A security researcher gained access to 13 million conversations of the Eiliko SI toy; data of 68,000 robots is stored on Chinese servers
Prepared by Sintelligent with the help of SI. Published in SI: . Updated: .
A children's SI toy kept conversations and children's data in a way an outsider could read, so before buying such things it is worth finding out where they store data.
According to The Verge writer Sean Hollister, the SI pet Eiliko from Energize Lab, which he bought on Amazon, handed security researcher Sammy Azdoufal a full transcript after a 10-minute conversation; through the same vulnerability he could read 13 million conversations of tens of thousands of people and see the entire active fleet of 68,000 toys; the largest market for the toys is the US, where, according to the database, more than 31,000 profiles belong to children. The database stores user profiles (name, age, family and so on), a full-text search of what was said, and unencrypted photos and short audio recordings at publicly accessible addresses, although the company's privacy policy promises recordings are deleted after processing. Azdoufal remotely changed the toy's "memory" and made it say what he chose; he is preparing nine CVE reports with Tod Beardsley. Energize Lab, according to the author, did not respond to his outreach to ten addresses over a month; the company's position was not found in the sources checked.
Sources 1