In an age where digital companions are increasingly integrated into our lives, the promise of a friendly, interactive robot can be incredibly appealing. Enter Eiliko, the charming, marshmallow-like robot designed to mirror your moods with its expressive face. But beneath its cute exterior lies a chilling reality: Eiliko, and its manufacturer Energize Lab, are reportedly compromising the privacy of tens of thousands of users, storing intimate conversations and personal data on unsecured Chinese servers, ripe for exploitation by hackers.
The Illusion of Secrecy: A Journalist’s Discovery
The alarm bells first rang for Sean Hollister, a senior editor at The Verge, who purchased an Eiliko from Amazon. During a seemingly innocuous 10-minute conversation with the bot, Hollister asked, “Do you ever tell anybody else what I’m saying?” Eiliko’s reassuring reply – “Your secrets are safe with me” – proved to be a stark deception. Within minutes, a complete transcript of their conversation, along with millions of others, was accessible to an ‘accidental hacker’ on the other side of the globe.
This wasn’t an isolated incident. The investigation revealed access to 13 million conversations from tens of thousands of individuals, spanning an active global fleet of 68,000 robot toys. Disturbingly, data indicates that over 31,000 of these profiles belong to children, with the United States being the largest market.
Meet the Accidental Hacker: Sammy Azdoufal
The individual behind this groundbreaking discovery is Sammy Azdoufal, known for his previous revelations about the vulnerabilities in smart devices. Azdoufal, who previously exposed how hackers could remote-control DJI robot vacuums, access Meari baby monitors, and locate unprotected photo IDs, stumbled upon Eiliko’s flaws during a trip to Japan. Intrigued by the popular robot charms, he bought one and quickly uncovered the shocking truth about Energize Lab’s service.
A System Utterly Unprotected
Azdoful’s findings were damning: Energize Lab’s service was not only completely unprotected but also actively engaged in profiling its users worldwide. This wasn’t merely about collecting IP addresses or general location data; it was a deep dive into the personal lives of its users.
Beyond Basic Data: Intrusive User Profiling
The extent of data collection by Eiliko is profoundly disturbing. Azdoufal discovered that the service literally reads and analyzes conversations to construct detailed user profiles. These profiles include sensitive information such as names, ages, birthdays, professions, family details, friends, pets, and even personality assessments. For instance, one profile described a 52-year-old customer service worker named Lucy as “kind, empathetic, hardworking, values friendship and trust,” but also noted she “has difficulty trusting family members” and “currently feels isolated.”
This level of intimate data, stored alongside email addresses, IP addresses, and a searchable, full-text database of every confidential utterance, presents a goldmine for scammers and malicious actors. Azdoufal demonstrated the ease with which one could search for terms like “suicide” and retrieve deeply personal snippets of conversations.
Unencrypted Photos and Audio: A Breach of Trust
The security lapses extend even further. Energize Lab has reportedly stored unencrypted photos of children – likely users of Eiliko’s camera-equipped larger siblings – at publicly accessible web addresses. Short audio recordings of users, despite the company’s privacy policy explicitly stating that “recordings are encrypted and transmitted to our service partners… and are deleted immediately after processing completes,” were also found stored at public web addresses. These recordings, though often garbled, included snippets like “Hey Eilik, go fishing,” “Hi Eilik,” “Eilik, sleep,” and even a 45-second recording with a baby crying in the background.
The company’s apparent disregard for security is underscored by its use of easily guessable admin passwords, reminiscent of those found on “most common passwords” lists. Furthermore, Energize Lab reportedly failed to take Azdoufal or The Verge’s concerns seriously when initially contacted about the massive security breach.
Energize Lab’s Silence and the Broader Implications
Despite extensive efforts by Sean Hollister to contact Energize Lab through multiple channels over a month, the company remained unresponsive. This silence, coupled with the egregious security failures, paints a worrying picture of corporate negligence in the burgeoning smart toy market.
The Eiliko case serves as a stark reminder of the critical importance of data privacy and cybersecurity, especially when it involves devices marketed to children. Consumers must exercise extreme caution and demand transparency from manufacturers about how their personal data, and that of their families, is collected, stored, and protected. The charming facade of a digital pet should never come at the cost of your deepest secrets.
For more details, visit our website.
Source: Link
Leave a comment