The Cybersecurity of Smart ‘Adult’ Toys, or Lack of It

The Cybersecurity of Smart ‘Adult’ Toys, or Lack of It

Speakers: [Speaker's Name Not Provided in Input]

Conference: RSAC 2024

YouTube: https://www.youtube.com/watch?v=igId0BB4Yy0

Overview

This talk delves into the often-overlooked and highly sensitive realm of cybersecurity vulnerabilities within smart adult toys. Delivered at RSAC 2024 by a seasoned researcher in IoT and smart device security, the presentation courageously tackles a topic frequently shrouded in societal taboos. The speaker meticulously uncovers a disturbing array of security flaws, ranging from trivial default passwords to critical code execution vulnerabilities, highlighting how these issues directly compromise user privacy, facilitate blackmail, and even pose risks of physical harm.

The significance of this research cannot be overstated. As connected devices proliferate, personal privacy becomes increasingly fragile, particularly when intimate aspects of life are digitized. This talk serves as a critical warning about the severe consequences of manufacturers neglecting security in products that handle exceptionally sensitive user data. It underscores the urgent need for robust security by design in all IoT devices, regardless of their perceived niche, and offers crucial insights for users, developers, and organizations grappling with the expanding frontier of digital privacy.

Background

▶ Watch: Introduction, content warning, and societal taboos (0:00)

The concept explored in this talk, which the speaker refers to as Teldic, is not new. Coined in 1975 by Ted Nelson, renowned for inventing "hypertext," Teldic describes the idea of remote, connected intimacy. While the underlying concept has a history, its modern manifestation through smart adult toys has introduced a complex layer of cybersecurity challenges that are often ignored due to the societal taboos surrounding the subject. The speaker candidly acknowledges these barriers, noting the difficulty in openly discussing such intimate topics.

The speaker’s personal anecdotes vividly illustrate the unique challenges and sensitivities involved in researching these devices. These include embarrassing encounters with airport security when traveling with a "dangerous bag" of connected devices for research—such as a connected tea kettle alongside a connected vibrator—and receiving peculiar product recommendations from online retailers. The speaker also proudly claims to have given "the world's only R-rated TED Talk" on this subject, which YouTube subsequently deemed unsuitable, further emphasizing the controversial nature of the domain.

The motivation for this deep dive into smart adult toy security stemmed from observations of the growing popularity of connected pornography, immersive experiences, cam modeling, and online sex parties. A pivotal moment for the speaker was a conversation with a senior US military official, who revealed the significant adoption of these devices within the military, raising immediate concerns about potential national security implications and personnel vulnerability. The COVID-19 lockdowns also saw a "huge uptick" in sales, as individuals sought ways to maintain intimate connections during isolation or simply cope with loneliness, further accelerating their market penetration.

However, this increased adoption has brought with it a grim reality of risks. The speaker recounted sobering instances where poor security in adult toys led to severe real-world harm, including cases of individuals being blackmailed, extorted, or, in one tragic instance, committing suicide due to the exploitation of their personal data. These incidents underscore that the security vulnerabilities discussed are not theoretical; they have tangible, devastating impacts on human lives, making the research presented in this talk profoundly important.

Key Findings

▶ Watch: R-rated Ted Talk and challenging societal norms (2:40)

The research presented uncovered a pervasive lack of security across a range of popular smart adult toys and associated applications, revealing multiple critical vulnerabilities that compromise user privacy and safety. The key findings include:

1. Early Love Device Flaws: An early model, the "Early Love," was found to create temporary image files of intimate sessions in publicly accessible directories on Android SD cards. Furthermore, it utilized a default Bluetooth PIN that was unchangeable, typically 0000, making it trivially accessible to anyone within Bluetooth range.

1. Lush 1 Encryption Deception and Vendor Negligence: The "Lush 1" device, despite manufacturer claims of no data passing through their servers and encryption, was discovered to transmit a significant amount of data unencrypted. It also lacked any PIN protection, remaining perpetually in discoverable mode. When vulnerabilities were ethically disclosed, the vendor's response was slow and ultimately resulted in a decision not to patch the old, vulnerable app, despite it still being used by a substantial portion of their customer base.

1. Buttplug.io Code Execution (External Research): Research by another security professional, building upon firmware analysis, demonstrated that it was possible to achieve code execution on devices utilizing the Buttplug.io framework. This opened the door to highly malicious attacks, including the potential for ransomware to "hold a but plug hostage" and, more alarmingly, the ability to cause physical damage by forcing batteries to overheat, posing a fire risk.

1. Cam Model Plugin Vulnerabilities (External Research): A cross-site scripting (XSS) bug was discovered in a Chrome plugin commonly used by cam models. This vulnerability could be exploited to launch Denial of Service (DoS) attacks, disrupting a model's livelihood, or, if a username could be enumerated, to achieve remote system compromise and take control of the model's device via the API.

1. Remote Toy Hijacking: A critical vulnerability was found that allowed for the remote hijacking of an adult toy. While the iPhone version of the app required the attacker to be on the same local network, the Android version permitted hijacking from "anywhere in the world," granting unauthorized control over an intimate device.

1. Location and Employer Privacy Breach: A significant privacy concern emerged from smartphone apps that would continually "ping outbound" to adult toy servers even when the toy itself was not connected and the user was not actively using the app. This meant that if a user connected their phone to a corporate Wi-Fi network, their employer's firewalls could detect these requests, inadvertently revealing personal activities and potentially leading to uncomfortable HR situations or disciplinary action.

1. Thex (Light) Static PIN and ID Exposure: The "Thex (Light)" device exhibited similar flaws to others, featuring a static Bluetooth PIN and remaining constantly in pairing mode. It also transmitted a link containing a static ID, which, if intercepted, could grant unauthorized access to the device.

1. Bluetooth/Wi-Fi Advertising ID Exposure: Perhaps one of the most pervasive and subtle privacy risks identified was that many smart adult toys broadcast identifiable Bluetooth advertising IDs or Wi-Fi SSIDs. This means that anyone within Bluetooth or Wi-Fi range—neighbors, family members, or even strangers in public spaces—could scan for these signals and determine not only that a person owns a smart adult toy but sometimes even the specific type of device (e.g., "that but plug" identified by its unique Bluetooth ID). This constitutes an involuntary and widespread disclosure of highly personal information.

Technical Deep Dive

▶ Watch: Real-world harm from adult toy security flaws (4:18)

The technical vulnerabilities identified across various smart adult toys highlight a systemic failure in implementing fundamental security principles. These issues range from insecure defaults and weak authentication to flawed data handling and a lack of encryption, collectively creating a landscape ripe for exploitation.

Starting with the Early Love device, the primary technical flaw resided within its Android companion application. This app was observed creating temporary image files, presumably snapshots or records of intimate sessions, and storing them in publicly accessible directories on the device's SD card, such as /sdcard/DCIM/ or similar. On older Android versions, or if permissions were improperly configured, any other application installed on the user's phone with SD card read permissions could access these highly sensitive images without the user's explicit knowledge or consent. This vulnerability underscores a common pitfall in mobile development: assuming that local storage is inherently private or securely partitioned. Compounding this, the device utilized a fixed Bluetooth PIN, typically 0000. This hardcoded, widely known credential meant that any individual within Bluetooth range, possessing basic technical knowledge, could establish an unauthorized connection to the device and potentially control it, completely bypassing any user-intended authorization.

The Lush 1 device presented a different but equally critical set of issues. Despite explicit assurances from the manufacturer that "no data passes through our servers" and that communications were encrypted, technical analysis revealed that a significant volume of sensitive user data was transmitted unencrypted over the network. This exposed communications to eavesdropping and man-in-the-middle (MitM) attacks, where an attacker could intercept, read, or even alter the data flowing between the app and the device. Furthermore, the Lush 1 operated without any PIN protection and remained continuously in a discoverable pairing mode, making it an open target for unauthorized connections from anyone within Bluetooth proximity. The manufacturer's subsequent decision not to retire the old, vulnerable application, even after releasing a new one used by 80% of their customers, exemplifies a severe lapse in responsible security practices, knowingly leaving a substantial user base exposed.

A particularly alarming finding, attributed to research by another professional, involved devices leveraging the Buttplug.io open-source library. Through in-depth firmware analysis and reverse engineering, it was demonstrated that these devices were susceptible to code execution vulnerabilities. This means an attacker could potentially upload and run arbitrary malicious code on the device's microcontroller. The implications are profound:

• Ransomware: An attacker could implement a form of "toy ransomware," rendering the device unusable until a ransom is paid.
• Physical Harm: More critically, the research speculated that an attacker could manipulate the device's internal components, such as forcing the battery to overheat. This could lead to thermal runaway, potentially causing the battery to catch fire or explode, posing a direct physical threat to the user.

The realm of cam model plugins also revealed significant vulnerabilities, specifically a cross-site scripting (XSS) bug within a Chrome browser plugin. XSS allows attackers to inject malicious client-side scripts into web pages viewed by other users. In this context, it could be used for:

• Denial of Service (DoS): Disrupting a cam model's live stream or session by crashing their browser or plugin, thereby impacting their income.
• Remote System Compromise: If an attacker could enumerate the cam model's username, the XSS vulnerability could be chained with other exploits to "pop their system remotely," gaining a remote shell or full control over their computer.
• API Hijacking: The research also noted the ability to take control of the cam model's device remotely through its API, likely due to weak or absent authentication on the API endpoints.

The issue of remote toy hijacking further demonstrated critical flaws in application security. While the iPhone version of a particular app required the attacker to be on the same local network (implying a local network-based attack vector, perhaps exploiting UPnP or mDNS), the Android version allowed for hijacking from "anywhere in the world." This suggests a vulnerability in the app's cloud-based communication or remote control protocol, likely involving weak authentication, predictable session IDs, or unauthenticated API endpoints, enabling an attacker to send control commands to a user's device from across the globe.

A subtle yet deeply invasive privacy breach was identified through the constant outbound pings from smartphone apps. Even when not actively connected to a physical toy, these apps would regularly send network requests to their respective adult toy servers as long as Wi-Fi was enabled on the phone. The critical scenario arises when an employee brings their personal phone, with such an app installed, into their workplace and connects to the corporate Wi-Fi. Corporate firewalls and network monitoring systems, designed to track outbound traffic for security or policy enforcement, could easily detect these pings to known adult toy servers. This inadvertently reveals highly personal activities to an employer, regardless of company policy or the employee's intent, creating significant privacy dilemmas and potential professional repercussions.

Finally, devices like Thex (Light) demonstrated a combination of common vulnerabilities. It featured a static Bluetooth PIN and remained perpetually in pairing mode, making it easily accessible to nearby attackers. Additionally, it was found to send a link containing a static ID, which, if intercepted (e.g., via network sniffing or Bluetooth observation), could be used to gain unauthorized access to the device. The most pervasive technical flaw, however, was the broadcasting of identifiable Bluetooth advertising IDs and Wi-Fi SSIDs. Many smart adult toys broadcast unique identifiers that clearly indicate their brand or type (e.g., a specific Bluetooth ID might resolve to "that but plug"). This means that anyone with a Bluetooth scanner or Wi-Fi analyzer in proximity—be it a neighbor, a family member, or someone in a public space—can passively detect the presence and often the specific type of an adult toy, leading to an involuntary and non-consensual disclosure of deeply personal information about the device owner. This highlights a fundamental design flaw where device discoverability is prioritized over user privacy.

Demo / Proof of Concept

▶ Watch: First device demo: "Early Love" and security issues (4:50)

While the speaker referenced a "dangerous bag" containing various smart adult toys intended for demonstration, it was noted that one of the key devices planned for a live demonstration was currently broken. Consequently, the talk focused primarily on detailing the discovered vulnerabilities and their implications rather than conducting live exploits.

However, the comprehensive description of each flaw, including specific device names, the nature of the vulnerability (e.g., static Bluetooth PINs, unencrypted data, outbound pings), and the precise methods of exploitation (e.g., intercepting static IDs, scanning for Bluetooth advertising IDs), effectively served as a detailed proof-of-concept. The findings themselves demonstrated the existence and exploitability of these security weaknesses, providing concrete evidence of the pervasive issues within this category of connected devices. The speaker's ability to detail these findings with such specificity, referencing direct observations and research, validates the claims without the necessity of a live, on-stage demonstration.

Defensive Implications

▶ Watch: Ransomware and physical harm potential in smart toys (6:40)

The widespread and severe vulnerabilities in smart adult toys demand a multi-faceted defensive strategy involving users, manufacturers, and even organizations.

For Users:

• Be Privacy Aware: Understand that these devices handle exceptionally personal data. Research the manufacturer's privacy policy thoroughly before purchase.
• Scrutinize App Permissions: Carefully review and limit the permissions granted to companion apps on your smartphone. If an app requests unnecessary access (e.g., location when not required for core functionality), reconsider its use.
• Understand Network Behavior: Be aware of when your device and its app are transmitting data. Disable Bluetooth and Wi-Fi on the device and your phone when the toy is not actively in use to prevent inadvertent broadcasting or data leakage.
• Avoid Corporate Networks: Do not connect personal devices or use apps associated with smart adult toys on employer-provided networks. Assume that corporate firewalls and network monitoring can detect such traffic, potentially leading to professional repercussions.
• Change Default Credentials: If the device allows, immediately change any default Bluetooth PINs or passwords to strong, unique credentials.
• Consider Offline Alternatives: If privacy is paramount, opt for non-connected or locally controlled devices that do not transmit data over networks.
• Firmware Updates: Regularly check for and apply any available firmware or app updates, though this sector often lags in providing timely security patches.

For Manufacturers:

• Security by Design: Embed security and privacy considerations from the initial product design phase, rather than as an afterthought.
• Robust Encryption: Implement strong, end-to-end encryption for all data in transit and at rest. Claims of encryption and data privacy must be verifiable and rigorously tested.
• Secure Authentication: Provide strong, user-configurable authentication mechanisms (e.g., complex, changeable PINs; multi-factor authentication) instead of static or absent credentials.
• Minimize Data Collection: Adhere to the principle of least privilege for data – collect only the data absolutely necessary for the device's intended function.
• Responsible Vulnerability Disclosure: Establish a clear, accessible, and responsive process for handling security vulnerability reports from researchers. Act promptly and transparently to address identified flaws.
• App Lifecycle Management: When releasing new, more secure applications or firmware, ensure a clear migration path for users and actively sunset older, vulnerable versions. Do not leave a significant portion of your user base exposed.
• Privacy-Focused Defaults: Devices should not be in perpetual pairing mode or broadcast identifiable information by default. Users should have explicit control over discoverability.

For Organizations/Employers:

• Review Acceptable Use Policies: Update organizational policies to address the use of personal IoT devices on corporate networks, recognizing the unique privacy implications of smart adult toys.
• Balance Security with Privacy: While network monitoring is crucial for security, organizations must consider the ethical implications of detecting highly personal, non-work-related traffic. Develop clear guidelines for how such information, if inadvertently discovered, will be handled to respect employee privacy.
• Educate Employees: Provide general cybersecurity awareness training that includes discussions on personal device privacy and the risks of connecting personal IoT devices to corporate networks.

Key Takeaways

• Pervasive Security Failures: Smart adult toys suffer from fundamental cybersecurity flaws, including static/absent authentication, unencrypted data transmission, and the exposure of highly personal information.
• Severe Real-World Consequences: These vulnerabilities are not theoretical; they lead to tangible harm, such as blackmail, extortion, physical injury (e.g., battery overheating), and tragic cases of suicide.
• Involuntary Privacy Breaches: Devices inadvertently broadcast identifiable information (Bluetooth IDs, Wi-Fi SSIDs) and app activity (outbound pings), revealing highly personal usage patterns to neighbors, family, or employers without user consent.
• Manufacturer Negligence: Many manufacturers exhibit poor security practices, make misleading claims about privacy, and are often slow or unwilling to address reported vulnerabilities, leaving users exposed.
• Critical User Vigilance Required: Users must exercise extreme caution, understand the technical behavior of their devices and associated apps, and prioritize privacy by managing connectivity and scrutinizing data practices.
• Call for Responsible Design: There is an urgent need for manufacturers to adopt security-by-design principles, implement robust encryption and authentication, and manage the entire product lifecycle with user privacy and safety at its core.

About the Speaker(s)

The speaker, whose name was not provided in the conference metadata, is a highly experienced and prominent researcher in the field of IoT (Internet of Things) and smart device security. They have a demonstrated history of engaging with challenging and often taboo topics, particularly concerning the cybersecurity of connected intimate devices.

Known for their candid and mature approach to sensitive subjects, the speaker has presented on this topic multiple times, often encountering unique situations, such as embarrassing airport security checks involving their research devices. They are also notable for having given what they claim to be "the world's only R-rated TED Talk" on the subject, which YouTube subsequently took down due to its content, highlighting their pioneering work in this controversial area. The speaker's research is characterized by a commitment to ethical disclosure, as evidenced by their efforts to report vulnerabilities to manufacturers. Their insights are grounded in deep technical analysis, including firmware reverse engineering, and a keen awareness of the real-world human impact of security flaws.