CloudPets teddy bears leaked and ransomed, exposing kids' voice messages

Edit: Demo of the CloudPets functionality using Web Bluetooth https://github.com/pdjstone/cloudpets-web-bluetooth/

I understand that this leak is related to mongodb... and that is terrible, but mostly referring to your bluetooth example.

I mean take bluetooth headphones they are notoriously insecure, but the range in which eavesdropping could take place is pretty small, and for most of us you would just be eavesdropping on our annoying music. Seems reasonable that they save bandwidth on secure transmission of data for higher audio quality. That said I could see an argument the other way, but I'm sure there are more examples where it doesn't seem like a big deal. It would be interesting to hear from someone who thinks I'm dead wrong.

We're screwed coming and going, and the vast majority still look at you like a woodland hermit if you suggest that you shouldn't have anything listening to you in your home.

Also, It's not just recordings. Once an adversary has account access, they can talk to children. I can't imagine that being a good thing.

So I'm worried about my kid saying things that could get other people into trouble.

True, but potentially very dangerous material in other ways. It's not hard to image kidnappers piecing together stolen audio clips to create fake messages as part of a ransom attempt. Or scammers creating audio clips to scare parents and extract money. A large bank of audio clips from a child could be used against that child's family in all sorts of ways, especially if the parents don't know the clips were stolen to begin with.

It's the why-do-I-care-about-my-privacy argument - but it's even more personal now, because it's not just you, it's your kids.

There's always that extra creep factor when it comes to children.

Because while we can make an informed decision about putting our own data into such a service, weighing up the risks and benefits, a four year old cannot - a parent is making that decision for them, and when you are making such a decision on behalf of someone else it behooves you to act more conservatively than when deciding on your own behalf.

Voice data was once safe in its obscurity... now I have a $2 app on my phone that can do decent voice transcription.

It's just one more thing to worry about.

I think you vastly overestimate the degree to which non-technical consumers understand computers, wifi, the internet, email, web sites, apps on their phone, and the differences and boundaries between any of those.

Audio messages can be used to train a system which then will be able to mimic the voice of the child, almost indistinguishable from the original. AI of this kind will be commodity (i.e. easily accessible by criminals) pretty soon if not today.

Someone steals the recording saying "Hello mommy and daddy, I love you so much."

They then manage to contact you, reporting that they have kidnapped your children. They play you the recording to prove they are in your custody and demand an immediate ransom payout.

Highly prone to error, not very likely to work, incredibly evil and likely to end up with the perpetrator in jail, but, unfortunately, the sort of thing that a desperate criminal might try, and even more unfortunately, it only needs to succeed once for someone to consider it a viable tactic.

I know this is stupidly unlikely occurrence, but extrapolate it with a bit more sophistication and you can start to see why this is actually quite nasty identity theft material.

And yes I also rant and rave about parents who post pictures of their children everywhere.

I wonder how children learning about these things from such a young age will play out once they're gron up.

Anything with a microphone might always be listening, and you probably can't (easily) verify whether it's on-demand or not ;-)

Disable indexing on s3 and you need to know the direct link. Dump the table to get those links but then you still need to know the secret your app shares with s3 to create the sig needed to download from s3. I.E. They need to know Z and X and X only gets issued to people logged in and expires after a time. Knowing Z alone gets you nothing.

I do the same to protect the s3 bucket from direct access our cache pulls from (cache has a shared secret with s3 to pull from. Cache also has another signing process for the client to use to download from the cache). Client Signing for Z file is not valid for client+1. We just use a cache in-between client and s3 as we managed to get a deal thats cheaper for us then direct access to s3. But the same could be done for direct client to s3.

Other than giving a false sense of security.

Even if the database is encrypted, something has to access the decrypted data and is vulnerable to attack.

There is a German word for that. Datensparsamkeit.

https://martinfowler.com/bliki/Datensparsamkeit.html

Actually, and probably for the first time ever, I completely agree with Fowler:

"Datensparsamkeit isn't just about bad people stealing data, it's also about your relationship with the primary company themselves. The default attitude at the moment is that any data you generate is not just freely usable by the capturer but furthermore becomes their valuable commercial property. Privacy advocates, including me, think this assumption needs to be changed. Companies should only capture what they need and the burden of demonstrating need should fall on them. In addition, of course, they must be completely transparent about what they capture, what they store, and who they share their data with."

This, I believe, needs to be enforced by regulations, worldwide. Businesses won't do it themselves, because it's a clear case of conflicting social and monetary interests.

Other stores may let you get away with setting up "root/ root" or "admin/ password" but at least they have forced you to think about setting up some security. It's a trade-off, but it's a crappy one IMHO. There's no risk to Mongo, et al: they told you to set up security but didn't force you because they want you to pick their product.

Remote access can be handled through a VPN, so there's no need for a remote server. I'm assuming that the device in question has computing hardware that's at least on par with a $9 CHIP.

What's really needed is for secure and easy to set up VPNs (to connect back to your home network) to become a thing, then the remote access problems are taken care of. After this, each IoT device's app just needs to look for the device and possibly give the user a gentle VPN reminder if it can't find it.

Of course, a VPN introduces a lot of extra work for the user. Even the steps to connect/disconnect from the VPN add enough friction that some people won't bother.

You really can't think of anything valuable about hooking up small devices/sensors to the internet? Do you really believe the potential for stronger security is so low that it's not worth investigating?

I work at an IoT company and we take security far more seriously than some would say is necessary or even reasonable. We're not the only ones out there, you just don't hear about us because our stuff works and therefore doesn't make the news. Just like you don't hear about all the miles an automated car drives safely.