Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CloudPets teddy bears leaked and ransomed, exposing kids' voice messages

troyhunt.com

Post reply on HN
Print view View original

141–150 of 175 posts

Re: CloudPets teddy bears leaked and ransomed, exposing kids' voice messages

#141

Post by vidarh »

janwillemb wrote: post #68

Apart from the total disaster these kind of incidents are, they serve a valuable purpose: material to educate my children about security. It is surprising to see how quickly my 9-year old daughter picks up the message, especially by these kind of stories.

My 7 year old son is rapidly becoming far more hostile to anything from ads to privacy invasions because it is simply making up a far bigger part of his life than it does for me.

I wonder how children learning about these things from such a young age will play out once they're gron up.

Re: CloudPets teddy bears leaked and ransomed, exposing kids' voice messages

#143

Post by marksomnian »

AstralStorm wrote: post #31
mattbgates wrote: post #18

Companies have to get more involved in actually encrypting their data before entering it into the database. For every web app I create, especially when sensitive information is exposed, I try to encrypt as much data as possible. With all the leaks and hacks.. it only makes sense to add some encryption method in there.

Encryption does nothing if you can just query the decrypted data. Other than giving a false sense of security. Even if the database is encrypted, something has to access the decrypted data and is vulnerable to attack.

If you do the decryption in your business logic, and store the key separately (Amazon KMS for example), then if somebody hacks the database directly the data is (slightly more) secure.

Agreed though. Encryption is only a stopgap and the DB should never have been public in the first place.

Re: CloudPets teddy bears leaked and ransomed, exposing kids' voice messages

#144

Post by shostack »

lazyasciiart wrote: post #50
nvarsj wrote: post #48

Earlier quoted context omitted.

This is _insane_. My daughter got a surprise cloudpet for her birthday from a distant relative. The app you have to use with the cloudpet is also filled with ads, some of which are of adult nature. This company is sleazy as hell. I hope they get sued out of existence.

They basically failed out of existence before this even happened (the article includes details on their share price sliding to nothing earlier last year), which is probably one reason they didn't bother telling customers about it. This is probably the best example I've ever seen of the dangers of trying to keep a service running once the company behind it has gone under.

Why did they fail aside from security issues?

Re: CloudPets teddy bears leaked and ransomed, exposing kids' voice messages

#145

Post by porker »

TeMPOraL wrote: post #127
mattbgates wrote: post #18

Companies have to get more involved in actually encrypting their data before entering it into the database. For every web app I create, especially when sensitive information is exposed, I try to encrypt as much data as possible. With all the leaks and hacks.. it only makes sense to add some encryption method in there.

The real issue is, companies should not touch, and especially not store data unless absolutely necessary, and only store it for as long as it's needed and not longer. There is a German word for that. Datensparsamkeit. https://martinfowler.com/bliki/Datensparsamkeit.html Actually, and probably for the first time ever, I completely agree with Fowler: "Datensparsamkeit isn't just about bad people stealing data, it's als…

> Actually, and probably for the first time ever, I completely agree with Fowler

Upvoting you just for that. <3

Re: CloudPets teddy bears leaked and ransomed, exposing kids' voice messages

#147

Post by Xylakant »

po wrote: post #133
Xylakant wrote: post #129

Earlier quoted context omitted.

Which totally would not have helped in this case: using https would still have left the DB exposed.

It doesn't help the server side data leak but at least you can't connect to it and make it say 'destroy all humans'

That's not necessarily the case. TLS protects the connection, but by default does not provide authentication. I also see a lot of instances where certificate checking has been disabled, so that the client just ignores a MitM attack. So with TLS it would seem more secure at first glance, but given the implementation blunders here I wouldn't expect any real improvement.

Re: CloudPets teddy bears leaked and ransomed, exposing kids' voice messages

#148

Post by croon »

gurkendoktor wrote: post #108
kageneko wrote: post #81

Earlier quoted context omitted.

Yeah, I'm not worried about my kid saying things that will get him in trouble. However... he repeats literally everything that he hears, sometimes verbatim. Sometimes hours or days layer. To be honest, it's really creepy at times. Plus, he doesn't really have a filter, so he'll talk about everything he sees at school or on the playground, just chattering about all day to himself. So I'm worried about my kid saying th…

A common anecdote from East Germany is that teachers would ask children what the "sandman" looks like (an evening TV show for children). The seemingly harmless answer then revealed whether their parents secretly watched imperialist West-German television. So yeah, children are pretty good at implicating other people. (No real source, but a random German article that quotes this anecdote: http://www.badische-zeitung.d…

More innocuous example:

I remember when being a kid in school, the police were by for a visit to educate on alcohol responsibility, and touching on ethanol/methanol dangers since moonshine was a thing, they showed a distiller (which "if clearly meant for distilling spirits" is illegal to own), and some kid blurted out "my dad has one of those!" immediately when seeing it.

The teacher tried to claim "teacher-parent confidentiality" when asked to identify the kid/parents as if that's a thing, but I don't think they took it seriously enough to warrant further action.

Nevertheless; yeah, kids say everything.

Re: CloudPets teddy bears leaked and ransomed, exposing kids' voice messages

#149

Post by nkrisc »

ourmandave wrote: post #72
gavman wrote: post #13

Earlier quoted context omitted.

> Hardly identity thief material. True, but potentially very dangerous material in other ways. It's not hard to image kidnappers piecing together stolen audio clips to create fake messages as part of a ransom attempt. Or scammers creating audio clips to scare parents and extract money. A large bank of audio clips from a child could be used against that child's family in all sorts of ways, especially if the parents do…

I don't understand. If I got a call in my daughter's voice saying "Help! I'm being held for ransom! Send all the bitcoins!" And then I call her phone and she answers or she walks in the door having gotten home from school, how is anyone going to collect on that?

In your contrived scenario meant to defeat the premise, no, it won't work. However there are basically limitless ways this data could potentially be exploited. The point is they don't need to even do it now, it could happen any time. Data doesn't just go away.

Re: CloudPets teddy bears leaked and ransomed, exposing kids' voice messages

#150

Post by tclancy »

shostack wrote: post #146

Non-engineer here... What is the significance of this being Mongo vs any other poorly/unsecured DB?

I don't know that it's Mongo-specific, it's more that newer storage engines, in an effort to be user-friendly, shoot to essentially be zero-configuration out-of-the-box. You install it, run the daemon and can immediately connect so you get that positive feedback the engine is easy to work with. This typically means there's no username/ password required and it's listening on its port to all responses (inside and outside whatever firewall you have). So you start it, connect to see that it works and think, "I should really secure this like it says in passing in the docs, but let me try a couple more things first". All of a sudden it's three weeks later, your MVP is ready to launch and the username/ password has been forgotten.

Other stores may let you get away with setting up "root/ root" or "admin/ password" but at least they have forced you to think about setting up some security. It's a trade-off, but it's a crappy one IMHO. There's no risk to Mongo, et al: they told you to set up security but didn't force you because they want you to pick their product.

Post reply on HN