Smart plush toys leaked data from 800,000 families
The stuffed animals of the Cloud Pets brand are linked to a mobile application that allows parent-child communication. Through this utility parents can record their voice and make the plush play it.
To access the application it is necessary a registration by providing personal information such as name, surnames, email addresses, telephone number or child's name.
Security specialist Troy Hunt has revealed that the parents' credentials were stored in a MongoDB database with little security. This database contained more than 800,000 accounts, many of them with weak passwords and easy to hack, thus exposing the conversations recorded by teddies.
References:
- 27/02/17 motherboard.vice.com Internet of Things Teddy Bear Leaked 2 Million Parent and Kids Message Recordings
- 28/02/17 motherboard.vice.com How This Internet of Things Stuffed Animal Can Be Remotely Turned Into a Spy Device
- 28/02/17 eldiario.es Un oso de peluche expone en Internet dos millones de conversaciones entre padres e hijos
- 28/02/17 tekcrispy.com Cuentas de usuarios y mensajes de voz de los peluches CloudPets han sido hackeados