Do your gadgets have ears? Why IoT regulation must include data privacy
summary
Shows concrete failures: a Samsung Smart TV sent audio in plaintext to Nuance (USA); the My Friend Cayla doll is a Bluetooth headset with Bluetooth without PIN allows mic activation and an app containing a 1,536-word "Z_bad_word" list and a database encrypted with a static key; Fisher‑Price Chatterbox repeats the no‑PIN Bluetooth bug; a Swan camera uses predictable device IDs so swapping an ID gives full video/audio access; kids’ tracker watches have an auth flaw exposing all devices and allowing GPS spoofing, mic/speaker control; firmware research using binwalk to extract firmware and arbitrary code injection shows ransomware and covert audio exfiltration—regulation needs real enforcement.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 1:25IoT privacy risks in devices
- 2:28Samsung TVs listening without consent
- 3:31My Friend Kayla doll privacy issues
- 6:44Regulation inspired by Kayla case
- 8:30Fisher-Price Chatterbox Bluetooth flaw
- 9:54Swan camera authorization flaw
- 12:00Kids tracker watches data exposure
- 15:31Ransomware on embedded devices
- 18:02Hot tub platform vulnerabilities
- 19:05Car alarms with microphones
- 20:29Regulation enforcement needed
- 21:33Conclusion
related talks
34mThe Cybersecurity of Smart ‘Adult’ Toys, or Lack of It
01h 07mToys that listen.
30mVulnerabilities in the Internet of Things
30mHousehold INFOSEC in a Post-Sony Era #bbuzz
23mCan you keep a secret? or Privacy in the Digital Age
01h 01mThe Internet of Pwned Things
54mSecuring Your In-Ear-Fitness Coach: Challenges in Hardening Next Generation Wearables
34mAvoiding legal privacy and security snafus with big data and the IoT