15 ms·
CloudPets teddy bears leaked and ransomed, exposing kids' voice messages
- snug 10y agoShould we call this PetsBleed?
- bbcbasic 10y agoNo. CloudBleed was insult enough to the "Bleed" suffix. This is taking it too far.
- chinathrow 10y agoInternet of bear poo.
- orf 10y agoA guy I work with did a presentation on this product, he is big into reverse engineering bluetooth devices. I can assure you the toys themselves are just as insecure as apparently their infrastructure is. Seeing it light up and say "destroy all humans" was pretty funny, moreso because there is pretty much zero authentication on them so you could do it from anywhere from your mobile, and the mic can turn on and record without any authentication at all. sigh internet of things
- 0xfeba 10y agoThe "S" in IoT stands for Security.
- salesguy222 10y agoHahaha i spent a good 3 minutes looking for where the S was, until the joke hit me
- jgamman 10y agoshouldn't that be 'SH' ?
- Crosseye_Jack 10y agoSome of us do give a shit about security. It's just a shame that it feels like we are the exception to the rule.
- elorant 10y agoWe do because we realize what the lack of it entails. So will the general public, eventually. And the only way to get there is if more cases like this start happening. It's a shame they have to learn the hard way but there's no other way. That, or we as an industry act up (in ways I can't even fathom).
- mulmen 10y agoThe fact that you allude to it suggests you can fathom it in some way. Maybe you don't want to but clearly bad actors can exploit insecure systems and that's especially easy from the inside.
- elorant 10y agoSure I can, but they're all unrealistic so no point mentioning them. We could for example start boycotting companies that don't take security seriously. But I'm afraid we'd end up with a very, very long list. Publicity can work wonders. You end-up with sensitive data for kids in the wild, possibly in the hands of perverts, nothing could work better than that in raising awareness for the general public. It's harsh, but it fucking works. So we'll stick with it for now, unless someone comes with a better idea.
- jdbernard 10y agoThe problem is that it generates awareness based on raw emotion, and of course that always leads to rational, measured decision making. /s On the other hand, I don't know any better idea either.
- otakucode 10y agoLawsuits for criminal negligence against the CEOs of the companies themselves would be a damn good start. Their business practices are why these problems happen. They cut every corner they can find, put business school grads in charge of deciding schedules and resource allocation to engineering, and make sure that if an engineer says 'we need more time and testing' that any low-level manager can tell them business goals come first.
- Cyph0n 10y agoI took a grad course last semester where one of the groups analyzed a Nest cam and the other analyzed the Mother sensor device. Both were surprisingly quite secure, especially the Mother, which had security features all the way down the stack.
- nickpsecurity 10y agoThere's security features then assurance. Features without assurance of correctness are often bypassed. Im curious what was in those you talk about down the stack.
- AndonAndonov 10y agoOne of my professors worked on the key exchange protocol [0], used in Nest. When discussing that particular point, he was very complimentary of Google's security practices, especially when it comes to Nest. [0] https://blogs.ncl.ac.uk/security/2015/07/28/j-pake-built-into-google-nest-thermostats/ https://blogs.ncl.ac.uk/security/2015/07/28/j-pake-built-int...
- conradev 10y agoI like Apple's approach, where HomeKit certification requires that the device use some form of secure transport to communicate with iOS.
- Xylakant 10y agoWhich totally would not have helped in this case: using https would still have left the DB exposed.
- po 10y agoIt doesn't help the server side data leak but at least you can't connect to it and make it say 'destroy all humans'
- Xylakant 10y agoThat's not necessarily the case. TLS protects the connection, but by default does not provide authentication. I also see a lot of instances where certificate checking has been disabled, so that the client just ignores a MitM attack. So with TLS it would seem more secure at first glance, but given the implementation blunders here I wouldn't expect any real improvement.
- po 10y agoYeah that's true, I'm totally assuming 'competently implemented TLS' when I say it would protect the connection.
- walrus01 10y agoReading and fully comprehending the full contents and implications of https://twitter.com/internetofshit https://twitter.com/internetofshit should be required for anyone who is thinking about making an IOT type device.
- pdjstone 10y agoI'll be putting out our blog post about this first thing tomorrow (we had it ready to go for next week, but I think now's a good time to add some fuel to the fire). Essentially the toy uses Bluetooth LE very insecurely and it has a speaker and a microphone. Guess what happens next? Edit: Demo of the CloudPets functionality using Web Bluetooth https://github.com/pdjstone/cloudpets-web-bluetooth/ https://github.com/pdjstone/cloudpets-web-bluetooth/
- lcw 10y agoI do agree that lots of IoT products have terrible security, but is having insecure bluetooth or the likes really a terrible thing for most of these types of products? I understand that this leak is related to mongodb... and that is terrible, but mostly referring to your bluetooth example. I mean take bluetooth headphones they are notoriously insecure, but the range in which eavesdropping could take place is pretty small, and for most of us you would just be eavesdropping on our annoying music. Seems reasonable that they save bandwidth on secure transmission of data for higher audio quality. That said I could see an argument the other way, but I'm sure there are more examples where it doesn't seem like a big deal. It would be interesting to hear from someone who thinks I'm dead wrong.
- LeifCarrotson 10y ago> Seems reasonable that they save bandwidth on secure transmission of data for higher audio quality. Encrypting a compressed audio stream does not add to the bandwidth, aside from the initial key negotiation. Furthermore, the bandwidth required for audio of a quality that's indiscernible from the original is negligible when compared to the bandwidth of Bluetooth radios. Ridiculously good audio is 320 kbps, and Bluetooth is easily good for 25 Mbps. I suppose you could argue that the battery power used to perform this computation is the limiting factor, but a good embedded DSP used to perform the recording and transmission typically have tiny power requirements and hardware encryption routines that don't significantly change the power requirements of the device, as compared to keeping a blue LED blinking or powering an earbud speaker. No, let's be honest here. The actual limiting factor is engineering time and money that goes into developing these devices as quick and cheaply as possible.
- lcw 10y agoYea I was thinking the bandwidth limitations would be on the CPU because of data decryption... your points are valid though even with that. It's not a great example. I still think that varying degrees of security are fine with these types of things.
- rodgerd 10y agoIf your threat model for your Bluetooth keyboard doesn't involve, say, an abusive spouse sniffing traffic to see if you're reaching out for help, your threat model is probably biased in favour of wankery like the NSA and not real threats ordinary people face.
- M_Grey 10y agoMeanwhile police in a murder case are preparing to take Amazon to court for Echo records. On the privacy front, there's just no saving people, but the IoT brings the magic of invading privacy together with furnishing botnets with millions of new bots! We're screwed coming and going, and the vast majority still look at you like a woodland hermit if you suggest that you shouldn't have anything listening to you in your home.
- mulmen 10y agoI wonder how much infrastructure is really required to properly support Alexa like capabilities for an individual. Does Amazon really need all of our recordings on their hardware in their data centers? Is it conceivable that we could own that hardware as well? I realize that training data is important and I assume the recorded data gets used for that purpose but does Amazon need to keep it forever? How long do they need it? Can I own and posses the hardware and pass off the learning alone?
- bostonvaulter2 10y agoBut even if they say that they're not storing or sending it, how feasible is it to verify that fact?
- nitrogen 10y agoVery feasible -- don't plug it into the Internet.
- M_Grey 10y agoAt which point you have a brick with a microphone, and a pretty blue light, right?
- amiller2571 10y agoI think the blue lights only show when its connected. You would get pretty red lights
- dTal 10y agoOkay, first of all: >the average parent.. is technically literate enough to know the wifi password but not savvy enough to understand how the "magic" of daddy talking to the kids through the bear (and vice versa) actually works [or] that every one of those recordings... is stored as an audio file on the web. If it is not considered amazingly stupid, or at least ignorant to not understand that the magic talking bear has a computer in it, and that if the computer wants the wifi password it probably uses the internet, and that if the entire purpose of the device is to make recordings available to you over the internet... then I despair. My sympathy for people who buy these sorts of products is wearing thin. But, in this particular instance... >our tolerances are very different when kids are involved Interesting. Why? The data is much less valuable: >One little girl who sounded about the same age as my own 4-year old daughter left a message to her parents: "Hello mommy and daddy, I love you so much." Another one has her singing a short song, others have precisely the sorts of messages you'd expect a young child to share with her parents. Hardly identity thief material.
- lvh 10y agoA device connecting to your WiFi could just be talking to devices on your network, not necessarily be sending all of your data to the Internet.
- bigiain 10y agoSure - they _could_, but I've got lightbulbs and power switches that "helpfully" connect to some un branded Chinese "cloud" service - without any normal-user way to even know about it never mind turn it off. I suspect some of it is so I've got the amazingly useful (nb: may not be useful at all) feature of being able to turn my lounge room lights on and off from my phone while not at home. Cynical me suspects it's also probably a pretty good way to ensure forced just-put-of-warranty failures... Pessimist-me assumes the Russians, the Chinese, Mossad, and some kid at the local hackerspace have all pwned the Chines cloud infrastructure and are using backdoor root shells on light globes subversive tshirt purchase history, and they're all cutting each other's throat price discounting as they sell it all as "business intelligence" to my car insurance company and the CBP...
- coleifer 10y agoOh god, it's a kids toy. It's meant to be something fun and cute. What a bunch of jerks to go messing around with that.
- Scott_Helme_ 10y agoHow about 'what a bunch of jerks to connect it to the internet and not secure it properly'?
- r1ch 10y agoThe company was tanking and they were looking to make a quick buck. What market motivation would they have to spend extra time and money securing it properly? This is a fine example of why we need IOT regulation.
- Scott_Helme_ 10y agoHopefully this event will be 'market motivation' enough for them and any companies who will follow them. If this stuff is insecure it will be found and brought to light. The only question is will the good guys find it or the bad guys.
- lathiat 10y agoand people wonder why medical and aerospace companies are highly regulated :-)
- maxerickson 10y agoSecurity problems with medical devices have been in the news too. The regulators have so far been focused on the health aspects of the devices.
- TeMPOraL 10y agoComputer security is a new thing in those industries; regulations have yet to catch up. The point here was, there are always companies that are looking to make a quick buck and which will always refuse to "spend extra time and money securing it properly". Such companies have the market forces on their side - the less they give a shit, the faster and cheaper they can sell their products/services. Regulations in established industries ensure that the minimum level of giving a shit is still safe enough for people.
- simplemath 10y agoIoT should die a swift and permanent death. Alas, that wont happen.
- Mister_Snuggles 10y agoI'd love to see the INTERNET of Things be replaced by the INTRANET of Things. Remote access can be handled through a VPN, so there's no need for a remote server. I'm assuming that the device in question has computing hardware that's at least on par with a $9 CHIP. What's really needed is for secure and easy to set up VPNs (to connect back to your home network) to become a thing, then the remote access problems are taken care of. After this, each IoT device's app just needs to look for the device and possibly give the user a gentle VPN reminder if it can't find it. Of course, a VPN introduces a lot of extra work for the user. Even the steps to connect/disconnect from the VPN add enough friction that some people won't bother.
- simplemath 10y agowhats really needed is an actual un-fucked-with consumer grade encryption standard that is headless, touchless and on forever with no offswitch. Alas, that wont happen either
- cgriswald 10y agoAgreed. A bear that records voices and gives remote access should not need to store data on a server. Store the data in the bear. That's the way these types of bears have always been. The only thing new here is remote access... Storing my kid's private voice recordings on your server is just plain creepy even if you don't leave it wide open.
- ribosometronome 10y agoSure! But in this case, part of the functionality was that friends and family could send voice messages to the bear, which are then approved by the parent in app, before being pushed to the bear. Based on how well the company is doing, it seems like this isn't really functionality that is deserved but it does sound like the justification for storing (some) messages is reasonable.
- teraflop 10y agoFor anyone who is coming straight to the comments before reading the article: the details are even worse than the headline suggests. Not only was a huge amount of information exposed through a public, unauthenticated MongoDB instance, and not only did CloudPets ignore multiple security researchers' attempts to alert them to the problem, but the database was actually held for ransom multiple times without customers being alerted to the breach.
- r1ch 10y agoFrom what I've seen, a lot of of those MongoDB ransomwares actually just delete the data and leave a ransom note in the hope of getting free bitcoin. So in a sense they've done some good by removing it from the internet.
- nvarsj 10y agoThis is _insane_. My daughter got a surprise cloudpet for her birthday from a distant relative. The app you have to use with the cloudpet is also filled with ads, some of which are of adult nature. This company is sleazy as hell. I hope they get sued out of existence.
- lazyasciiart 10y agoThey basically failed out of existence before this even happened (the article includes details on their share price sliding to nothing earlier last year), which is probably one reason they didn't bother telling customers about it. This is probably the best example I've ever seen of the dangers of trying to keep a service running once the company behind it has gone under.
- shostack 10y agoWhy did they fail aside from security issues?
- minimuffins 10y agojust a guess: their product is stupid
- mattbgates 10y agoCompanies have to get more involved in actually encrypting their data before entering it into the database. For every web app I create, especially when sensitive information is exposed, I try to encrypt as much data as possible. With all the leaks and hacks.. it only makes sense to add some encryption method in there.
- AstralStorm 10y agoEncryption does nothing if you can just query the decrypted data. Other than giving a false sense of security. Even if the database is encrypted, something has to access the decrypted data and is vulnerable to attack.
- marksomnian 10y agoIf you do the decryption in your business logic, and store the key separately (Amazon KMS for example), then if somebody hacks the database directly the data is (slightly more) secure. Agreed though. Encryption is only a stopgap and the DB should never have been public in the first place.
- TeMPOraL 10y agoThe real issue is, companies should not touch, and especially not store data unless absolutely necessary, and only store it for as long as it's needed and not longer. There is a German word for that. Datensparsamkeit. https://martinfowler.com/bliki/Datensparsamkeit.html https://martinfowler.com/bliki/Datensparsamkeit.html Actually, and probably for the first time ever, I completely agree with Fowler: "Datensparsamkeit isn't just about bad people stealing data, it's also about your relationship with the primary company themselves. The default attitude at the moment is that any data you generate is not just freely usable by the capturer but furthermore becomes their valuable commercial property. Privacy advocates, including me, think this assumption needs to be changed. Companies should only capture what they need and the burden of demonstrating need should fall on them. In addition, of course, they must be completely transparent about what they capture, what they store, and who they share their data with." This, I believe, needs to be enforced by regulations, worldwide. Businesses won't do it themselves, because it's a clear case of conflicting social and monetary interests.
- Kiro 10y ago> As you can see by loading the image, all that's required to access the file is the path which is returned by the app every time my profile is loaded. How else would you do it?
- bigiain 10y agoPut it behind the webapp's authentication and access control layer - so only logged in users with relevant connection/permission to the requested image can get it.
- IanCal 10y agoAuthorisation?
- semiquaver 10y agohttp://docs.aws.amazon.com/AmazonS3/latest/dev/ShareObjectPreSignedURL.html http://docs.aws.amazon.com/AmazonS3/latest/dev/ShareObjectPr...
- Crosseye_Jack 10y agoWell your correct that a valid address would be needed to access the content. But if you are being told by an api to access Z content it's easy to say "here is a sig that's only valid for the next x mins" (x being something you base on your user base) instead of anyone knowing the file name of the file (which they can get from dumping your db) from access the file without having that extra layer of protection. Disable indexing on s3 and you need to know the direct link. Dump the table to get those links but then you still need to know the secret your app shares with s3 to create the sig needed to download from s3. I.E. They need to know Z and X and X only gets issued to people logged in and expires after a time. Knowing Z alone gets you nothing. I do the same to protect the s3 bucket from direct access our cache pulls from (cache has a shared secret with s3 to pull from. Cache also has another signing process for the client to use to download from the cache). Client Signing for Z file is not valid for client+1. We just use a cache in-between client and s3 as we managed to get a deal thats cheaper for us then direct access to s3. But the same could be done for direct client to s3.
- deleted 10y ago[deleted]
- deleted 10y ago[deleted]
- jasonlotito 10y agoAs an interesting side note, this is also seems to be built on top of the Parse Node.js self-hosted server, based on the schema provided.
- matt_morgan 10y agoI wonder what cloud-connected pets the Trump and Trump-Kushners have.
- Taek 10y agoIs there a fine for this? Some sort of punishment? Companies need to be taking security seriously, we are all paying the price. Internet-of-Shit will remain exactly that until neglecting security is a substantial threat to the bottom line of a company. They ignored multiple warnings? Got hacked multiple times? This is negligence, and this company should be fined out of business.
- f_allwein 10y agoJudging from other comments, it seems they're on the way out anyway. But the question of fines etc. is interesting...
- deathanatos 10y agoThe corporation might be, but this seems like the level of gross criminal negligence that a person should be held liable for.
- callalex 10y agoI'm not necessarily disagreeing but that seems fundamentally opposed to the way a LLC works.
- TeMPOraL 10y agoFailing at business is one thing, doing people-hostile things should be another. I'm all for reducing the personal risk of doing business for entrepreneurs, but for antisocial actions, there should be personal consequences.
- nkrisc 10y agoWhen will these companies be held liable for beaches like this? The time for feigned ignorance is over, this is negligence at the best, outright greedy indifference at the worst. There are no more excuses.
- janwillemb 10y agoApart from the total disaster these kind of incidents are, they serve a valuable purpose: material to educate my children about security. It is surprising to see how quickly my 9-year old daughter picks up the message, especially by these kind of stories.
- vidarh 10y agoMy 7 year old son is rapidly becoming far more hostile to anything from ads to privacy invasions because it is simply making up a far bigger part of his life than it does for me. I wonder how children learning about these things from such a young age will play out once they're gron up.
- cm2187 10y ago> The Germans had a good point: kids' toys which record their voices and send the recordings up to the web pose some serious privacy risks. It's not that the risks are particularly any different to the ones you and I face every day with the volumes of data we produce and place online (and if you merely have a modern phone, that's precisely what you're doing), it's that our tolerances are very different when kids are involved It's a bit paradoxical. There are way less things a kid can say that can get him in trouble than an adult. Even the most oppressive regime will not hold what a 4yo toddler says against him. The need for privacy should rather be less for a kid than for an adult. What it means is that violations of privacy are creepy, period. We try to rationalise it by arguing that we get something out of it, but when dealing with our kids, we stop believing our own bullshit and it is just becomes purely creepy...
- simcop2387 10y agoI think it's possibly a bit more that we rationalize it as an adult because we can make a choice to give up the privacy or not. For a child they haven't developed mentally yet to understand that choice. That said I agree that the child has less potential for revealing information.
- dexwiz 10y agoEven calling it a choice is rationalizing the loss of privacy. Most services are a binary choice of giving up privacy or not using the service. Some services can be done without, but many are required to operate in a modern society.
- tiglionabbit 10y agoThere's always the possibility that the toy overhears adults.
- mirimir 10y agoFirst, it's not just about "get [them] in trouble". Think about ten years later. Do we want adversaries to have logs of children's conversations? Also, It's not just recordings. Once an adversary has account access, they can talk to children. I can't imagine that being a good thing.
- Animats 10y ago"CloudPets can send and receive messages from anywhere in the world! Buy Now".[1] They delivered on that, all right. If you want one, they're now available for the low, low price of only $3.[2] Including WiFi. [1] https://cloudpets.com/ https://cloudpets.com/ [2] https://www.hollar.com/products/as-seen-on-tv-cloudpet-dog https://www.hollar.com/products/as-seen-on-tv-cloudpet-dog
- rasz_pl 10y ago$3 is a great price for a stuffed animal, not to mention IoT BT/Wifi platform.
- Walf 10y agoSo it could all have been avoided if they'd made it unnecessary to identify oneself and paired app with toy via decent public key encrypted communications. I think the toy is a good idea, it just had a shit implementation.
- tudorw 10y agoIoTTDWAMBTPCHGOOBOABS 'Internet of Things That Don't Work Anymore Because The Company That Made Them Has Gone Out Of Business, Oh, And Because Security'
- kriro 10y agoWho's the goto "freedom/privacy marketing" organization (EFF seems to be legal only)? This is an excellent propaganda for freedom opportunity. It involves a creepy invasion of privacy targeting children. Needs to be used in a massive campaign against (insecure) IoT ASAP.
- hidden-markov 10y agoPrivacy international.
- atemerev 10y agoI had a bear like that (not CloudPets, but looks like an exact clone). Thankfully, it was only used by my daughter with my supervision, so I know exactly what has been said. Unless the mic was enabled remotely, that is. I assumed that the security issues might be bad, but placing the voice on unsecured Mongo facing public Internet is beyond shit. Thankfully, I have disabled the bear long time ago. But now I worry about my NetAtmo station, which contains an always listening microphone to "measure the noise pollution". Yeah, right.
- scott_karana 10y ago"Always listening" is meaningless marketing drivel. Anything with a microphone might always be listening, and you probably can't (easily) verify whether it's on-demand or not ;-)
- graystevens 10y agoI'm working on an idea in the security space, that focusing on data breaches and attempting to identify them early. Keen to validate the idea, so if any fellow startups or businesses are interested, I'd love to talk and see what people think. Email is in my profile.
- deleted 10y ago[deleted]
- shostack 10y agoNon-engineer here... What is the significance of this being Mongo vs any other poorly/unsecured DB?
- tclancy 10y agoI don't know that it's Mongo-specific, it's more that newer storage engines, in an effort to be user-friendly, shoot to essentially be zero-configuration out-of-the-box. You install it, run the daemon and can immediately connect so you get that positive feedback the engine is easy to work with. This typically means there's no username/ password required and it's listening on its port to all responses (inside and outside whatever firewall you have). So you start it, connect to see that it works and think, "I should really secure this like it says in passing in the docs, but let me try a couple more things first". All of a sudden it's three weeks later, your MVP is ready to launch and the username/ password has been forgotten. Other stores may let you get away with setting up "root/ root" or "admin/ password" but at least they have forced you to think about setting up some security. It's a trade-off, but it's a crappy one IMHO. There's no risk to Mongo, et al: they told you to set up security but didn't force you because they want you to pick their product.
- coldpie 10y agoFor goodness's sake. Stop connecting things to the Internet.
- ohstopitu 10y agoCan someone explain to me why a teddy bear need to be connected to the internet? Especially in this fashion? Why can't we just have a BT connection between the device and the phone and IAPs in the phone if they must?
- FullMtlAlcoholc 10y agoI don't want to be sophomoric or immature, but I just wanted to point out that a company whose initials are CP makes teddy bears for children. And now audio of children has been hacked, exposing kids voices. The future is here, and it's weird.
- stefek99 10y agoLooking at the stock price - the whole company is in the state of disarray. Massive negligence.
- otakucode 10y agoUntil executives of tech companies are convicted for criminal negligence, this will never improve. The current accepted business practices in tech are abominable and criminally reckless. If a company building housing was as negligent in hiring unqualified cheap talent, ignoring reports from engineers about needing more resources or time in deference to business goals, etc, they would be tried as a criminal and face time in prison. Put some CEOs in handcuffs, lock them in a cage like an animal, and see how quickly companies actually start doing crazy things like mentioning the word 'security' in job listings for software engineers or system administrators or even doing the unthinkable, hiring experienced expensive engineers.