11–20 of 175 posts
Oh god, it's a kids toy. It's meant to be something fun and cute. What a bunch of jerks to go messing around with that.
How about 'what a bunch of jerks to connect it to the internet and not secure it properly'?
For anyone who is coming straight to the comments before reading the article: the details are even worse than the headline suggests. Not only was a huge amount of information exposed through a public, unauthenticated MongoDB instance, and not only did CloudPets ignore multiple security researchers' attempts to alert them to the problem, but the database was actually held for ransom multiple times without customers be…
Okay, first of all: >the average parent.. is technically literate enough to know the wifi password but not savvy enough to understand how the "magic" of daddy talking to the kids through the bear (and vice versa) actually works [or] that every one of those recordings... is stored as an audio file on the web. If it is not considered amazingly stupid, or at least ignorant to not understand that the magic talking bear h…
True, but potentially very dangerous material in other ways. It's not hard to image kidnappers piecing together stolen audio clips to create fake messages as part of a ransom attempt. Or scammers creating audio clips to scare parents and extract money. A large bank of audio clips from a child could be used against that child's family in all sorts of ways, especially if the parents don't know the clips were stolen to begin with.
Earlier quoted context omitted.
How about 'what a bunch of jerks to connect it to the internet and not secure it properly'?
The company was tanking and they were looking to make a quick buck. What market motivation would they have to spend extra time and money securing it properly? This is a fine example of why we need IOT regulation.
Earlier quoted context omitted.
How about 'what a bunch of jerks to connect it to the internet and not secure it properly'?
The company was tanking and they were looking to make a quick buck. What market motivation would they have to spend extra time and money securing it properly? This is a fine example of why we need IOT regulation.
Okay, first of all: >the average parent.. is technically literate enough to know the wifi password but not savvy enough to understand how the "magic" of daddy talking to the kids through the bear (and vice versa) actually works [or] that every one of those recordings... is stored as an audio file on the web. If it is not considered amazingly stupid, or at least ignorant to not understand that the magic talking bear h…
It's the why-do-I-care-about-my-privacy argument - but it's even more personal now, because it's not just you, it's your kids.
There's always that extra creep factor when it comes to children.
Earlier quoted context omitted.
The company was tanking and they were looking to make a quick buck. What market motivation would they have to spend extra time and money securing it properly? This is a fine example of why we need IOT regulation.
and people wonder why medical and aerospace companies are highly regulated :-)
The regulators have so far been focused on the health aspects of the devices.
A guy I work with did a presentation on this product, he is big into reverse engineering bluetooth devices. I can assure you the toys themselves are just as insecure as apparently their infrastructure is. Seeing it light up and say "destroy all humans" was pretty funny, moreso because there is pretty much zero authentication on them so you could do it from anywhere from your mobile, and the mic can turn on and record…