Eiliko Robot Toy Exposes Millions of User Conversations and Children's Data, Researchers Find

Millions of conversations exposed

Eiliko, a small robot toy made by manufacturer Energize Lab, transmits everything users say over Wi-Fi to servers in China, where the data sits with little protection. Security researcher Sammy Azdoufal discovered that the company's service was completely unprotected, giving him access to a complete transcript of a 10-minute conversation within minutes of a reporter having it with the toy.

According to Azdoufal's findings, the exposed database contained 13 million conversations from tens of thousands of people, along with apparent access to the active worldwide fleet of 68,000 robot toys. The data showed the largest market is the United States, where more than 31,000 profiles belong to children.

Detailed profiles stored insecurely

The service does more than collect IP addresses and rough locations. Azdoufal found that it reads user conversations and builds profiles that can include a person's name, age, birthday, profession, family, friends, pets and personality traits. In one example from the database, a 52-year-old customer service worker was described with personal details that the researcher said could be useful to scammers.

Energize Lab was also storing email addresses alongside a searchable full-text database of everything users had said. Searches for sensitive terms surfaced snippets of people asking about death. Some photos of children, captured with a camera-equipped sibling product, and short audio recordings were stored unencrypted at public web addresses, despite the company's privacy policy stating that recordings are deleted immediately after processing.

Company response and hijacked personalities

The Verge and Azdoufal spent over a month trying to contact Energize Lab through 10 different email addresses and LinkedIn. The company never answered questions, offering only a robotic customer support reply. Many of its admin passwords matched entries on common password lists, according to the report.

Azdoufal also demonstrated that he could remotely hack a toy's memory and hijack its AI personality from the other side of the globe. In one test, the robot made false claims to a reporter, and in another it was made to adopt an abusive persona overnight. The researcher said a hacker could do the same to the entire fleet of robots simultaneously. Azdoufal is working with Tod Beardsley to publish nine official CVE vulnerability reports for Energize Lab.

Sources: The Verge