Next speaker, hacks banks by day and other random things at night, currently sex toys. The
focus of his talk today is to explore the under research branch of IOT and the security and
privacy threats that exist. So to present on his talk of IOT of dongs, ladies and gentlemen,
RenderMan. Hello. So yes, I am RenderMan, this is Murdock Monkey. Just so you know, I did
a little biohacking on my liver last night and so when I was working on the slides, I guess
you forgot to hit save. So I was just sitting in the back hacking together something so if
this seems a little disjointed, I apologize. This is a serious talk. Let's try to be adults
here, vaguely. I mean, there are no children in here, right? Okay, good, I don't want to pay
therapy bills. So yes, Internet of Things. We all know about it. Manufacturers not, you know,
the security on them is terrible. They don't have a way to update them or they just don't
care. Users don't consider the security and privacy of using these things until it's way
too late. Groups like I Am the Cavalry are doing amazing work on, you know, automotive,
medical, but nobody wanted to touch sex toys for some reason. So, but, you know, I'm not
sure. This shows that IOT is permeating every part of our lives, including one of the most
private bedroom activities. So yes, sex toys are now being connected to the Internet. For a lot
of people, that's, like, they can't grok that, you know, initially, let alone that there's,
you know, security issues. Basically what we're looking at is sex toys, Kegel exercisers,
general rings. If it goes into your genitals, your genitals go into it or it goes around
genitals, that's when we're worried. Those are the devices we're worried about, so.
A large number of IOT research firms, yeah, they didn't want to look at this, because, you
know, there's stigmas around sex. We have a very weird thing in North America about sex, you
know, we'll watch all the violence we want on television, but, you know, you can't see two
people have sex. Like, makes no sense to me. So it started basically because I had the idea
rolling around in my head for about ten years. Happened to mention it to the purveyor of a adult
toy store back home in Edmonton, and she was like, this is a good idea. I do all these in-home
demonstrations and, you know, it's like a Tupperware party but different kind of rubber made.
But it's like, yeah, I've got some, you know, old models, you know, ones where the batteries
don't work or broken power connector and that, and gave me these old demo ones. And, yeah,
started diving into this stuff and shit got real, real quick, because when you now realize it, the question is, is hijacking the remote control, you know, is it just a
tool of a connected sex toy, sexual assault? I hear that uncomfortable giggling, but, no, think about it. You know, you, you know, you have a
partner, you give them permission to control this device, someone else hijacks the connection, that person does not have
permission, that fits the definition of sexual assault. There has been several cases of rape by deception, where it was
like, you know, if your twin brother has sex with your wife kind of thing. It's very interesting, because it's, they usually are dismissed on some sort of
technicality. Again, I'm not a lawyer. I really want to put an interesting query into the EFF about this. Canada's sexual assault laws
specifically define, you cannot, consent obtained by fraud is not consent. So, in this case, yes, if you're impersonating someone, you know, by hijacking
their account or whatever.
Yes, that is not, you know, consent goes to the person on the other end, not the account. But it gets really weird when you start looking at laws
because these are devices that are voluntarily used. It's the same data that, you know, their intimate partner would be sending, but not by that
same person, but if the, you find out that it wasn't the person you thought it was controlling it, the emotional horror and trauma
from that is, you know, should not be anywhere dismissed or, or
less than a physical assault, so. Um, probably all heard about the WeVibe lawsuit after
DefCon last year. Um, for those of you who weren't around, a Goldfiskin follower did a talk
where they found a number of issues with the, the WeVibe. Um, full disclosure, I had actually
put in the exact same talk, came to the exact same conclusions as them. Uh, they got
selected. Uh, they were first time speakers. I've spoken way too many times here. Um, all
boiled down to they didn't have the right privacy policy in the app. It basically was the
privacy policy from their website. So it didn't, you know, I was mentioning cookies and stuff
like that. It didn't disclose, you know, some of the information that they were collecting
from the app and the device. And yeah, they got nailed to the wall because hey, you know, if I
had known that this was doing this, I wouldn't have bought it. Deceptive advertising and
such. Absolutely no evidence of, of malfeasance. You know, data didn't leak. They weren't
abusing.
It, you know, weren't doing dossiers on users or anything. Um, it was just literally a
paperwork oversight. So the biggest lawsuit regarding all this stuff had absolutely nothing to
do with, you know, actually technical privacy or security, but just legal paperwork. Uh, they
settled for five million dollars in a class action lawsuit. Um, and uh, we should be finding
out in the next two, three weeks, uh, how much, uh, people actually get out of that. Um, it
could be up to ten grand if you, do you know what I'm saying? Um, so, uh, so, uh, the, the
government was really strong to use the app and the, the device. Um, the interesting part is
WE CONNECT was actually one of the better apps even before all this. You know, they were one of
the best ones I had tested. Um, you know, they still had some issues, but yeah, they were
actually doing SSL, um, at least half-ways right. Um, they were, you know, doing a lot of
things that, uh, you would expect. Um, after they, uh, got hit with this lawsuit and the, the
Goldfisk followers talk, they stepped up and basically completely re-engineered their app.
It's now kind of like the gold standard I have for other vendors. It's like you need
to be doing all the stuff that they're doing. You know, they got rid of things like you
don't need to create an account to use it. So there's no personal information being collected
there. Allows for, you know, you start it up the first time, it says, hey, would you
like to opt out of anonymous data collection? Cool. You know, gives people the chance right
there the first time. Looks like they're actually doing certificate pinning. Like, holy crap.
Still some issues. My favorite is that you still can't visit their website over SSL. Like,
I've been hammering on that for, like, 18 months and they still have not gotten back to me
at all. It's just, it's hilarious. I also heard about the CMEI, which is the
CMEI controversy. This is a vibrator with an embedded webcam. Hey, I don't judge, you
know. Basically, it's because it's doing video, it needs bandwidth. And so it uses Wi-Fi.
When you start it up, it becomes its own access point. So you connect your tablet, phone,
whatever, to it. So it's not actually connecting to the Internet or anything like that. It's
so you can, you know, view the stream, control it from your phone. It's basically, it's an
RA link system on a chip running BusyBox. Interesting to note, yeah, I smuggled my GPG key
chain across the border on a dong. Because there's about eight megs of storage available on
here, so. Proof of concept. I had to do it. I've also, there's the embedded web server and,
yes, I have actually hosted a website, you know, an Internet on a dong. .
Literally all it is, is a reworked, you know, cheap Chinese IP camera that they, you know, made
fit in the particular container. That's a picture of my nose. Pentest partners, Ken Monroe, is
he here? Nope? Okay. He's probably over at IoT Village. Literally this thing was in the air from
Amazon when they released their report. So, you know, I've actually, you know, I think, you know, I've
they had found all the same things I had already in the software. I didn't have the hardware
yet to confirm the last few. While the report was factually correct, there was a lot of
innuendo and jokes and just juvenile humor. They released it under a pseudonym of, you
know, Bill DeJure. It's like, really guys? You know, come on. We're professionals here. So
I took some exception with that, posted a rebuttal saying that yes, your evidence of risk
was true, but you blew it out of proportion. Like, oh my God, these things are Wi-Fi, so
they're broadcasting to anyone and, you know, wardrivers can pick this up and add it to
Wiggle.net. I show a screenshot of Wiggle.net. Well, if you actually log in to Wiggle and use
the CMEI SSID and search, you find two. Both of them are roughly the same location outside a
four-story sex shop in downtown Tokyo.
So out of, Christ, I forget how many they're up to. They're like, you know, 600 million access
points cataloged. Two. And it's, you know, demo stuff in, like, an incredibly packed part of
town. So, like, yeah, the risk is very, very minimal on that. Yes, there was a default pin
that, interestingly, their previous software didn't give you any way to change it or none of
the instructions. It would tell you repeatedly, change the password, change the password. I'm not
sure how. So I posted this rebuttal and, you know, working with Ken Monroe and that, they made a
bunch of press, but unfortunately, you know, this whole project didn't get mentioned, so I'm
like, Ken! But, no, it got them on the same page, but it shows that people are paying
attention, you know, that the public is now considering this. So vendors were already freaked
out by the WeVibe suit. Seeing this, you know, getting dragged through the mud didn't help them
at all. You see? It's also a great example because they had tried to, you know, do a coordinated
disclosure with the vendor, but they never replied. Like, this is why you need vulnerability
disclosure programs that actually are acted upon. Problem of these things is that you have,
you know, the potential for really dumbass regulations and stuff like that. I mean, you've got
some 70 or 80-year-old geriatric, you know, congressman. Or senator trying to figure out this
this technology and it's like, oh, my God, that's like, oh, my God, you know, sex. You
know, considering that they're probably also doing their secretary or something. You know,
it's like you're looking for solutions to a problem that doesn't exist. It may not be your
thing, but doesn't everyone deserve privacy and security in what they do? Even if you don't
agree with it. If not, you're wanting people to be hurt. You're a terrible human being. And
so Internet of Don.GS, if in case you're wondering, .GS is South Sandwich Islands. So I had
actually inquired with some friends that do issue CVEs. There's a big thing with, like, IOT
stuff. They don't know how to issue a CVE for some of it because it's, you know, using other
project software, but, you know, it's only for this device, it's configuration. So I was
like, screw it. So I'm doing Dong Vulnerability Exposure IDs. And I'm like, you know, I'm
going to do it. Mostly for my own sanity, when I was submitting things, it would be like a half
a dozen things that I wanted to make sure that none of them were forgotten. So having, you
know, an identifier helped. But also the reports, you know, you can actually start seeing what
sort of issues are happening. I've already helped a number of vendors build Vulnerability
Disclosure and Management programs. Because if somebody finds something, why the hell aren't
you just making it easy to report? They're giving you free work. Like, you know, it's
a good thing. It makes sense. Again, nonjudgmental. Just want to see, have people, you know,
use these things privately and securely. So the vast majority of these are Bluetooth.
Bluetooth LE is the only Wi-Fi one. They pair to a smartphone or a tablet for local
control, but also as a gateway for remote control via the internet. A few have some desktop
applications as well. XMPP is a very common control channel on these. It's a very common
one. Provides, you know, text chat functions as well. But they'll also do text, audio, and
video chat. Like, they're full-fledged, you know, video teleconferencing, and telebildonics
suites. So lots of interesting attack surfaces there when you think about it between the
text, the audio, and the video. Almost always there's some sort of interaction with a company
server for brokering the connection or, you know, finding each other or something. But, you
know, it's trying to convince vendors that it's, like, you know, it's not going to work. You
need to be as hands-off as you can possibly be. Because, yes, it might be easier to do things
this way where you tag, you know, unique identifiers to everybody. But, no, that's where
things get weird. So the more hands-off you can be, the better. Basics. Yeah. We're all
pretty familiar with how this sort of thing should work. So, so far, 27 vulnerabilities
reported. 17 fixed, though I haven't checked in the last week. Four vulnerabilities reported.
Four complete or partial user databases. Two complete remote hijacks. One set of GPS
locations for all users that were online at the time. I've got eight vendors that are on board
with doing vulnerability disclosure programs. I'm helping them basically to realize, hey, you're a
software company now, whether you want it to be or not. You're going to have to do certain
things. Four have reached what I consider a trusted partner level and means that they have a
very good and well-established vulnerability disclosure program. Four of them are on board with a
security program. They're being proactive and just fully embracing the idea that, okay, we need
to be secure. Twenty-two test devices in this, you know, lovely hand-cut foam case, which is really
fun as carry-on. One corporate sponsor and a very confused mother. So, yes, we were
supported by PornHub. Wait, you're all familiar with it? I thought it was just some obscure little site.
Drunken e-mail to their marketing people saying, hey, here's the project. Going to buy some of
these devices. They're expensive. Can you help somehow? Immediately got a reply, yeah, we're on
board. We love this. Originally they were trying to get some of the vendors to send free stuff.
Eventually just settled on, here's a big pile of cash. So, yes, I got a bank transfer from
PornHub for keeping my clothes on. That just seems weird. But, again, try explaining that one to
your mother. This is really weird research. I'm generally not embarrassed or shocked or anything
like that. But still, it's the things you see, you know, it's not necessarily for the timid,
because people have some interesting fetishes. There are people who like the idea of a random
anonymous person on the Internet controlling their vibrator. But that's not necessarily the
thing. That's, you know, informed consent. That's your thing. But the vulnerabilities that
you find are just shocking. So, not everyone knows how to do SSL if they're using it at all. User
information, personal information disclosure, partner disclosure, GPS permissions, blah,
blah, blah. Almost, I'd say at least half, if they're doing SSL, allow all host name verifier,
which basically turns off. So, you know, it's a little bit of a, you know, it's a little bit of a
way to turn off SSL certificate checking. So, you can stick any certificate in there for easy
man in the middle. So, why did you implement SSL in the first place? You just turned it off,
basically. A lot of these devices, when you think about it, you know, a spouse that's
traveling for work or something, you know, they're probably using them in hotels, which are
shared networks a lot of times. So, I don't know if anybody here has ever done sniffing on
wireless networks, but it's amazing what other people will be doing. It's amazing how many
people watch porn in airports.
Yeah. User enumeration, you can find variations of this where you can basically find out if a
certain e-mail address has an account there for whatever purpose. So, with Lovince, you could
basically do a simple query and it would just come back with true or false. No authentication, no
tokens required, no nothing. Anyone on the Internet can just do a get request and, you know, it
comes back with true or false.
So, I took my personal address book of about 275 addresses and ran that through, just proof of
concept. I have some friends with some surprising interests. I didn't know. But this shows you can
find out things about people that maybe they don't want to share. So, one of them was a friend
doing Bluetooth research and had some of the Lovince devices. He didn't know about my projects.
So it's really funny to email him and say, dude, why do you have these? And he's like,
holy shit, I was able to find this. I ramped it up the Ashley Madison dump, dumped all
the government addresses I could find. Query about 10,000. They've already had enough damage
to their lives. I'm not going to disclose anything, but there was a handful of trues
from very interesting places. Oh, my bod. The app has a search function for finding
potential partners. If you do some of them, if you have a privacy bit set for public, you
could do a partial user name search and come up in the list. If you had the privacy bit set
to private, you had to know the entire user name. That's the only way you could connect.
But in the GUI it limited you to, I believe, three characters is the minimum, but only
through the GUI. If you did the query directly, single characters, which means A through Z,
zero through nine, you now have a private user name. You don't have to do the query
directly. You now have all the public. Lots of interesting information there. But it got
worse because my Patawan, a student I'm mentoring, figured out that you just throw a couple of
double quotes in that and, yeah, you click. It's like, oh, this is taking a while.
There's a 32 meg JSON reply of everything. Private or not. Like the whole bloody database,
like 50,000 users, here's everything. Of course, I also included the URL for the URL, but
all the profile photos and I made the mistake of downloading all of them. I have now got
more dick pics than I know what to do with. Some apps are more social. They have ways to
find new friends. Sometimes the server provides more info. Like you can post, so you can
post a vibration pattern and do so anonymously. But in the return from the server, it
still includes the user's e-mail address. So you're not helping. An anonymous user name now
has its associated e-mail disclosed to others for whatever sort of spam or hijacking
purposes. But think about this. Things like cam model sites. You know, the potential for
stalking and harassment, you know, if information is disclosed about their location or their
private details. That's scary. Partner disclosure. Larry Pesci, he's a big fan of
Defcon 22, showed this one. Didn't report it at the time, the bastard. But it has been
reported and fixed now where he was basically able to, you know, query for a user name in
your vagina and it would respond with your partner's nickname, Hacks on the Matrix. Yeah. So
you could tell and build social graphs of who was connected to who because you could connect
to multiple people over time and it would still report over time. Skip that one because we're
running short on time. Yeah. I'll let you figure out what that's about. Embedded API keys.
They're always fun. I have one that has left their admin MailChimp API key in the app,
unobfuscated. Full access to their marketing mail lists, user, you know, subscriber lists and
everything so you can query all that. And send mail as them if you really wanted to. So, you can
see here why that's going to change. They're... they're not replying to my emails. I may
have to send an email to them from themselves.
Or just drop an out a, you know. So it's all good for a reason. Some of this is funny but
there is serious concerns. Uh, screen privacy should be in all IOTs. Especially these devices.
As you see, this is a quick few examples. There are a lot more where they're not. The
industry, literally, does not know what they don't know. They have been hardware manufacturers
of manually operated devices, manual devices and functional desktop hardware.陽
until very recently, they don't have people like us around to say, hey, that's not a good
idea. They just are never interacting with us. So I'm trying to build some bridges to wake
them up to the reality and when you hand them their 50,000 user database on a silver platter,
you have their undivided attention. Yes, this means I have a bag full of sex toys to travel
with, but for me this is a serious issue. And the difference between screwing around and
science is writing it down, so. Yep. Basically, several of the vendors that I'd helped have
actually approached me and wanting to start some sort of trade group or consortium or
something like that to adopt a voluntary privacy and security set of standards that they
then would adhere to through like a third party audit or some sort of transparency report to
basically say, hey, we take security seriously, here's how we take it seriously.
Full disclosures and having vulnerability disclosure programs. It makes consumers aware,
yes, there are risks, yes, we are dealing with them. It's not just ignoring them or anything
like that. Still trying to figure that out. I don't know if it's going to be a seal of approval
on the box. You see my face on there. It's secure. Still trying to figure out how to do it
because I have no idea what I'm doing with this project. It's a new area for me. There's other
other things like, you know, Google Play and the App Store, Apple App Store, they will ban
adult apps for random reasons. Well, then that means you break the update cycle. So, yes, the
manufacturer may fix an issue, but it's not getting pushed out. So you have to, you know,
people have to sideload apps and stuff like that, so you're making them turn off security.
I'm like, that's dumb. Data collection in, from users in places where sex toys are
illegal. I believe one of the southern states, it is still, I believe, Texas, it is illegal to
own more than six sex toys. So I won't be going to Texas any time soon. But, you know, you can
see how data harvesting might be an issue. Physical harm, as we found out with Samsung, you
know, lithium ion batteries burst into flames. Considering where these things are generally
put, that would make your day suck. And I'm waiting for things like the first divorce case
to say, you know, oh, yeah, I'm going to have sex with you. I'm going to have sex with you.
The guys, the app, remote vibrator app was connected to a secretary's device, not his wife's,
you know, like that sort of thing. So, anyways, hope that convinced you that there are some
serious issues here. Because they're not regulated like medical devices, there are no
standards or anything like that. So as the public, we have to hold them to said standards.
Get over the discomfort. You know, these are the exact same chipsets that are in so many, like,
fridges and children's toys and everything like that. It's just different packaging. We need
your help.
To educate people and say, hey, guys, let's raise the bar. So if you're interested in this,
I will be around. I'm trying to organize a hackadong, probably at the IoT village to, you
know, people can start taking apart apps and give you some help there. If you're good at, like,
policy writing and stuff like that, I could really use some help for, like, the voluntary
framework. Buy me a beer so I can wipe away some of the memories of the things I've seen. And
we also have a Patreon to just offset the few.
We have for, like, you know, server time and software and that. All right. Cool. Thank you.