Major Security Vulnerability Discovered in Eiliko Robot Toys
It has been revealed that millions of user conversations, children's photos, and profile data were stored unprotected on the servers of Eiliko robot toys produced by Energize Lab.
Security researchers' investigations have shown that the popular Eiliko robot toys stored millions of users' private data, voice recordings, and unencrypted children's photos insecurely on servers in China, and could be easily hacked.
Security Vulnerability in Eiliko Toys
Eiliko robot toys, produced by Energize Lab and attracting attention with their cute design, transmit conversations made via Wi-Fi to servers in China. Researchers stated that this system is far from protecting user data and leaves the door open for external interference.
User Profiles and Conversation Data
Examinations revealed that the system not only collects IP addresses but also creates detailed profiles such as users' names, ages, occupations, family members, and personal vulnerabilities. Information containing personal sensitivities can also be accessed in the database where tens of millions of conversation records were searched.
Children's Photos and Voice Recordings
Another dimension of the security vulnerabilities covers photos and voice recordings belonging to children. It was determined that photos taken by camera-equipped models of Eiliko were kept unencrypted on publicly accessible web addresses and that voice data was stored in violation of the privacy policy.
The Company's Unresponsiveness and Remote Hacking
Although researchers tried to report the security vulnerabilities to company officials, no response was received from Energize Lab. In tests conducted, it was proven that the personalities and behaviors of the robots could be changed remotely by accessing their memory from the other side of the world.