Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CloudPets teddy bears leaked and ransomed, exposing kids' voice messages

troyhunt.com

Post reply on HN
Print view View original

41–50 of 175 posts

Re: CloudPets teddy bears leaked and ransomed, exposing kids' voice messages

#41

Post by hornbaker »

nobodyorother wrote: post #28
gavman wrote: post #13

Earlier quoted context omitted.

> Hardly identity thief material. True, but potentially very dangerous material in other ways. It's not hard to image kidnappers piecing together stolen audio clips to create fake messages as part of a ransom attempt. Or scammers creating audio clips to scare parents and extract money. A large bank of audio clips from a child could be used against that child's family in all sorts of ways, especially if the parents do…

Of course, when somebody releases a proof of concept, it'll be called RansomBear.

BearBleed.

Re: CloudPets teddy bears leaked and ransomed, exposing kids' voice messages

#42

Post by Eridrus »

gavman wrote: post #13
dTal wrote: post #5

Okay, first of all: >the average parent.. is technically literate enough to know the wifi password but not savvy enough to understand how the "magic" of daddy talking to the kids through the bear (and vice versa) actually works [or] that every one of those recordings... is stored as an audio file on the web. If it is not considered amazingly stupid, or at least ignorant to not understand that the magic talking bear h…

> Hardly identity thief material. True, but potentially very dangerous material in other ways. It's not hard to image kidnappers piecing together stolen audio clips to create fake messages as part of a ransom attempt. Or scammers creating audio clips to scare parents and extract money. A large bank of audio clips from a child could be used against that child's family in all sorts of ways, especially if the parents do…

If we assume that you can actually scare the parents into paying a ransom, in the end the impact is... a lot of stress + financial loss. And this assumes that the parents can't get in contact with the kid, the police can't get in contact with the kid and the scammers have enough savvy to accept untraceable money. All of which points to this being more of a movie plot than something that will happen in reality.

And even if this were a credible threat, logically we should be more concerned about direct financial theft since it has the same impact, but is far less elaborate (but still far less common than other types of cybercrime).

Re: CloudPets teddy bears leaked and ransomed, exposing kids' voice messages

#43

Post by pdjstone »

orf wrote: post #4

A guy I work with did a presentation on this product, he is big into reverse engineering bluetooth devices. I can assure you the toys themselves are just as insecure as apparently their infrastructure is. Seeing it light up and say "destroy all humans" was pretty funny, moreso because there is pretty much zero authentication on them so you could do it from anywhere from your mobile, and the mic can turn on and record…

I'll be putting out our blog post about this first thing tomorrow (we had it ready to go for next week, but I think now's a good time to add some fuel to the fire). Essentially the toy uses Bluetooth LE very insecurely and it has a speaker and a microphone. Guess what happens next?

Edit: Demo of the CloudPets functionality using Web Bluetooth https://github.com/pdjstone/cloudpets-web-bluetooth/

Re: CloudPets teddy bears leaked and ransomed, exposing kids' voice messages

#44

Post by lcw »

orf wrote: post #4

A guy I work with did a presentation on this product, he is big into reverse engineering bluetooth devices. I can assure you the toys themselves are just as insecure as apparently their infrastructure is. Seeing it light up and say "destroy all humans" was pretty funny, moreso because there is pretty much zero authentication on them so you could do it from anywhere from your mobile, and the mic can turn on and record…

I do agree that lots of IoT products have terrible security, but is having insecure bluetooth or the likes really a terrible thing for most of these types of products?

I understand that this leak is related to mongodb... and that is terrible, but mostly referring to your bluetooth example.

I mean take bluetooth headphones they are notoriously insecure, but the range in which eavesdropping could take place is pretty small, and for most of us you would just be eavesdropping on our annoying music. Seems reasonable that they save bandwidth on secure transmission of data for higher audio quality. That said I could see an argument the other way, but I'm sure there are more examples where it doesn't seem like a big deal. It would be interesting to hear from someone who thinks I'm dead wrong.

Re: CloudPets teddy bears leaked and ransomed, exposing kids' voice messages

#45

Post by nitemice »

rm_-rf_slash wrote: post #21
gavman wrote: post #13

Earlier quoted context omitted.

> Hardly identity thief material. True, but potentially very dangerous material in other ways. It's not hard to image kidnappers piecing together stolen audio clips to create fake messages as part of a ransom attempt. Or scammers creating audio clips to scare parents and extract money. A large bank of audio clips from a child could be used against that child's family in all sorts of ways, especially if the parents do…

Or worse, they could train a neural network to mimic the child's voice and create a fake message to send to the police alleging child abuse, with a ransom note at the end - in the child's voice.

You don't even need it. Adobe's working on a product that allows you to make a voice say whatever you want, using 20 min worth of voice samples. [1](https://arstechnica.com/information-technology/2016/11/adobe...)

Re: CloudPets teddy bears leaked and ransomed, exposing kids' voice messages

#46

Post by wyager »

r1ch wrote: post #11
Scott_Helme_ wrote: post #7

Earlier quoted context omitted.

How about 'what a bunch of jerks to connect it to the internet and not secure it properly'?

The company was tanking and they were looking to make a quick buck. What market motivation would they have to spend extra time and money securing it properly? This is a fine example of why we need IOT regulation.

> This is a fine example of why we need IOT regulation.

Cool, let's just inundate the industry with pointless government "security" checklists that don't actually accomplish anything. That way, instead of a small fraction of all the cool, affordable products we now have access to occasionally getting hacked, we can just not have any cool, affordable products except those made by companies big enough to hire enough corporate lawyers to CYA their way to government approval.

How about, if you care so much about teddy bears getting owned, you just don't buy them? It's easier and more polite than taking them away from everyone else as well.

You can't legislate security into existence. That's not how it works. Security isn't a solved problem, so the government can't force people to do it correctly. The only think you can possibly accomplish is either making products more expensive (with no/negligible actual security benefit) or removing them from the market entirely.

Re: CloudPets teddy bears leaked and ransomed, exposing kids' voice messages

#47

Post by LeifCarrotson »

lcw wrote: post #44
orf wrote: post #4

A guy I work with did a presentation on this product, he is big into reverse engineering bluetooth devices. I can assure you the toys themselves are just as insecure as apparently their infrastructure is. Seeing it light up and say "destroy all humans" was pretty funny, moreso because there is pretty much zero authentication on them so you could do it from anywhere from your mobile, and the mic can turn on and record…

I do agree that lots of IoT products have terrible security, but is having insecure bluetooth or the likes really a terrible thing for most of these types of products? I understand that this leak is related to mongodb... and that is terrible, but mostly referring to your bluetooth example. I mean take bluetooth headphones they are notoriously insecure, but the range in which eavesdropping could take place is pretty s…

> Seems reasonable that they save bandwidth on secure transmission of data for higher audio quality.

Encrypting a compressed audio stream does not add to the bandwidth, aside from the initial key negotiation.

Furthermore, the bandwidth required for audio of a quality that's indiscernible from the original is negligible when compared to the bandwidth of Bluetooth radios. Ridiculously good audio is 320 kbps, and Bluetooth is easily good for 25 Mbps.

I suppose you could argue that the battery power used to perform this computation is the limiting factor, but a good embedded DSP used to perform the recording and transmission typically have tiny power requirements and hardware encryption routines that don't significantly change the power requirements of the device, as compared to keeping a blue LED blinking or powering an earbud speaker.

No, let's be honest here. The actual limiting factor is engineering time and money that goes into developing these devices as quick and cheaply as possible.

Re: CloudPets teddy bears leaked and ransomed, exposing kids' voice messages

#48

Post by nvarsj »

teraflop wrote: post #10

For anyone who is coming straight to the comments before reading the article: the details are even worse than the headline suggests. Not only was a huge amount of information exposed through a public, unauthenticated MongoDB instance, and not only did CloudPets ignore multiple security researchers' attempts to alert them to the problem, but the database was actually held for ransom multiple times without customers be…

This is _insane_. My daughter got a surprise cloudpet for her birthday from a distant relative. The app you have to use with the cloudpet is also filled with ads, some of which are of adult nature. This company is sleazy as hell. I hope they get sued out of existence.

Re: CloudPets teddy bears leaked and ransomed, exposing kids' voice messages

#49

Post by caf »

dTal wrote: post #5

Okay, first of all: >the average parent.. is technically literate enough to know the wifi password but not savvy enough to understand how the "magic" of daddy talking to the kids through the bear (and vice versa) actually works [or] that every one of those recordings... is stored as an audio file on the web. If it is not considered amazingly stupid, or at least ignorant to not understand that the magic talking bear h…

Interesting. Why? The data is much less valuable:

Because while we can make an informed decision about putting our own data into such a service, weighing up the risks and benefits, a four year old cannot - a parent is making that decision for them, and when you are making such a decision on behalf of someone else it behooves you to act more conservatively than when deciding on your own behalf.

Re: CloudPets teddy bears leaked and ransomed, exposing kids' voice messages

#50

Post by lazyasciiart »

nvarsj wrote: post #48
teraflop wrote: post #10

For anyone who is coming straight to the comments before reading the article: the details are even worse than the headline suggests. Not only was a huge amount of information exposed through a public, unauthenticated MongoDB instance, and not only did CloudPets ignore multiple security researchers' attempts to alert them to the problem, but the database was actually held for ransom multiple times without customers be…

This is _insane_. My daughter got a surprise cloudpet for her birthday from a distant relative. The app you have to use with the cloudpet is also filled with ads, some of which are of adult nature. This company is sleazy as hell. I hope they get sued out of existence.

They basically failed out of existence before this even happened (the article includes details on their share price sliding to nothing earlier last year), which is probably one reason they didn't bother telling customers about it. This is probably the best example I've ever seen of the dangers of trying to keep a service running once the company behind it has gone under.
Post reply on HN