Data Breach , Data Loss , Privacy
Don't Hug These Internet-Connected Stuffed Toys Failing Toymaker Leaks 2 Million Parent-Children Chats
Spiral Toys, which manufacturers the CloudPets range of Bluetooth-enabled "smart toys," is under privacy fire for exposing 821,000 user records online, as well as links to 2.2 million parent and child voice recordings captured by its interactive toys and related apps.
See Also: Balancing Fraud Detection & the Consumer Banking Experience
Copies of the data are in wide circulation and appear to be the focus of multiple attempted ransom shakedowns, says Australian developer and Have I Been Pwned administrator Troy Hunt, who says that he and other researchers have verified that the exposed data is legitimate.
Neither Spiral Toys, based in Agoura Hills, Calif., nor its CEO, Mark Meyers, could be immediately reached for comment on the report.
The CloudPets alert follows an increasing call from security experts for internet-connected devices to be regulated by governments and poorly secured devices to be blocked from the internet (see Cybersecurity Chaos Dominates RSA Conference Discussions).
Information Security Missteps
In a blog post, Hunt alleges Spiral Toys committed numerous information security errors in relation to its toys. Here's a brief recap of what he says apparently went wrong.
MongoDB: The company exposed MongoDB databases - no password required for access - containing user account information, which was indexed by the internet-connected device search engine Shodan. "The data is now in the wild," Hunt says. (See related story: Emory Healthcare Database Breach: What Happened?) Ransom demands: Attackers downloaded and then deleted some of these MongoDB databases - including one containing 821,000 user records - and left at least three different ransom notices for Spiral Toys. Links: "The MongoDB contains references to both profile pictures and voice records which are stored in Amazon S3" - Simple Storage Service - Hunt says, and accessing the linked recordings is not protected by user authentication. Hunt has posted a sample sound file using a CloudPets toy to demonstrate what attackers might be able to recover. He says links to all of the data stored on Amazon S3 were contained in the exposed MongoDB databases. Passwords: While Spiral Toys stored passwords using the bcrypt password-hashing algorithm, which is good, it failed to enforce any password rules, as demonstrated in this YouTube video. As a result, short - such as "qwe" - or overused passwords could be picked, meaning that many passwords could be easily cracked. Bug reporting: Spiral Toys maintained no channel for security researchers to report flaws in its products and could not be reached despite multiple attempts from different researchers, including a Dec. 31, 2016, trouble ticket logged in its ZenDesk system by Dutch security researcher Victor Gevers.Warnings, Then Ransom Demand
Motherboard says that independent of Hunt, on Dec. 30, 2016, it received a tip-off that poorly secured CloudPets data was being stored online. "I want to inform you that 45.79.147.159 is running a MongoDB instance which appears not to be correctly configured or protected by a firewall allowing connections via port 2701," according to a message it received.
Hunt says that he and other security experts have been attempting to alert Spiral Toys to the security problems. Gevers, for one, attempted to warn Spiral Toys multiple times beginning in late December 2016, but says he couldn't make contact.
@CloudPets Hi! I want to report a securtity issue but This email address is being protected from spambots. You need JavaScript enabled to view it. & This email address is being protected from spambots. You need JavaScript enabled to view it. are not functional: Recipient not found.
Norway-based Irish security researcher Niall Merrigan charted a number of MongoDB ransom demands - all apparently part of the same campaign - beginning in January that include one or more stolen CloudPets databases. One of the related ransom notices reads: "You DB is backed up on our servers, send 1 BTC to 1J5ADzFv1gx3fsUPUY1AWktuJ6DF9P6hiF then send your ip address to email:This email address is being protected from spambots. You need JavaScript enabled to view it.."
The breach is a reminder that too many organizations fail to provide a dedicated hotline for bug hunters. "I've said many times before in many blog posts, public talks and workshops that one of the greatest difficulties I have in dealing with data breaches is getting a response from the organization involved," Hunt says.
No One Home?
Wiggy, a cloud-connected piggy bank.The failure to raise anyone at Spiral Toys may be due to its stock price now being worth less than one cent. The value of the company's stock - listed on the Over-The-Counter Bulletin Board, which is regulated by the Financial Industry Regulatory Authority - has been in decline since late 2015. Potential salvation in the form of a an internet-connected "smart piggybank" named Wiggy that the company brought to market in November 2016 has so far failed to materialize.
To date, Spiral Toys has filed no data breach notifications with the state of California.
As of January 1, the state requires public notification for breaches affecting 500 or more residents even when encrypted data gets leaked if security credentials or encryption keys that could unlock the data were also exposed.
Creepy Smart Toy Redux
When it comes to smart toys - and many manufacturers' apparent disregard for kids' privacy - we've seen all of this before.
In 2015, for example, Hong Kong toymaker VTech was hacked and data on 200,000 kids exposed.
The same year, I detailed how Mattel's $75 internet-connected Hello Barbie that could listen to children's conversations and respond to them triggered privacy and creepiness warnings from experts.
Also in 2015, Ken Munro, a partner at U.K.-based penetration testing firm Pen Test Partners, showed how the $60 Cayla doll, which can be paired with a smartphone, and a dedicated app used to process what's said to the doll, could be locally hacked.
Germany Bans Cayla
Now, some regulators are taking action. Earlier this month, the Bundesnetzagentur - Germany's telecommunications watchdog - banned the Cayla doll on privacy grounds, because it surreptitiously records local conversations and transmits them to a web service. The doll was introduced in 2014.
"Any toy that is capable of transmitting signals and that can be used to record images or sound without detection is banned in Germany," according to the Bundesnetzagentur. It also found that the toy's wireless connection was poorly secured, leaving it at risk of local eavesdropping. Genesis Toys, which manufactures, Cayla, couldn't be immediately reached for comment on those allegations.
The Bundesnetzagentur is promising to put the security of more so-called interactive or "smart" toys to the test.
It's a sure bet that Hello Barbie, Cayla and now CloudPets - or rather Mattel, Genesis Toys and Spiral Toys - are not the only information security and privacy offenders.