make a voice say whatever you want, using 20 min worth of voice samples. [1]( https://arstechnica.com/information-technology/2016/11/adobe... )

Their ability to do harm with Flash has been limited so they had to branch out.

Really though this is pretty cool, when not used for nefarious purposes.

Re: CloudPets teddy bears leaked and ransomed, exposing kids' voice messages

#89

Post by callalex »

deathanatos wrote: post #80
f_allwein wrote: post #66

Earlier quoted context omitted.

Judging from other comments, it seems they're on the way out anyway. But the question of fines etc. is interesting...

The corporation might be, but this seems like the level of gross criminal negligence that a person should be held liable for.

I'm not necessarily disagreeing but that seems fundamentally opposed to the way a LLC works.

Re: CloudPets teddy bears leaked and ransomed, exposing kids' voice messages

#90

Post by ams6110 »

dTal wrote: post #5

Okay, first of all: >the average parent.. is technically literate enough to know the wifi password but not savvy enough to understand how the "magic" of daddy talking to the kids through the bear (and vice versa) actually works [or] that every one of those recordings... is stored as an audio file on the web. If it is not considered amazingly stupid, or at least ignorant to not understand that the magic talking bear h…

If it is not considered amazingly stupid, or at least ignorant to not understand that the magic talking bear has a computer in it, and that if the computer wants the wifi password it probably uses the internet, and that if the entire purpose of the device is to make recordings available to you over the internet... then I despair.

I think you vastly overestimate the degree to which non-technical consumers understand computers, wifi, the internet, email, web sites, apps on their phone, and the differences and boundaries between any of those.

Post reply on HN