





Pen Test Partners

Pen Test Partners

Pen Test Partners

Pen Test Partners

Pen Test Partners

A high-tech vibrator with a built-in Web-connected endoscope has been penetration tested by a UK security outfit and found to be massively insecure. The researchers demonstrated a remote attack that would grant easy access to the live video stream, and a local Wi-Fi attack that would additionally net root access and persistence.

The vibrator in question is the Siime Eye, which was released by sex toy company Svakom way back in 2015. (At the time of publishing the $250 Siime Eye is no longer listed on Svakom's website, but the page still exists if you have a direct link. You can still buy one on Amazon for about £150, though you should probably read the rest of this story first.)

In addition to its five different vibration modes, including an "intelligent mode" that "simulates vibration frequency during the whole process of sex," the Siime Eye is equipped with an endoscope-like camera and "hidden searchlight" on the tip. The idea is that you can use the camera to inspect your nether regions, or "share the wonderful sex adventure to your partner via pictures or videos."

Truthfully, the Siime Eye sounds like a fairly novel use of technology. It is a shame, then, that Svakom—or more likely some outsourced programmers—failed to secure the device properly. Or at all, really.

Based in Buckingham, Pen Test Partners (it's almost as if God himself parted the gloomy clouds over Blighty and handed us a funny story) found a variety of vulnerabilities in the Siime Eye. Starting from the top:

By probing the official Android app, they found that every Siime Eye vibrator has hardcoded login credentials. If you can join the same wireless network as the vibrator, you can simply load up a Web browser on your laptop and gain access.

Oddly, the vibrator is configured as a Wi-Fi access point, rather than a client that connects to an existing Wi-Fi network. And the SSID is a static name. You could use a wardriving site to see where in the world Siime Eye users are located.

Digging further into the Web server running on the Siime Eye, they found that the CGI files allowed for JSONP callbacks, bypassing a (badly configured) same origin policy (SOP). This let the researchers write proof of concept code that dumped a list of local Wi-Fi networks and the video stream.

The real meat of the attack was through a hidden service: with a specially crafted URL the researchers enabled a telnet server on the vibrator. Getting the root password was less easy, though: it involved opening the device up, attaching a Bus Pirate to the flash memory chip, grabbing a blob of the Linux filesystem, and eventually managing to find a hardcoded root password in the camera software.

With that information in hand, Pen Test Partners outlines two possible attack vectors. The harder route involves getting a user to install a rogue application, and then using a website JavaScript drive-by to siphon off "all video data, Wi-Fi passwords, and a list of local networks" from the vibrator. The easy attack is through locally connecting to a Siime Eye and "almost immediately getting a root shell and a video stream."

The best defence if you own a Siime Eye is to change the Wi-Fi password to something more complex, and/or get in touch with Svakom and ask for a refund. You might not have much luck contacting Svakom, though: Pen Test Partners says it tried three times to disclose the Siime Eye vulnerabilities to Svakom, starting in December 2016, but never got a response.

And thus concludes another tale from the burgeoning Internet of Compromised Things. There are some ongoing efforts to try and and improve IoT security, but adoption will likely be slow and piecemeal, especially out on the technological fringes where there's less scrutiny from security experts and journalists.

Now read about the time Amazon spitefully put a 10-inch dildo in a customer's shopping basket...