The Cybersecurity of Smart ‘Adult’ Toys, or Lack of It
summary
Research shows specific failures: Android apps create temporary images on SD cards and use default Bluetooth PINs like 0000, allowing local takeover of Lovense toys; a Hush model leaks unencrypted traffic and permits remote code execution on a butt plug enabling speculative ransomware and battery overheating; a camera-endoscope acts as a WiFi AP with PSK "88888888" and admin blank, letting attackers get a persistent root shell after dumping firmware; a male chastity device allows deletion of digital keys, permanently locking users while vendor refuses fixes.
AI-written summary · about
chapters (23)
- 0:00Introduction to the topic
- 1:20Real-world security perils
- 3:02Philosophy of kink and data
- 3:40Military and social impacts
- 4:22Risks of identity and harm
- 5:25Analyzing early vulnerabilities
- 7:37Advanced hacking scenarios
- 11:17Bluetooth and Wi-Fi tracking
- 12:29Screwdriving and vendor ethics
- 15:09The camera dildo anomaly
- 17:16Device control vulnerabilities
- 18:02Rooting for research
- 19:01Firmware and code exploits
- 20:11Hookup app location data
- 21:13State-level persecution risks
- 22:10Dumpster fire disclosures
- 23:01Improving location security
- 23:27The chastity cage problem
- 24:01Vendor apathy and new risks
- 26:46Industry change and advocacy
- 28:06Legislation and compliance
- 28:43Taking action as consumers
- 29:25Conclusion and Q&A
related talks
22mDo your gadgets have ears? Why IoT regulation must include data privacy
47m#ToyFail: Is your child safe from the Internet of Things?
01h 06mBackdoors in Back Doors
59mThe Internet of Pwned Things
30mVulnerabilities in the Internet of Things
18mNo Key, No Problem: Vulnerabilities in Master Lock Smart Locks
30mHousehold INFOSEC in a Post-Sony Era #bbuzz
22mA Mirage of Safety: Bug Finding & Exploit Techniques of Top Android Vendor's Privacy Protection Apps