CloudPets

» see cloudpets.com as it lived, on the wayback machine

~ the eulogy ~

CloudPets went on sale in 2015 as a plush toy with a heart-shaped button on one paw. A parent or a grandparent recorded a message in a phone app and it traveled to the toy over Bluetooth. The child squeezed the paw to hear it, then squeezed again to answer back. Spiral Toys put $9.6 million of partner-funded advertising behind the line on Nickelodeon and Cartoon Network, and its distribution partner ordered more than a million units for North American shelves. As a product idea it was sweet, and it worked.

The back end was a MongoDB instance sitting on a public IP address with authentication switched off. Shodan indexed it on 25 December 2016. It carried roughly 821,000 user records across production and test environments, with email addresses and bcrypt password hashes, and bcrypt stops helping the moment your signup form accepts a one-character password. This one did. The company's own tutorial material used qwe as the example.

Those records pointed at the audio. About 2.18 million voice message references sat in the database, and the recordings themselves lived in an Amazon S3 bucket that needed no authorization whatsoever, only knowledge of the file path, which the database handed over on request. Every file was a small child talking to a relative or a relative talking to a small child.

Troy Hunt received the data in late January 2017 and published on 27 February. Spiral Toys had been warned twice at the end of December and again on 4 January, and had answered none of it. When the story ran, chief executive Mark Meyers called it a very minimal issue. The company was gone before the year was out.

~ the dossier ~

~ the ransom ~

Somebody else had found the database long before the researchers did. On 7 January 2017 the original collections were deleted and replaced with a record named PLEASE_READ pointing at a bitcoin address. On 8 January a second party did the same trick under the name README_MISSING_DATABASES, and a third left one called PWNED_SECURE_YOUR_STUFF_SILLY. By 13 January nothing publicly readable was left on the host. The exposure ended because competing extortionists had finished taking turns with it, which is not the same as anybody fixing anything.

~ why it kept happening ~

My distance from this one is the plain kind: wrong country, and no children in 2016. The engineering is not distant at all. I work on devices that look at things and send what they see somewhere else, and the CloudPets failure is the one that every team shipping that class of hardware is roughly one sprint away from. The toy worked and the phone app worked. Somebody stood up a database to get a demo running, left it facing the internet with the auth off, and never went back for it.

The Bluetooth had a separate hole. The toys would pair with any phone in range without a PIN, so a stranger standing close enough to a house could connect to the bear inside it and play audio through the speaker. Mozilla and the security firm Cure53 went back to check in 2018 and found that one still open, more than a year after the database story broke.

~ the retailers ~

Retail took its time. The big American chains kept CloudPets listed through 2017 and into 2018, and only pulled the product in June 2018, after the Electronic Frontier Foundation wrote to them on 28 May citing the Mozilla research and the Consumer Product Safety Commission opened a look at connected gadgets. Spiral Toys had already been out of business for months by then, and the listings between all of the retailers came to about twenty units, so the purge removed almost nothing. It was a statement rather than a recall.

~ what the app still pointed at ~

In June 2018 Threatpost noticed that the CloudPets app, still installed on an unknown number of phones, was directing users to mycloudpets.com, and that the domain had been put up for sale. A dead company's software was aiming parents at an address that anyone with a few hundred dollars could buy. cloudpets.com does not resolve at all now, which is the safest state it has ever been in.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »