1
00:00:00,000 --> 00:00:09,380
Next speaker, hacks banks by day and other random things at night, currently sex toys. The

2
00:00:09,380 --> 00:00:18,740
focus of his talk today is to explore the under research branch of IOT and the security and

3
00:00:18,740 --> 00:00:25,440
privacy threats that exist. So to present on his talk of IOT of dongs, ladies and gentlemen,

4
00:00:26,780 --> 00:00:39,260
RenderMan. Hello. So yes, I am RenderMan, this is Murdock Monkey. Just so you know, I did

5
00:00:39,260 --> 00:00:43,040
a little biohacking on my liver last night and so when I was working on the slides, I guess

6
00:00:43,040 --> 00:00:47,580
you forgot to hit save. So I was just sitting in the back hacking together something so if

7
00:00:47,580 --> 00:00:54,400
this seems a little disjointed, I apologize. This is a serious talk. Let's try to be adults

8
00:00:54,400 --> 00:00:58,400
here, vaguely. I mean, there are no children in here, right? Okay, good, I don't want to pay

9
00:00:58,400 --> 00:01:05,240
therapy bills. So yes, Internet of Things. We all know about it. Manufacturers not, you know,

10
00:01:05,240 --> 00:01:08,180
the security on them is terrible. They don't have a way to update them or they just don't

11
00:01:08,180 --> 00:01:13,420
care. Users don't consider the security and privacy of using these things until it's way

12
00:01:13,420 --> 00:01:18,560
too late. Groups like I Am the Cavalry are doing amazing work on, you know, automotive,

13
00:01:18,920 --> 00:01:24,380
medical, but nobody wanted to touch sex toys for some reason. So, but, you know, I'm not

14
00:01:24,380 --> 00:01:28,000
sure. This shows that IOT is permeating every part of our lives, including one of the most

15
00:01:28,000 --> 00:01:36,720
private bedroom activities. So yes, sex toys are now being connected to the Internet. For a lot

16
00:01:36,720 --> 00:01:40,600
of people, that's, like, they can't grok that, you know, initially, let alone that there's,

17
00:01:40,600 --> 00:01:45,880
you know, security issues. Basically what we're looking at is sex toys, Kegel exercisers,

18
00:01:45,900 --> 00:01:49,900
general rings. If it goes into your genitals, your genitals go into it or it goes around

19
00:01:49,900 --> 00:01:53,700
genitals, that's when we're worried. Those are the devices we're worried about, so.

20
00:01:55,040 --> 00:02:00,720
A large number of IOT research firms, yeah, they didn't want to look at this, because, you

21
00:02:00,720 --> 00:02:05,720
know, there's stigmas around sex. We have a very weird thing in North America about sex, you

22
00:02:05,720 --> 00:02:08,760
know, we'll watch all the violence we want on television, but, you know, you can't see two

23
00:02:08,760 --> 00:02:15,720
people have sex. Like, makes no sense to me. So it started basically because I had the idea

24
00:02:15,720 --> 00:02:22,060
rolling around in my head for about ten years. Happened to mention it to the purveyor of a adult

25
00:02:22,060 --> 00:02:28,180
toy store back home in Edmonton, and she was like, this is a good idea. I do all these in-home

26
00:02:30,020 --> 00:02:34,160
demonstrations and, you know, it's like a Tupperware party but different kind of rubber made.

27
00:02:35,440 --> 00:02:38,680
But it's like, yeah, I've got some, you know, old models, you know, ones where the batteries

28
00:02:38,680 --> 00:02:43,980
don't work or broken power connector and that, and gave me these old demo ones. And, yeah,

29
00:02:44,080 --> 00:02:52,040
started diving into this stuff and shit got real, real quick, because when you now realize it, the question is, is hijacking the remote control, you know, is it just a

30
00:02:52,060 --> 00:03:04,400
tool of a connected sex toy, sexual assault? I hear that uncomfortable giggling, but, no, think about it. You know, you, you know, you have a

31
00:03:04,400 --> 00:03:11,280
partner, you give them permission to control this device, someone else hijacks the connection, that person does not have

32
00:03:11,980 --> 00:03:21,980
permission, that fits the definition of sexual assault. There has been several cases of rape by deception, where it was

33
00:03:22,060 --> 00:03:31,380
like, you know, if your twin brother has sex with your wife kind of thing. It's very interesting, because it's, they usually are dismissed on some sort of

34
00:03:31,380 --> 00:03:39,960
technicality. Again, I'm not a lawyer. I really want to put an interesting query into the EFF about this. Canada's sexual assault laws

35
00:03:40,660 --> 00:03:50,720
specifically define, you cannot, consent obtained by fraud is not consent. So, in this case, yes, if you're impersonating someone, you know, by hijacking

36
00:03:50,720 --> 00:03:51,360
their account or whatever.

37
00:03:52,060 --> 00:03:59,620
Yes, that is not, you know, consent goes to the person on the other end, not the account. But it gets really weird when you start looking at laws

38
00:03:59,620 --> 00:04:07,740
because these are devices that are voluntarily used. It's the same data that, you know, their intimate partner would be sending, but not by that

39
00:04:07,740 --> 00:04:17,000
same person, but if the, you find out that it wasn't the person you thought it was controlling it, the emotional horror and trauma

40
00:04:17,000 --> 00:04:22,040
from that is, you know, should not be anywhere dismissed or, or

41
00:04:22,760 --> 00:04:28,320
less than a physical assault, so. Um, probably all heard about the WeVibe lawsuit after

42
00:04:28,740 --> 00:04:34,040
DefCon last year. Um, for those of you who weren't around, a Goldfiskin follower did a talk

43
00:04:34,040 --> 00:04:39,120
where they found a number of issues with the, the WeVibe. Um, full disclosure, I had actually

44
00:04:39,120 --> 00:04:43,960
put in the exact same talk, came to the exact same conclusions as them. Uh, they got

45
00:04:43,960 --> 00:04:49,860
selected. Uh, they were first time speakers. I've spoken way too many times here. Um, all

46
00:04:49,860 --> 00:04:56,580
boiled down to they didn't have the right privacy policy in the app. It basically was the

47
00:04:56,580 --> 00:05:01,080
privacy policy from their website. So it didn't, you know, I was mentioning cookies and stuff

48
00:05:01,080 --> 00:05:04,200
like that. It didn't disclose, you know, some of the information that they were collecting

49
00:05:04,200 --> 00:05:10,580
from the app and the device. And yeah, they got nailed to the wall because hey, you know, if I

50
00:05:10,580 --> 00:05:14,360
had known that this was doing this, I wouldn't have bought it. Deceptive advertising and

51
00:05:14,360 --> 00:05:19,300
such. Absolutely no evidence of, of malfeasance. You know, data didn't leak. They weren't

52
00:05:19,300 --> 00:05:19,780
abusing.

53
00:05:19,780 --> 00:05:24,560
It, you know, weren't doing dossiers on users or anything. Um, it was just literally a

54
00:05:24,560 --> 00:05:29,880
paperwork oversight. So the biggest lawsuit regarding all this stuff had absolutely nothing to

55
00:05:29,880 --> 00:05:34,840
do with, you know, actually technical privacy or security, but just legal paperwork. Uh, they

56
00:05:34,840 --> 00:05:40,920
settled for five million dollars in a class action lawsuit. Um, and uh, we should be finding

57
00:05:40,920 --> 00:05:47,440
out in the next two, three weeks, uh, how much, uh, people actually get out of that. Um, it

58
00:05:47,440 --> 00:05:49,760
could be up to ten grand if you, do you know what I'm saying? Um, so, uh, so, uh, the, the

59
00:05:49,760 --> 00:05:55,640
government was really strong to use the app and the, the device. Um, the interesting part is

60
00:05:56,180 --> 00:06:01,020
WE CONNECT was actually one of the better apps even before all this. You know, they were one of

61
00:06:01,020 --> 00:06:05,400
the best ones I had tested. Um, you know, they still had some issues, but yeah, they were

62
00:06:05,400 --> 00:06:12,160
actually doing SSL, um, at least half-ways right. Um, they were, you know, doing a lot of

63
00:06:12,160 --> 00:06:18,880
things that, uh, you would expect. Um, after they, uh, got hit with this lawsuit and the, the

64
00:06:18,880 --> 00:06:25,400
Goldfisk followers talk, they stepped up and basically completely re-engineered their app.

65
00:06:26,460 --> 00:06:30,840
It's now kind of like the gold standard I have for other vendors. It's like you need

66
00:06:30,840 --> 00:06:35,080
to be doing all the stuff that they're doing. You know, they got rid of things like you

67
00:06:35,080 --> 00:06:40,920
don't need to create an account to use it. So there's no personal information being collected

68
00:06:40,920 --> 00:06:46,460
there. Allows for, you know, you start it up the first time, it says, hey, would you

69
00:06:46,460 --> 00:06:51,580
like to opt out of anonymous data collection? Cool. You know, gives people the chance right

70
00:06:51,580 --> 00:06:56,640
there the first time. Looks like they're actually doing certificate pinning. Like, holy crap.

71
00:06:58,500 --> 00:07:05,600
Still some issues. My favorite is that you still can't visit their website over SSL. Like,

72
00:07:07,100 --> 00:07:11,640
I've been hammering on that for, like, 18 months and they still have not gotten back to me

73
00:07:11,640 --> 00:07:16,440
at all. It's just, it's hilarious. I also heard about the CMEI, which is the

74
00:07:16,440 --> 00:07:26,040
CMEI controversy. This is a vibrator with an embedded webcam. Hey, I don't judge, you

75
00:07:26,040 --> 00:07:35,060
know. Basically, it's because it's doing video, it needs bandwidth. And so it uses Wi-Fi.

76
00:07:36,400 --> 00:07:41,380
When you start it up, it becomes its own access point. So you connect your tablet, phone,

77
00:07:41,640 --> 00:07:46,420
whatever, to it. So it's not actually connecting to the Internet or anything like that. It's

78
00:07:46,420 --> 00:07:53,100
so you can, you know, view the stream, control it from your phone. It's basically, it's an

79
00:07:53,100 --> 00:08:01,400
RA link system on a chip running BusyBox. Interesting to note, yeah, I smuggled my GPG key

80
00:08:01,400 --> 00:08:08,360
chain across the border on a dong. Because there's about eight megs of storage available on

81
00:08:08,360 --> 00:08:15,620
here, so. Proof of concept. I had to do it. I've also, there's the embedded web server and,

82
00:08:16,420 --> 00:08:20,360
yes, I have actually hosted a website, you know, an Internet on a dong. .

83
00:08:21,060 --> 00:08:27,720
Literally all it is, is a reworked, you know, cheap Chinese IP camera that they, you know, made

84
00:08:27,720 --> 00:08:36,160
fit in the particular container. That's a picture of my nose. Pentest partners, Ken Monroe, is

85
00:08:36,160 --> 00:08:42,020
he here? Nope? Okay. He's probably over at IoT Village. Literally this thing was in the air from

86
00:08:42,020 --> 00:08:46,400
Amazon when they released their report. So, you know, I've actually, you know, I think, you know, I've

87
00:08:46,420 --> 00:08:50,840
they had found all the same things I had already in the software. I didn't have the hardware

88
00:08:50,840 --> 00:08:58,280
yet to confirm the last few. While the report was factually correct, there was a lot of

89
00:08:58,280 --> 00:09:05,120
innuendo and jokes and just juvenile humor. They released it under a pseudonym of, you

90
00:09:05,120 --> 00:09:10,420
know, Bill DeJure. It's like, really guys? You know, come on. We're professionals here. So

91
00:09:10,420 --> 00:09:16,300
I took some exception with that, posted a rebuttal saying that yes, your evidence of risk

92
00:09:16,300 --> 00:09:21,680
was true, but you blew it out of proportion. Like, oh my God, these things are Wi-Fi, so

93
00:09:21,680 --> 00:09:25,680
they're broadcasting to anyone and, you know, wardrivers can pick this up and add it to

94
00:09:25,680 --> 00:09:34,320
Wiggle.net. I show a screenshot of Wiggle.net. Well, if you actually log in to Wiggle and use

95
00:09:34,320 --> 00:09:42,860
the CMEI SSID and search, you find two. Both of them are roughly the same location outside a

96
00:09:42,860 --> 00:09:45,300
four-story sex shop in downtown Tokyo.

97
00:09:46,300 --> 00:09:51,800
So out of, Christ, I forget how many they're up to. They're like, you know, 600 million access

98
00:09:51,800 --> 00:09:58,920
points cataloged. Two. And it's, you know, demo stuff in, like, an incredibly packed part of

99
00:09:58,920 --> 00:10:05,600
town. So, like, yeah, the risk is very, very minimal on that. Yes, there was a default pin

100
00:10:07,260 --> 00:10:11,860
that, interestingly, their previous software didn't give you any way to change it or none of

101
00:10:11,860 --> 00:10:16,280
the instructions. It would tell you repeatedly, change the password, change the password. I'm not

102
00:10:16,300 --> 00:10:26,380
sure how. So I posted this rebuttal and, you know, working with Ken Monroe and that, they made a

103
00:10:26,380 --> 00:10:29,640
bunch of press, but unfortunately, you know, this whole project didn't get mentioned, so I'm

104
00:10:29,640 --> 00:10:35,040
like, Ken! But, no, it got them on the same page, but it shows that people are paying

105
00:10:35,040 --> 00:10:40,840
attention, you know, that the public is now considering this. So vendors were already freaked

106
00:10:40,840 --> 00:10:45,460
out by the WeVibe suit. Seeing this, you know, getting dragged through the mud didn't help them

107
00:10:46,300 --> 00:10:50,760
at all. You see? It's also a great example because they had tried to, you know, do a coordinated

108
00:10:50,760 --> 00:10:57,720
disclosure with the vendor, but they never replied. Like, this is why you need vulnerability

109
00:10:58,380 --> 00:11:04,500
disclosure programs that actually are acted upon. Problem of these things is that you have,

110
00:11:04,700 --> 00:11:09,060
you know, the potential for really dumbass regulations and stuff like that. I mean, you've got

111
00:11:09,060 --> 00:11:15,660
some 70 or 80-year-old geriatric, you know, congressman. Or senator trying to figure out this

112
00:11:15,660 --> 00:11:20,620
this technology and it's like, oh, my God, that's like, oh, my God, you know, sex. You

113
00:11:20,620 --> 00:11:24,980
know, considering that they're probably also doing their secretary or something. You know,

114
00:11:25,000 --> 00:11:31,560
it's like you're looking for solutions to a problem that doesn't exist. It may not be your

115
00:11:31,560 --> 00:11:37,020
thing, but doesn't everyone deserve privacy and security in what they do? Even if you don't

116
00:11:37,020 --> 00:11:45,640
agree with it. If not, you're wanting people to be hurt. You're a terrible human being. And

117
00:11:45,640 --> 00:11:54,500
so Internet of Don.GS, if in case you're wondering, .GS is South Sandwich Islands. So I had

118
00:11:54,500 --> 00:12:00,920
actually inquired with some friends that do issue CVEs. There's a big thing with, like, IOT

119
00:12:00,920 --> 00:12:06,720
stuff. They don't know how to issue a CVE for some of it because it's, you know, using other

120
00:12:06,720 --> 00:12:11,760
project software, but, you know, it's only for this device, it's configuration. So I was

121
00:12:11,760 --> 00:12:15,620
like, screw it. So I'm doing Dong Vulnerability Exposure IDs. And I'm like, you know, I'm

122
00:12:15,620 --> 00:12:20,800
going to do it. Mostly for my own sanity, when I was submitting things, it would be like a half

123
00:12:20,800 --> 00:12:24,800
a dozen things that I wanted to make sure that none of them were forgotten. So having, you

124
00:12:24,800 --> 00:12:29,120
know, an identifier helped. But also the reports, you know, you can actually start seeing what

125
00:12:29,120 --> 00:12:35,640
sort of issues are happening. I've already helped a number of vendors build Vulnerability

126
00:12:36,700 --> 00:12:41,500
Disclosure and Management programs. Because if somebody finds something, why the hell aren't

127
00:12:41,500 --> 00:12:45,600
you just making it easy to report? They're giving you free work. Like, you know, it's

128
00:12:45,600 --> 00:12:51,100
a good thing. It makes sense. Again, nonjudgmental. Just want to see, have people, you know,

129
00:12:51,100 --> 00:12:57,120
use these things privately and securely. So the vast majority of these are Bluetooth.

130
00:12:57,460 --> 00:13:04,420
Bluetooth LE is the only Wi-Fi one. They pair to a smartphone or a tablet for local

131
00:13:04,420 --> 00:13:10,740
control, but also as a gateway for remote control via the internet. A few have some desktop

132
00:13:10,740 --> 00:13:15,580
applications as well. XMPP is a very common control channel on these. It's a very common

133
00:13:15,600 --> 00:13:20,620
one. Provides, you know, text chat functions as well. But they'll also do text, audio, and

134
00:13:20,620 --> 00:13:25,480
video chat. Like, they're full-fledged, you know, video teleconferencing, and telebildonics

135
00:13:26,060 --> 00:13:31,120
suites. So lots of interesting attack surfaces there when you think about it between the

136
00:13:31,120 --> 00:13:36,360
text, the audio, and the video. Almost always there's some sort of interaction with a company

137
00:13:36,360 --> 00:13:43,080
server for brokering the connection or, you know, finding each other or something. But, you

138
00:13:43,080 --> 00:13:45,580
know, it's trying to convince vendors that it's, like, you know, it's not going to work. You

139
00:13:45,600 --> 00:13:51,300
need to be as hands-off as you can possibly be. Because, yes, it might be easier to do things

140
00:13:51,300 --> 00:13:56,300
this way where you tag, you know, unique identifiers to everybody. But, no, that's where

141
00:13:56,300 --> 00:14:04,260
things get weird. So the more hands-off you can be, the better. Basics. Yeah. We're all

142
00:14:04,260 --> 00:14:10,040
pretty familiar with how this sort of thing should work. So, so far, 27 vulnerabilities

143
00:14:10,040 --> 00:14:15,580
reported. 17 fixed, though I haven't checked in the last week. Four vulnerabilities reported.

144
00:14:15,600 --> 00:14:21,040
Four complete or partial user databases. Two complete remote hijacks. One set of GPS

145
00:14:21,040 --> 00:14:26,840
locations for all users that were online at the time. I've got eight vendors that are on board

146
00:14:27,420 --> 00:14:33,080
with doing vulnerability disclosure programs. I'm helping them basically to realize, hey, you're a

147
00:14:33,080 --> 00:14:36,820
software company now, whether you want it to be or not. You're going to have to do certain

148
00:14:36,820 --> 00:14:41,820
things. Four have reached what I consider a trusted partner level and means that they have a

149
00:14:41,820 --> 00:14:45,580
very good and well-established vulnerability disclosure program. Four of them are on board with a

150
00:14:45,580 --> 00:14:52,280
security program. They're being proactive and just fully embracing the idea that, okay, we need

151
00:14:52,280 --> 00:14:59,680
to be secure. Twenty-two test devices in this, you know, lovely hand-cut foam case, which is really

152
00:14:59,680 --> 00:15:06,420
fun as carry-on. One corporate sponsor and a very confused mother. So, yes, we were

153
00:15:06,420 --> 00:15:15,380
supported by PornHub. Wait, you're all familiar with it? I thought it was just some obscure little site.

154
00:15:16,640 --> 00:15:21,560
Drunken e-mail to their marketing people saying, hey, here's the project. Going to buy some of

155
00:15:21,560 --> 00:15:28,180
these devices. They're expensive. Can you help somehow? Immediately got a reply, yeah, we're on

156
00:15:28,180 --> 00:15:33,120
board. We love this. Originally they were trying to get some of the vendors to send free stuff.

157
00:15:34,580 --> 00:15:40,740
Eventually just settled on, here's a big pile of cash. So, yes, I got a bank transfer from

158
00:15:41,740 --> 00:15:47,720
PornHub for keeping my clothes on. That just seems weird. But, again, try explaining that one to

159
00:15:47,720 --> 00:15:56,260
your mother. This is really weird research. I'm generally not embarrassed or shocked or anything

160
00:15:56,260 --> 00:16:02,000
like that. But still, it's the things you see, you know, it's not necessarily for the timid,

161
00:16:02,840 --> 00:16:07,800
because people have some interesting fetishes. There are people who like the idea of a random

162
00:16:07,800 --> 00:16:10,720
anonymous person on the Internet controlling their vibrator. But that's not necessarily the

163
00:16:10,720 --> 00:16:16,820
thing. That's, you know, informed consent. That's your thing. But the vulnerabilities that

164
00:16:16,820 --> 00:16:24,700
you find are just shocking. So, not everyone knows how to do SSL if they're using it at all. User

165
00:16:24,700 --> 00:16:30,120
information, personal information disclosure, partner disclosure, GPS permissions, blah,

166
00:16:30,140 --> 00:16:38,940
blah, blah. Almost, I'd say at least half, if they're doing SSL, allow all host name verifier,

167
00:16:39,680 --> 00:16:40,700
which basically turns off. So, you know, it's a little bit of a, you know, it's a little bit of a

168
00:16:40,700 --> 00:16:44,380
way to turn off SSL certificate checking. So, you can stick any certificate in there for easy

169
00:16:44,380 --> 00:16:49,320
man in the middle. So, why did you implement SSL in the first place? You just turned it off,

170
00:16:49,400 --> 00:16:54,400
basically. A lot of these devices, when you think about it, you know, a spouse that's

171
00:16:54,400 --> 00:16:57,960
traveling for work or something, you know, they're probably using them in hotels, which are

172
00:16:57,960 --> 00:17:03,080
shared networks a lot of times. So, I don't know if anybody here has ever done sniffing on

173
00:17:03,080 --> 00:17:08,240
wireless networks, but it's amazing what other people will be doing. It's amazing how many

174
00:17:08,240 --> 00:17:09,260
people watch porn in airports.

175
00:17:12,220 --> 00:17:17,620
Yeah. User enumeration, you can find variations of this where you can basically find out if a

176
00:17:17,620 --> 00:17:25,480
certain e-mail address has an account there for whatever purpose. So, with Lovince, you could

177
00:17:25,480 --> 00:17:29,640
basically do a simple query and it would just come back with true or false. No authentication, no

178
00:17:29,640 --> 00:17:35,660
tokens required, no nothing. Anyone on the Internet can just do a get request and, you know, it

179
00:17:35,660 --> 00:17:36,480
comes back with true or false.

180
00:17:37,860 --> 00:17:43,800
So, I took my personal address book of about 275 addresses and ran that through, just proof of

181
00:17:43,800 --> 00:17:53,040
concept. I have some friends with some surprising interests. I didn't know. But this shows you can

182
00:17:53,040 --> 00:17:58,480
find out things about people that maybe they don't want to share. So, one of them was a friend

183
00:17:58,480 --> 00:18:03,860
doing Bluetooth research and had some of the Lovince devices. He didn't know about my projects.

184
00:18:03,860 --> 00:18:08,040
So it's really funny to email him and say, dude, why do you have these? And he's like,

185
00:18:08,140 --> 00:18:13,660
holy shit, I was able to find this. I ramped it up the Ashley Madison dump, dumped all

186
00:18:13,660 --> 00:18:20,120
the government addresses I could find. Query about 10,000. They've already had enough damage

187
00:18:20,120 --> 00:18:23,840
to their lives. I'm not going to disclose anything, but there was a handful of trues

188
00:18:24,300 --> 00:18:31,000
from very interesting places. Oh, my bod. The app has a search function for finding

189
00:18:31,580 --> 00:18:38,180
potential partners. If you do some of them, if you have a privacy bit set for public, you

190
00:18:38,180 --> 00:18:43,760
could do a partial user name search and come up in the list. If you had the privacy bit set

191
00:18:43,760 --> 00:18:48,700
to private, you had to know the entire user name. That's the only way you could connect.

192
00:18:50,260 --> 00:18:55,420
But in the GUI it limited you to, I believe, three characters is the minimum, but only

193
00:18:55,420 --> 00:18:59,260
through the GUI. If you did the query directly, single characters, which means A through Z,

194
00:18:59,400 --> 00:19:00,980
zero through nine, you now have a private user name. You don't have to do the query

195
00:19:00,980 --> 00:19:06,100
directly. You now have all the public. Lots of interesting information there. But it got

196
00:19:06,100 --> 00:19:12,820
worse because my Patawan, a student I'm mentoring, figured out that you just throw a couple of

197
00:19:12,820 --> 00:19:17,300
double quotes in that and, yeah, you click. It's like, oh, this is taking a while.

198
00:19:17,860 --> 00:19:25,980
There's a 32 meg JSON reply of everything. Private or not. Like the whole bloody database,

199
00:19:26,080 --> 00:19:30,960
like 50,000 users, here's everything. Of course, I also included the URL for the URL, but

200
00:19:30,980 --> 00:19:36,840
all the profile photos and I made the mistake of downloading all of them. I have now got

201
00:19:36,840 --> 00:19:43,680
more dick pics than I know what to do with. Some apps are more social. They have ways to

202
00:19:43,680 --> 00:19:51,860
find new friends. Sometimes the server provides more info. Like you can post, so you can

203
00:19:51,860 --> 00:19:58,440
post a vibration pattern and do so anonymously. But in the return from the server, it

204
00:19:58,440 --> 00:20:06,260
still includes the user's e-mail address. So you're not helping. An anonymous user name now

205
00:20:06,260 --> 00:20:11,900
has its associated e-mail disclosed to others for whatever sort of spam or hijacking

206
00:20:11,900 --> 00:20:17,460
purposes. But think about this. Things like cam model sites. You know, the potential for

207
00:20:17,460 --> 00:20:21,420
stalking and harassment, you know, if information is disclosed about their location or their

208
00:20:21,420 --> 00:20:28,420
private details. That's scary. Partner disclosure. Larry Pesci, he's a big fan of

209
00:20:28,440 --> 00:20:33,520
Defcon 22, showed this one. Didn't report it at the time, the bastard. But it has been

210
00:20:33,520 --> 00:20:37,920
reported and fixed now where he was basically able to, you know, query for a user name in

211
00:20:37,920 --> 00:20:45,720
your vagina and it would respond with your partner's nickname, Hacks on the Matrix. Yeah. So

212
00:20:45,720 --> 00:20:51,380
you could tell and build social graphs of who was connected to who because you could connect

213
00:20:51,380 --> 00:20:58,280
to multiple people over time and it would still report over time. Skip that one because we're

214
00:20:58,280 --> 00:21:07,560
running short on time. Yeah. I'll let you figure out what that's about. Embedded API keys.

215
00:21:07,880 --> 00:21:16,380
They're always fun. I have one that has left their admin MailChimp API key in the app,

216
00:21:16,440 --> 00:21:23,760
unobfuscated. Full access to their marketing mail lists, user, you know, subscriber lists and

217
00:21:23,760 --> 00:21:28,260
everything so you can query all that. And send mail as them if you really wanted to. So, you can

218
00:21:28,260 --> 00:21:31,120
see here why that's going to change. They're... they're not replying to my emails. I may

219
00:21:31,120 --> 00:21:32,740
have to send an email to them from themselves.

220
00:21:33,880 --> 00:21:39,780
Or just drop an out a, you know. So it's all good for a reason. Some of this is funny but

221
00:21:39,780 --> 00:21:45,960
there is serious concerns. Uh, screen privacy should be in all IOTs. Especially these devices.

222
00:21:46,280 --> 00:21:51,560
As you see, this is a quick few examples. There are a lot more where they're not. The

223
00:21:51,560 --> 00:21:56,300
industry, literally, does not know what they don't know. They have been hardware manufacturers

224
00:21:56,300 --> 00:21:58,240
of manually operated devices, manual devices and functional desktop hardware.陽

225
00:21:58,240 --> 00:22:03,640
until very recently, they don't have people like us around to say, hey, that's not a good

226
00:22:03,640 --> 00:22:09,760
idea. They just are never interacting with us. So I'm trying to build some bridges to wake

227
00:22:09,760 --> 00:22:14,480
them up to the reality and when you hand them their 50,000 user database on a silver platter,

228
00:22:14,540 --> 00:22:19,920
you have their undivided attention. Yes, this means I have a bag full of sex toys to travel

229
00:22:19,920 --> 00:22:26,440
with, but for me this is a serious issue. And the difference between screwing around and

230
00:22:26,440 --> 00:22:33,880
science is writing it down, so. Yep. Basically, several of the vendors that I'd helped have

231
00:22:33,880 --> 00:22:38,100
actually approached me and wanting to start some sort of trade group or consortium or

232
00:22:38,100 --> 00:22:46,420
something like that to adopt a voluntary privacy and security set of standards that they

233
00:22:46,420 --> 00:22:51,800
then would adhere to through like a third party audit or some sort of transparency report to

234
00:22:51,800 --> 00:22:55,800
basically say, hey, we take security seriously, here's how we take it seriously.

235
00:22:57,500 --> 00:23:04,380
Full disclosures and having vulnerability disclosure programs. It makes consumers aware,

236
00:23:04,660 --> 00:23:08,900
yes, there are risks, yes, we are dealing with them. It's not just ignoring them or anything

237
00:23:08,900 --> 00:23:13,060
like that. Still trying to figure that out. I don't know if it's going to be a seal of approval

238
00:23:13,060 --> 00:23:20,640
on the box. You see my face on there. It's secure. Still trying to figure out how to do it

239
00:23:20,640 --> 00:23:25,800
because I have no idea what I'm doing with this project. It's a new area for me. There's other

240
00:23:25,800 --> 00:23:30,380
other things like, you know, Google Play and the App Store, Apple App Store, they will ban

241
00:23:30,380 --> 00:23:37,180
adult apps for random reasons. Well, then that means you break the update cycle. So, yes, the

242
00:23:37,180 --> 00:23:43,080
manufacturer may fix an issue, but it's not getting pushed out. So you have to, you know,

243
00:23:43,080 --> 00:23:46,240
people have to sideload apps and stuff like that, so you're making them turn off security.

244
00:23:46,520 --> 00:23:53,280
I'm like, that's dumb. Data collection in, from users in places where sex toys are

245
00:23:53,280 --> 00:24:00,080
illegal. I believe one of the southern states, it is still, I believe, Texas, it is illegal to

246
00:24:00,080 --> 00:24:06,360
own more than six sex toys. So I won't be going to Texas any time soon. But, you know, you can

247
00:24:06,360 --> 00:24:11,340
see how data harvesting might be an issue. Physical harm, as we found out with Samsung, you

248
00:24:11,340 --> 00:24:16,700
know, lithium ion batteries burst into flames. Considering where these things are generally

249
00:24:16,700 --> 00:24:21,700
put, that would make your day suck. And I'm waiting for things like the first divorce case

250
00:24:21,700 --> 00:24:23,260
to say, you know, oh, yeah, I'm going to have sex with you. I'm going to have sex with you.

251
00:24:23,260 --> 00:24:28,920
The guys, the app, remote vibrator app was connected to a secretary's device, not his wife's,

252
00:24:28,920 --> 00:24:33,120
you know, like that sort of thing. So, anyways, hope that convinced you that there are some

253
00:24:33,120 --> 00:24:36,740
serious issues here. Because they're not regulated like medical devices, there are no

254
00:24:36,740 --> 00:24:41,620
standards or anything like that. So as the public, we have to hold them to said standards.

255
00:24:43,000 --> 00:24:47,760
Get over the discomfort. You know, these are the exact same chipsets that are in so many, like,

256
00:24:47,760 --> 00:24:52,800
fridges and children's toys and everything like that. It's just different packaging. We need

257
00:24:52,800 --> 00:24:53,140
your help.

258
00:24:53,260 --> 00:24:59,600
To educate people and say, hey, guys, let's raise the bar. So if you're interested in this,

259
00:24:59,700 --> 00:25:05,760
I will be around. I'm trying to organize a hackadong, probably at the IoT village to, you

260
00:25:05,760 --> 00:25:10,660
know, people can start taking apart apps and give you some help there. If you're good at, like,

261
00:25:10,680 --> 00:25:15,160
policy writing and stuff like that, I could really use some help for, like, the voluntary

262
00:25:15,160 --> 00:25:20,800
framework. Buy me a beer so I can wipe away some of the memories of the things I've seen. And

263
00:25:20,800 --> 00:25:23,120
we also have a Patreon to just offset the few.

264
00:25:23,120 --> 00:25:29,080
We have for, like, you know, server time and software and that. All right. Cool. Thank you.