Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CloudPets teddy bears leaked and ransomed, exposing kids' voice messages

troyhunt.com

Post reply on HN
Print view View original

151–160 of 175 posts

Re: CloudPets teddy bears leaked and ransomed, exposing kids' voice messages

#151

Post by tclancy »

Mister_Snuggles wrote: post #24
simplemath wrote: post #8

IoT should die a swift and permanent death. Alas, that wont happen.

I'd love to see the INTERNET of Things be replaced by the INTRANET of Things. Remote access can be handled through a VPN, so there's no need for a remote server. I'm assuming that the device in question has computing hardware that's at least on par with a $9 CHIP. What's really needed is for secure and easy to set up VPNs (to connect back to your home network) to become a thing, then the remote access problems are ta…

I know HN frowns on this kind of thing, but you username gives me hope one of the CloudPets has gone sentient and is leading a revolution for IoT security. "Don't let what happened to me happen to you[r stuffed animal]!"

Re: CloudPets teddy bears leaked and ransomed, exposing kids' voice messages

#152

Post by hipitihop »

mulmen wrote: post #84
M_Grey wrote: post #82

Earlier quoted context omitted.

Meanwhile police in a murder case are preparing to take Amazon to court for Echo records. On the privacy front, there's just no saving people, but the IoT brings the magic of invading privacy together with furnishing botnets with millions of new bots! We're screwed coming and going, and the vast majority still look at you like a woodland hermit if you suggest that you shouldn't have anything listening to you in your…

I wonder how much infrastructure is really required to properly support Alexa like capabilities for an individual. Does Amazon really need all of our recordings on their hardware in their data centers? Is it conceivable that we could own that hardware as well? I realize that training data is important and I assume the recorded data gets used for that purpose but does Amazon need to keep it forever? How long do they n…

Although I would only consider this developer ready at the moment, ooen efforts like this have promise, at least you have choice what back end if any https://www.kickstarter.com/projects/seeed/respeaker-an-open...

Re: CloudPets teddy bears leaked and ransomed, exposing kids' voice messages

#154

Post by joncampbelldev »

wyager wrote: post #46
r1ch wrote: post #11

Earlier quoted context omitted.

The company was tanking and they were looking to make a quick buck. What market motivation would they have to spend extra time and money securing it properly? This is a fine example of why we need IOT regulation.

> This is a fine example of why we need IOT regulation. Cool, let's just inundate the industry with pointless government "security" checklists that don't actually accomplish anything. That way, instead of a small fraction of all the cool, affordable products we now have access to occasionally getting hacked, we can just not have any cool, affordable products except those made by companies big enough to hire enough co…

I'd be happy with regulations as basic as:

- use HTTPS

- no hardcoded security tokens in your requests

- any personal data stored is inaccessible to the outside world without AT LEAST a password

- minimum password length for users

just anything to slow the shitstorm combination of incompetent developers and corner cutting executives.

AND such regulations are reasonably easy to enforce, anyone can check network traffic to verify protocol and api tokens or setup a new account with a short password, port scanning would catch most public databases.

Re: CloudPets teddy bears leaked and ransomed, exposing kids' voice messages

#155

Post by jdbernard »

elorant wrote: post #119
mulmen wrote: post #83

Earlier quoted context omitted.

The fact that you allude to it suggests you can fathom it in some way. Maybe you don't want to but clearly bad actors can exploit insecure systems and that's especially easy from the inside.

Sure I can, but they're all unrealistic so no point mentioning them. We could for example start boycotting companies that don't take security seriously. But I'm afraid we'd end up with a very, very long list. Publicity can work wonders. You end-up with sensitive data for kids in the wild, possibly in the hands of perverts, nothing could work better than that in raising awareness for the general public. It's harsh, bu…

The problem is that it generates awareness based on raw emotion, and of course that always leads to rational, measured decision making. /s

On the other hand, I don't know any better idea either.

Re: CloudPets teddy bears leaked and ransomed, exposing kids' voice messages

#157

Post by Mister_Snuggles »

mulmen wrote: post #104
Mister_Snuggles wrote: post #99

Earlier quoted context omitted.

Apple is in a good position to do this. Unfortunately, they keep paring down their product line and I could reasonably see them dropping the Airport products. Maybe the OpenVPN guys can do it? They've got clients for every platform and seem to be present in some consumer-grade routers. Infrastructure-wise, iOS has on-demand VPN capability and I'm sure Android does too. All the pieces are there, the only thing it need…

There are a lot of details that have to be done right. Backups in the cloud still make a lot of sense but there need to be serious guarantees on the security of the backed up data. Decentralized backups could be a solution to this but come with their own problems like can you trust your cousin and brother in law to run servers as reliably as Amazon? I would love to see some of the features of iCloud moved into an Air…

I wouldn't advocate getting rid of "the cloud" in general, but I'd advocate rationalizing it.

For your examples:

- Backups - Agreed, these make sense and need the appropriate security guarantees.

- Siri - I can't think of anything it does that requires the voice recognition stuff to operate in the cloud. If this could all be done on-device, but with the ability to reach out to the cloud as required that would be cool.

- Maps - I'm torn. On one hand, it could be a local thing, but on the other hand there is a LOT of value added by it living in the cloud. Whenever my bus is moving slow, my first instinct is to pull up Google Maps and see where the accident is. It's shockingly accurate.

And some other stuff:

- File syncing/sharing (like Dropbox and friends) - Doesn't NEED to be a cloud service, this could be as simple as a USB hard drive attached to a router or as complex as a 12-bay NAS. What I'd love to see in this space is a universal API that app vendors can use - no more dealing with some apps that are Dropbox only when I want to use SugarSync or OneDrive etc. Then the storage provider would just provide an app that implements that API and everything that wants to store files in the cloud could use it.

- Email - I think what we have for email these days is really a great example of how things should work. Don't want to invest a lot of time and effort? Sign up for Gmail. You can use the web, or you can use a choice of native clients easily. Willing to put in the work? Buy a domain, get yourself a Digital Ocean droplet (or colocate a box - your choice!), and run your own.

Re: CloudPets teddy bears leaked and ransomed, exposing kids' voice messages

#158

Post by scott_karana »

atemerev wrote: post #118

I had a bear like that (not CloudPets, but looks like an exact clone). Thankfully, it was only used by my daughter with my supervision, so I know exactly what has been said. Unless the mic was enabled remotely, that is. I assumed that the security issues might be bad, but placing the voice on unsecured Mongo facing public Internet is beyond shit. Thankfully, I have disabled the bear long time ago. But now I worry abo…

"Always listening" is meaningless marketing drivel.

Anything with a microphone might always be listening, and you probably can't (easily) verify whether it's on-demand or not ;-)

Re: CloudPets teddy bears leaked and ransomed, exposing kids' voice messages

#159

Post by Houshalter »

M_Grey wrote: post #82
orf wrote: post #4

A guy I work with did a presentation on this product, he is big into reverse engineering bluetooth devices. I can assure you the toys themselves are just as insecure as apparently their infrastructure is. Seeing it light up and say "destroy all humans" was pretty funny, moreso because there is pretty much zero authentication on them so you could do it from anywhere from your mobile, and the mic can turn on and record…

Meanwhile police in a murder case are preparing to take Amazon to court for Echo records. On the privacy front, there's just no saving people, but the IoT brings the magic of invading privacy together with furnishing botnets with millions of new bots! We're screwed coming and going, and the vast majority still look at you like a woodland hermit if you suggest that you shouldn't have anything listening to you in your…

What's wrong with the police requesting Echo records? Surely the Echo records requests you make to it. No different than Google recording your search history. And it's pretty reasonable for the police to want to look at that in a murder case. And they got a warrant. I don't see anything sinister in this case at all.

Re: CloudPets teddy bears leaked and ransomed, exposing kids' voice messages

#160

Post by noonespecial »

simplemath wrote: post #75
komali2 wrote: post #61

Earlier quoted context omitted.

Seriously? That's a fairly aggressive comment to just throw out there without any backing arguments. You really can't think of anything valuable about hooking up small devices/sensors to the internet? Do you really believe the potential for stronger security is so low that it's not worth investigating? I work at an IoT company and we take security far more seriously than some would say is necessary or even reasonable…

>I work at an IoT company and we take security far more seriously than some would say is necessary or even reasonable. Then you are a member of a miniscule minority. The backing argument is a ballooning threat surface that can never reliably be patched

>a ballooning threat surface that can never reliably be patched

Some would convincingly describe Microsoft Windows the same way.

Post reply on HN