CloudPets teddy bears leaked and ransomed, exposing kids' voice messages
1–10 of 175 posts
Re: CloudPets teddy bears leaked and ransomed, exposing kids' voice messages
#2Should we call this PetsBleed?
Re: CloudPets teddy bears leaked and ransomed, exposing kids' voice messages
#3Internet of bear poo.
Re: CloudPets teddy bears leaked and ransomed, exposing kids' voice messages
#4A guy I work with did a presentation on this product, he is big into reverse engineering bluetooth devices. I can assure you the toys themselves are just as insecure as apparently their infrastructure is.
Seeing it light up and say "destroy all humans" was pretty funny, moreso because there is pretty much zero authentication on them so you could do it from anywhere from your mobile, and the mic can turn on and record without any authentication at all.
sigh internet of things
Re: CloudPets teddy bears leaked and ransomed, exposing kids' voice messages
#5Okay, first of all:
>the average parent.. is technically literate enough to know the wifi password but not savvy enough to understand how the "magic" of daddy talking to the kids through the bear (and vice versa) actually works [or] that every one of those recordings... is stored as an audio file on the web.
If it is not considered amazingly stupid, or at least ignorant to not understand that the magic talking bear has a computer in it, and that if the computer wants the wifi password it probably uses the internet, and that if the entire purpose of the device is to make recordings available to you over the internet... then I despair. My sympathy for people who buy these sorts of products is wearing thin. But, in this particular instance...
>our tolerances are very different when kids are involved
Interesting. Why? The data is much less valuable:
>One little girl who sounded about the same age as my own 4-year old daughter left a message to her parents: "Hello mommy and daddy, I love you so much." Another one has her singing a short song, others have precisely the sorts of messages you'd expect a young child to share with her parents.
Hardly identity thief material.
Re: CloudPets teddy bears leaked and ransomed, exposing kids' voice messages
#6Oh god, it's a kids toy. It's meant to be something fun and cute. What a bunch of jerks to go messing around with that.
Re: CloudPets teddy bears leaked and ransomed, exposing kids' voice messages
#7Oh god, it's a kids toy. It's meant to be something fun and cute. What a bunch of jerks to go messing around with that.
How about 'what a bunch of jerks to connect it to the internet and not secure it properly'?
Re: CloudPets teddy bears leaked and ransomed, exposing kids' voice messages
#8IoT should die a swift and permanent death.
Alas, that wont happen.
Re: CloudPets teddy bears leaked and ransomed, exposing kids' voice messages
#9Okay, first of all: >the average parent.. is technically literate enough to know the wifi password but not savvy enough to understand how the "magic" of daddy talking to the kids through the bear (and vice versa) actually works [or] that every one of those recordings... is stored as an audio file on the web. If it is not considered amazingly stupid, or at least ignorant to not understand that the magic talking bear h…
A device connecting to your WiFi could just be talking to devices on your network, not necessarily be sending all of your data to the Internet.
Re: CloudPets teddy bears leaked and ransomed, exposing kids' voice messages
#10For anyone who is coming straight to the comments before reading the article: the details are even worse than the headline suggests.
Not only was a huge amount of information exposed through a public, unauthenticated MongoDB instance, and not only did CloudPets ignore multiple security researchers' attempts to alert them to the problem, but the database was actually held for ransom multiple times without customers being alerted to the breach.