Eiliko’s Cute Robot Raises Questions: Secrets Aren’t Safe on Chinese Servers Ready to Be Hacked
A toy with exposed conversations
After buying an Eiliko on Amazon, the reporter spoke with the toy over Wi-Fi. The report says that within minutes, researcher Sammy Azdoufal could access a transcript of that conversation and a much larger collection of user data.
Azdoufal reportedly found access to 13 million conversations and the active worldwide fleet of 68,000 toys. Data indicated that the United States was the largest market, with more than 31,000 profiles belonging to children.
Profiles built from private chats
The exposed information went beyond email addresses and IP addresses, according to the report. Energize Lab’s service created profiles containing details such as users’ names, ages, birthdays, jobs, families, friends and pets, as well as judgments about their personalities.
The report gives the example of a customer profile describing a 52-year-old service worker as empathetic and hardworking, while noting difficulties trusting family members and feelings of isolation. Azdoufal said the database could be searched for terms such as “suicide,” bringing up excerpts of users’ conversations.
Questions about security and recordings
The report says some children’s photos and short audio clips were available at public web addresses, without encryption. The clips included voices of adults and children, as well as a baby crying; the article notes that some recordings were difficult to understand.
Energize Lab’s privacy policy says recordings are encrypted, sent to service partners such as Alibaba Cloud for processing, and deleted afterward. The report’s findings appear inconsistent with that stated policy, because audio recordings were reportedly retained.
Key points
- Azdoufal reportedly accessed Eiliko conversations through an unprotected Energize Lab service.
- The database included 13 million conversations and profiles tied to tens of thousands of people.
- More than 31,000 profiles in the United States belonged to children.
- Some photos and audio recordings were reportedly stored at public web addresses.