Chinese Surveillance and CloudPets
summary
CloudPets’ backend exposes an unauthenticated MongoDB that leaks emails, password hashes and voice recordings for roughly 800000 users exposed; firmware updates use only weak checks and the toy accepts connections with no BLE bonding so proofs of concept still let strangers play or record audio. Retailers pull the toy after retests find fixes absent. Chinese police apps ijob and bxaaq are reverse engineered from APKs, export screens and harvest blood type, political views and electricity consumption tracking plus contacts and messages for centralized big‑data correlation.
AI-written summary · about
chapters (13)
- 0:00Start
- 1:24What are Cloud Pets?
- 1:41How do Cloud Pets work?
- 3:01What could possibly go wrong? Any ideas?
- 3:57First Ransom
- 4:40Previous Work #14: Toy Security
- 6:13Question: What did they fix?
- 6:46Unicorn Analysis
- 10:39Part 2: Chinese Police Apps - IJOP & BXAQ
- 13:32Setting up Tor
- 13:59What is after the login?
- 22:50Conclusion
- 24:04What is the "BXAQ" app?
related talks
28mCyberespionage: Targeted Attacks Abusing Third-Party Cloud Services
59mThe Internet of Pwned Things
01h 01mThe Internet of Pwned Things
47m#ToyFail: Is your child safe from the Internet of Things?
34mThe Cybersecurity of Smart ‘Adult’ Toys, or Lack of It
59mQuantified Self - A Path to Self-Enlightenment or Just a Security Nightmare?
32mUsing Geopolitical Conflicts for Threat Hunting
01h 07mToys that listen.