News for hackers. Stuff that matters.

A comment on German parents told to destroy Cayla dolls over hacking fears.

Re:German parents told to destroy Cayla dolls over hacking f... by acqq on Friday February 17, 2017 @11:06AM (#13669201)
From what I understand, the main problem of the doll is that, as soon it is turned on, it pairs to the first Bluetooth connection it can? That means, if the child is using it without the parents, they can't know with whom the child communicates.

Once paired, the Internet-dependent functionality is provided by the device and the app with which the doll was paired. The attacks are possible because the hacker can provide his own "server side" handling (the doll being the client).

The doll has a built in microphone and speaker.

It's the app on the mobile phone that connects to the internet and "transcripts" the voice of the questions into something that can be processed by sending it to some servers. The iOS version of the app can do 3000 transcriptions before you have to purchase more.

http://myfriendcayla.co.uk/public/downloads/cayla_FAQ.pdf

From what I read, when not paired, the doll is offline but if powered it still "talks" and "listens", just without the processing possible through the app and the servers across the internet and for EU, that's another problem: are the servers in the EU or not, are they doing special treatment of the data as it's known the data are from minors etc.

[ Parent | on HN ]
Re:German parents told to destroy Cayla dolls over hacking f... by germanier on Friday February 17, 2017 @11:32AM (#13669459)
No, the main problem is that a) it looks like a doll b) it has a microphone c) it can transmit recorded voice. That's enough to make owning that device illegal.

That it transmits the voice of unsuspecting children (who of course also have privacy rights) to who-knows-where is just the icing on the cake.

[ Parent | on HN ]