Two million recordings of families imperiled by cloud-connected toys' crappy MongoDB

Re: Think of the Children

"Far more entertainingly, think of the opportunity to add your own messages to the database to be played back to unsuspecting children and parents alike."

Someone has not just thought about it, they did it. The Cayla doll was hacked (easily) to make it a curse monster.

Note that one of the really bad things about this is that the developers of Cayla put some thought into censoring Zuckerberg style the conversations that Cayla could have with a child, forbidding any mention of gay marriage for example, but couldn't be bothered to secure their trash-talking conduit to prevent someone "grooming" the child.

I see you got a downvote, no idea why. Have an upvote to compensate.

Re: Think of the Children

"Or they could just call them on the fucking phone."

Wouldn't that qualify as paedophilia and incest?

Re: Think of the Children

Or they could just call them on the fucking phone.

Or they could buy their pre-school kids a special toy where the kids can learn how to use very simple buttons to hear from dad/mum and leave a message for dad/mum.

A phone is nothing special. But making teddy talk?

(Ideally, the toy would have reasonable security behind it and a manufacturer who, if they screw up, admit it and deal with it quickly rather than trying to deny it when the stolen info is probably on TPB et al by now)

[12hrs after original post - dunno how but I replied to and quoted the wrong message in my original post...]

Re: Incompetence

There was no mention of paying the ransom, so I'm guessing they just restored from a backup each time (as mentioned in the joke above).

Re: Incompetence

"Why did they make no attempt to fix the situation the first, second or third times?"

Your imagination just isn't up to the level of incompetence out in the field. They probably have something hard coded into the bears or apps that are out in the field... We just haven't heard about it because it doesn't happen with every access, just something like initial setup or reset (and seriously, why spend more time investigating their level of security).

Re: But it's Cloud!

Harry Harrison's "I Always Do What Teddy Says"

Somehow it seems that I've been posting comments relating to this story a lot more in the last two years, children's toys are probably beyond the line where the current IoT craze should have stopped.

"Not when Pen Test Partners have been briefing about these vulnerabilities since 2014.

I have an indelible recollection from 35 years ago of a friend's 2 year old daughter confiding secrets to her doll.

It doesn't take much imagination to see the dangers there.

They have some sensible advice about Cloud Pets on their website.

Does it involve incineration, use of a lupara at short range or copious amounts of gunpowder?

"Any product that isn't secure out of the box when installed is unfit for purpose."

A developer who ignores basic security is unfit for purpose IMO. This is presumably someone who does this for a living, not just some random member of the public.

"I would fire the entire dev/IT team if I were in charge of that toy outfit"

Those in charge are equally guilty. Either they paid no attention at all or ignored the risks. If you'd been in charge you should have been fired as well.

> "I would name and shame the guyz on the Internet, never to find a job in IT again."

Right because you've never made an IT mistake, and all the rest of us are perfect programmers too, who sprang into the world with all the knowledge we have now?

People learn far more from their mistakes than successes. Sure fire the IT dept, but can bet your boots those guys/girls won't make the same mistake twice. To suggest that for 1 mistake someone should lose their career, livelihood, then possibly their house and wife, is ridiculous.

I would fire the entire dev/IT team

I think "sue the company into non-existance" would send the correct message.

Log files is good, RTFM is much, much better ...

Making it just work securely without the need to read either logfiles or TFM is better still.

Re: Harry Harrison - I Always Do What Teddy Says...

Oh Lordy, I hadn't read that one before ... that's scary good!

Re: Waste of time

"it seems difficult to imagine that there is much data which could be useful to anyone who got hold of it."

From the link in the Reg article

"the data sent to Lorenzo shows that along with references to their profile photos, it contained the names of children and their day and month of birth (although not year). It also contains relationships to parents and "friends" (i.e. grandmother, uncle) that have been authorised to share messages with the child."

There's also the email address used to sign up. How many people use a childs, oets or reletives name or DoB as a password? The year may be missing from the DoB field but is guessable give or take a few years so easy to try a few. So, at the very least, a lot of email accounts might be directly at risk.

Banks often uses mothers name etc as part of a verification process and the linked data includes the child's relatives and their relationship and if a miscreant already has access to your email account then a lot of relevant info is there for social engineering attacks. It's also quite likely that those same email addresses will have turned up on other data breaches too. Maybe someone with a young child has/had an Ashley Madison account. Should dolly tell child and reletives all about daddy's dalliances or will daddy pay to keep the doll quiet?

Re: Easy Way to Have the Problem Addressed

and possibly even Hillary, who is literally the wench of Babylon with added pizza delivery service, in power.

Be thankful for small mercies.

I'm still not sure which is the rock and which is the hard place. One is the wench of Babylon, one is a guinea pig attempting to hatch an orange. One of them is in power, one of them isn't. Neither is a viable option.