Smart Teddy Bears Involved in Massive Data Breach

CloudPets toys connect to mobile apps and let parents and loved ones send messages to their children that are played through the stuffed animals

CloudPets toys connect to mobile apps and let parents and loved ones send messages to their children that are played through the stuffed animals

Account information on 800,000 CloudPets users was left unprotected on the internet, as well as 2.2 million voice recordings sent between children and their loved ones, according to reports. In the case of CloudPets, owned by SpiralToys, it wasn't the cute and huggable smart stuffed toys hackers were hugging, but the data. The parent or child speaks into a microphone inside the toy, which uses a Bluetooth interface to upload the recording to cloud storage via an Android or iOS smartphone app tied to an account. The leak was announced on February 27 and it drew the attention of several security researchers who argued that due to this glitch, hackers may have been granted access to users' recordings.

Numerous passwords for the CloudPets accounts were easily crackable because no rules for password strength were enforced, meaning they could be just one character long.

Those recordings don't necessarily present a security threat in and of themselves, Hunt said, but parents should certainly be aware of what's out there. After advising a password reset, Hunt asked for his original CloudPets password. However, connected toys pose certain privacy and security risks that, if exploited, could have lifelong impacts for affected children.

With a little sleuthing, and some help from CloudPets users willing to serve as guinea pigs, Hunt tracked down some surprisingly personal information on the CloudPets servers.

But as Hunt and other investigators found, kids' information was stored in an insecure database that didn't require authentication to access it. Anyone who saw the data could download a child's CloudPet audio files, and there was no way of telling how many people had done that at this point, according to Hunt.

It's all very innocent and cute, until you fast forward to December of a year ago when the CloudPets database started leaking private information like a sieve.

The breach was first reported in a blog post from Troy Hunt, a Microsoft regional director, on Tuesday.

He noted that California, where Spiral Toys is based, requires companies to notify users in the case of a data breach, which includes the disclosure of email addresses and passwords that permit access to an online account.

Top US, Chinese diplomats meet to discuss relationship
He added that Yang also "had an opportunity to say hi to the President before he left". He said that a delegation of six people had arrived from Beijing to Washington.

Connected toys have been hacked with childrens' voice recordings leaked and attackers leaving ransom notes in the targeted database - but the company behind the stuffed animals has refused to admit it's done anything wrong.

Equally troubling, Stone says he'd spent five months attempting to report the issue to Spiral Toys, however he's received no response.

The latest cautionary tale comes from CloudPets, a company that makes cute bears and dogs that can pass voice messages between kids and their parents.

Smart devices are proliferating, many of them through crowdfunded efforts or new startup business ventures. "We have to find a balance", he said, referring to the need to weigh security against ease-of-use. Rather shockingly, he added: "We looked at it and thought it was a very minimal issue".

Victor Gevers, who is a security researcher at the GDI Foundation, claimed that he also revealed the breach from CloudPets and attempted to contact the company last December.

The main takeaway? Think twice before you welcome any internet-connected device into your home, particularly ones that children may interact with on a regular basis.

What does Troy Hunt say about that?

Recommended News

  • NASA pioneer, Hampton resident Katherine Johnson makes appearance at Oscars

    NASA pioneer, Hampton resident Katherine Johnson makes appearance at Oscars

    Her calculations made the journey of Alan Shephard, the first American to go into space, possible. As Johnson once said , "Girls are capable of doing everything men are capable of doing".
    Strenuous Workout May Kill Male Sex Drive

    Strenuous Workout May Kill Male Sex Drive

    The next step was to classify the men according to their workout habits, regarding whether they exercised for long or short time. They were categorized in groups based on the length and intensity of their workouts as well as on the strength of their libido.
    Media Coverage of Trump Government's Flaws May be Backfiring

    Media Coverage of Trump Government's Flaws May be Backfiring

    Not saying that this wouldn't have happened without the Democrat media complex, but they sure do know how to fan the flames. And the Journal/NBC News poll suggests that this strategy may be having some impact on the way people see the president.
  • Boston Celtics center Al Horford scraps with Dwight Howard

    Boston Celtics center Al Horford scraps with Dwight Howard

    Dwight Howard took no prisoners in Monday night's game against the Celtics. "In the second half they played harder than us". Atlanta Hawks coach Mike Budenholzer knew that stopping the Boston Celtics hinged on making things hard for Isaiah Thomas .
    Cosby lawyer demands trial be moved, cites 'corruption' by media coverage

    Cosby lawyer demands trial be moved, cites 'corruption' by media coverage

    It has almost twice the population of Montgomery County, which is the third largest county in the state. Prosecutors said they were opposed to the defense team's "jury shopping".
    Analyst's Predictions on Verizon Communications Inc. (VZ), Wal-Mart Stores, Inc. (WMT)

    Analyst's Predictions on Verizon Communications Inc. (VZ), Wal-Mart Stores, Inc. (WMT)

    The Average Volume of the company is 8.77 Million and P/E (price to earnings) ratio is 15.72, while Forward P/E ratio is 16.72. The stock is now moving above its 20-Day Simple Moving Average of 5.31% with the 50-Day Simple Moving Average of 5.31 percent.
  • YouTube Is Launching a Streaming Service With Real Cable Channels

    YouTube Is Launching a Streaming Service With Real Cable Channels

    Local news programming from network affiliates will also be included, according to Robert Kyncl, YouTube's chief business officer. Subscribers will also get access to shows that had previously been available exclusively on YouTube Red.
    Grace Episcopal to host Ash Wednesday services

    Grace Episcopal to host Ash Wednesday services

    Lent, which begins on Wednesday, commemorates the 40 days Jesus spent fasting in the desert preparing for his ministry. But some religious leaders think Ash Wednesday should remain glitter-free.
    Franchise tag gives Chandler Jones time to develop in Cardinals' defense

    Franchise tag gives Chandler Jones time to develop in Cardinals' defense

    The Cardinals have a number of key free agents to deal with, including impact starters like Calais Campbell and Tony Jefferson. If Jones receives an offer from another team, Arizona can match it or receive two first round draft picks as compensation.
  • 'Get Out' tops box office with huge $30.5 million in ticket sales

    Building up its box office total: The Lego Batman Movie earned an extra $19 million in its second week, nabbing second place. It finished at the top of the box office all three days while Lego Batman limped in with about half that at $9.6 million.
    Mnuchin: Trump Isn't Cutting Medicare, Social Security

    Mnuchin: Trump Isn't Cutting Medicare, Social Security

    If Mnuchin's comments are correct, the president would be making good on his campaign promise to not make cuts to Social Security, Medicare, and Medicaid.
    Toro Rosso aiming for best-ever fifth

    Toro Rosso aiming for best-ever fifth

    The bodywork is tightly packaged around the sidepods and the rear, but the auto retains a large airbox intake similar to the one on last year's Ferrari-powered vehicle .

We are pleased to provide this opportunity to share information, experiences and observations about what's in the news.
Some of the comments may be reprinted elsewhere in the site or in the newspaper.
Thank you for taking the time to offer your thoughts.