Transcription performed by LeahTranscribes[FULL TRANSCRIPT]
[INTRO MUSIC]
REPORTER: It’s Tuesday, December 15, 2015, and a suspect has been arrested in the VTech Kids’ Toy Hacking case. UK police slapped the cuffs on a 21-year old man just a few hours ago as part of an ongoing investigation into the hacking. Estimates indicate almost 6.5 million kids’ profiles and almost five million adult accounts were compromised in what might be described as the most unscrupulous hack to hit headlines in years. No credit card info was obtained but children’s names and addresses are said to have been accessed, which aside from being a black eye on VTech, is just straight up creepy. The suspect hasn’t yet been named but something tells us his next few days behind bars probably won’t be so enjoyable. Happy holidays, creep.
[INTRO MUSIC]
JACK (INTRO): This is Darknet Diaries, true stories from the dark side of the internet. I’m Jack Rhysider. [INTRO MUSIC ENDS]
JACK: Kids today see their parents using tablets and phones and they want to play, too. [BACKGROUND MUSIC] Toy makers have tried to capitalize this by offering child-friendly tablets and smart watches. These kid-friendly devices are online and connected to the internet just like any other tablet. They have features that let the child send messages from their tablet to their parent’s phone. Not just chats, though.
The kid can send pictures, videos, or voice recordings. VTech is one maker of these kind of kid-friendly devices. They make tablets and phone apps that are specifically designed for kids. When you buy a VTech tablet it asks you to register the device. They ask for the parent’s name and the physical address as well as the username and password. Then the toy tablet also asks for the child’s name, if they are a boy or a girl, and what their birthday is. It even suggests you take a picture of the child using the tablet to set up a profile. This registration allows the parent’s phone to connect to their kid’s tablets. The technology VTech created that connects a parent’s phone to a kid’s tablet is called Kid Connect. VTech also created its own app store called The Learning Lodge where you can use their tablet to download apps, games, and books. Take a guess at what happens when hackers get ahold of these toy tablets.
They end up pushing the tablets to the limits. There’s a forum dedicated to hacking the VTech tablets. People have been able to do all sorts of things. One hacker took the thing apart and with a soldering iron, was able to get into the underlying operating system which is Linux. From there, the hackers were able to get root access to it. Then eventually, someone showed us they got the little toy tablet to play Doom, that old PC game from the 90s. The hardware hacker community is often heard saying if you can’t open it, you don’t own it. Just like it’s legal to do work on your own car, it’s also legal to modify the electronics you own. You may void the warranty but it’s not illegal to take it apart and do whatever you want to it. As this forum grew in popularity it eventually attracted a different kind of hacker. Instead of a hardware hacker, this guy was a network hacker. He browsed around and found the tablets talk frequently to a website called planetvtech.com. He took a look at that website and almost immediately found it was vulnerable to SQL injection.
SQL injections are the number one risk websites face. It takes advantage of weak code and tries to exploit the underlying database. Network hackers like this are often already equipped with loads of scripts and programs that automatically execute attack. Out of sheer curiosity, with a few key strokes, this hacker ran a script against planetvtech.com which attempted to exploit SQL. To his surprise, it worked. He had shell access to the website. A few keystrokes later, he then had root access. He said to himself, quote, “Holy fuck. I have root. That was easy. What can I find?” End quote. He had full access to the planetvtech.com website. 100 percent control of it. Once the hacker was in the web server he took a look around. He saw numerous other servers on the VTech network, including a database server. He was able to hop into the database and when looking around there, he found the database was huge. The hacker grabbed a copy of everything in the database, downloaded the whole thing, then moved on to another database and grabbed a copy of everything there, too. The hacker then disconnected from the VTech servers. [MUSIC ENDS]
He knew he had committed a crime and a wave of nervousness swept across him. This breach occurred around November 16, 2015. The hacker was equal parts disappointed and excited. He thought getting into the VTech network was way too easy. In a very short time he was able to take all the contents of their multiple databases. [MUSIC CONTINUES] With a copy of the VTech database on his own computer, he was able to slowly go through it and see what data he had. The first thing he noticed was a table called Parent. It had the following fields: First Name, Last Name, E-Mail Address, Encrypted Password, Secret Question, Secret Answer, Home Address, IP Address. As the hacker looked, he realized this is the entire user database for everyone who’s registered at the site. There were 4.8 million people listed in this table. He could not believe his eyes.
A list of 4.8 million user accounts would be a hot item on the dark net. A list this large could bring in some decent Bitcoin but the hacker had no intention on selling the data. The hacker took another look at the database and found another interesting table called Member. It contained children’s names, birthdays, gender, and their parent’s ID. The hacker realized by combining the two tables he could positively identify what the last name of the child was and where they live. This table contained the information of 200,000 children. By looking at the birth dates, the average age of the child was five years old. Hacker turned his computer off and took a walk to think about what to do. He was much more angry than he was excited. He was angry that VTech was so careless with securing their site and with the personal information of so many children so easily obtained. It became clear to the hacker that he had to get VTech to admit that they have a security problem and to fix it. Having such lax security for personal children data was unacceptable to the hacker so he began thinking of ways to fix the problem. He could go in and fix it himself but that wouldn’t teach VTech how to keep it secure in the future. He thought about reaching out to VTech but he thought they’d never listen to him, or they’d try to fix it and deny it was ever a problem. The hacker took a few days to think about what to do.
He decided to tell the media. This way the story will break worldwide and VTech would have to solve the problem fast. He decided to reach out to Lorenzo Franceschi-Bicchierai, a reporter for Vice’s Motherboard. Motherboard is a news outlet specifically covering stories related to computers and Lorenzo had been breaking a lot of really great stories about breaches. Many security reporters provide numerous ways for people to reach them anonymously, sometimes through signal or using PGP e-mails, encrypted chat, or other means. The hacker connected with Lorenzo securely and asked to remain anonymous. He gave Lorenzo the 4.8 million user records and the 200,000 children records and asked him to break the story. He clearly told Lorenzo that he was an ethical hacker and had no intention on using this data for anything malicious. The hacker told Lorenzo, quote, “Profiting from database dumps is not something I do, especially not if children are involved. I just want issues made aware and fixed. It was pretty easy to dump so someone with darker motives could easily get it. Frankly, it makes me sick that I was able to get all this stuff. VTech should have the book thrown at ‘em. They have shitty security.” End quote.
Lorenzo now had the burden to figure out what to do. The first thing he tried to do is determine if the hacker is telling the truth and if this data is new and legit. The worst thing a reporter can do is falsely accuse someone of wrongdoing. That would be slander. That would ruin the reporter’s reputation, so Lorenzo send the dump to Troy Hunt to validate it. Troy is a security researcher most famously known for running the website haveibeenpwned.com. Troy obtains as many e-mail dumps as he can. These are giant lists of e-mail addresses that are seen in security breaches. He then turns his list into a public service to allow anyone to search his website to see if their e-mail address was part of a breach. At first you may think a site like that is a phishing scam, and some are, but Troy has proven himself to be ethical and legit. He and his website are trustworthy. He has over four billion e-mail addresses in his database which he gathered from all public breaches. Troy took a look at this new dump from Lorenzo. He found the password field wasn’t encrypted in the database like it said it was.
Instead the passwords were stored using a basic unsalted MD5 hash. Without going into too much detail of what MD5 is, just know it’s bad security practice to store your passwords this way. Some MD5 hashes you can simply Google and find the password. There are super computers that can brute force an MD5 hash and crack it fairly quickly. Storing passwords as MD5 hashes is a severe lack of security. Troy was at first shocked by this. He then went to the website to see what it looked like. He immediately noticed the site doesn’t use HTTPS anywhere, not for authentication or the API, nothing. He also noticed the site was running ASP 2.0 which by that time had been unsupported by Microsoft for over four years. He also noticed some parts of the website were leaking more information than they should, returning errors with surprising results. A failed login message would actually show the SQL query used to log in. Troy was shocked by the details he could gather simply by using the site and not even trying to hack it.
The dump passed the sniff test for Troy, but at almost five million user records, he wanted help to verify the contents were legit. Troy’s website Have I Been Pwned? was wildly successful and he offered an additional service; not only could you check your e-mail to see if it had been in a breach, but you could also give him your e-mail and he’ll notify you if it shows up in any future breaches. By this time Troy had almost 300,000 subscribers to this e-mail watch list. Troy looked through his subscribers and tried to find any that also showed up in the VTech user dump. He did, in fact, find many matching e-mail addresses so he reached out to those people. He asked if they had a VTech account and asked if the home address and ISP were accurate. This is what their responses were. “Yes, that’s accurate. I did register at VTech so I could download add-ons for a toy laptop.” “Yes, that is accurate. It’s an old address. I was at that ISP at that time so I can verify the info. I would have used the VTech website for my daughter around that time, too.” “Yes, I did access VTech Learning Lodge in 2014 after purchasing Cora Cub for my child. In order to personalize its voice-activated feature you had to join The Learning Lodge.” At this point, Troy was convinced the dump was legit and told Lorenzo what he found.
JACK: By this time Lorenzo had already reached out to VTech multiple times. Over and over, Lorenzo was getting no response or being redirected to somewhere else. Eventually, days later, Lorenzo got the following response from a VTech spokesperson named Grace Ping. Quote, “On November 14, an unauthorized party accessed VTech customer data on our Learning Lodge app store customer database. We were not aware of this unauthorized access until you alerted us.” End quote. VTech claims they received the e-mail from Lorenzo, found evidence of the hack the next day, then three days later issued a press released and notified their customers through e-mail. Their initial press statement was vague and unclear as to what was taken and who was impacted. It also said the passwords were encrypted but technically MD5 hashing is not an encryption method. The date didn’t line up either because the data in the dump was time-stamped two days after they said the breach took place.
But they did take down the following websites: planetvtech.com, vsmilelink.com, and sleepybearlullabytime.com. Taking these websites down must have been a big decision for VTech. Imagine the app store being down on your phone for over a month. No updates, no downloads, no sending messages between devices. Their toys lost major functionality during that time but the company did the right thing by shutting the servers down. If not, they would have attracted many other hackers and had a much bigger catastrophe on their hands. Once the vulnerable websites were offline and a press statement was issued, Lorenzo then published his article indicating VTech suffered a data breach. He published all the details of what the hacker had given him. Troy Hunt followed up with a scathing blog post of his own. The news spread quickly of VTech’s poor security controls. Parents around the world were outraged their children’s information was leaked. VTech is a company based in Hong Kong but they have a large market in the US, Spain, UK, Germany, and France. VTech’s stock began to tumble.
Troy was also facing an ethical dilemma. His website haveibeenpwned.com allowed users to search e-mails that were seen in public data breaches. He added the 4.8 million e-mail addresses to his site but refused to make the children’s names searchable. The hacker who broke into VTech took another look at the data he grabbed. To his surprise he found even more data than he initially realized. There was a certain directory that had 190 gigabytes of data. As he looked through it he found it contained over 100,000 pictures that children took with their tablets, watches, or laptops. Many of these photos were duplicates, blurry, or just black so it was hard to guess as to how many actual photos there were. The hacker looked further through the files he took. He found there were chat logs which went back a whole year. Theses would be all chat messages that were sent between the child’s tablet and the parent’s phone. Looking at the data even further, the hacker found a directory full of audio files. He opened one and played it. This is what he heard.
CHILD: I pledge allegiance to the flag of the United States America and to the Republic for which is stands, one nation under God and [inaudible].
JACK: There were thousands of recordings like this. These are recordings of kids talking into their tablets. The hacker reached back out to Lorenzo and gave him the 190 gigabytes of photos, the years’ worth of chat logs, and numerous voice recordings. A few days later Lorenzo published a second article on Motherboard with these new findings. We are now able to see redacted pictures of children and hear their voices. This adds salt to VTech’s wounds. More parents are realizing their child’s personal information was not kept safe. The hacker told Lorenzo he was pleased with the way that news stories were spreading awareness of the problem. Quote, “It is as much coverage as I had hoped for.” End quote. The hacker went on to say he might move to a new target. Quote, “Maybe into VTech’s competitors, I don’t know.” End quote. On December 1, two weeks after the breach, VTech published an FAQ. It contained more information about the hack. VTech claims that not just 200,000 children accounts were taken, but instead that number was 6.3 million children accounts.
But VTech did not admit than any photos were taken. Then US Senators Edward Markey and Joe Barton sent VTech a letter pointing at The Children’s Online Privacy Protection Act, otherwise known as COPPA, an act established in 1998 to protect children online. Their letter also consisted of nine questions they wanted VTech to answer such as what information do you collect on children under twelve? What do you use that information for? Do you sell any of that to anyone? What encryption is used to secure the data? VTech didn’t immediately respond but they eventually updated their FAQ to answer some of these questions. A week after the breach VTech hired a security firm called FireEye to help with incident response. FireEye was able to find the security issues and resolve them. On January 25, two months after the servers were taken down, they were partially restored. Users could update and register their devices again but still could not use the app store.
A month after the breach, a specialized crime unit in England caught and arrested a 21-year old man in a town west of London. He was arrested on a suspicion of unauthorized use of a computer outlining The Computer Misuse Act of 1990. The crime unit also seized multiple electronic items found. They also mentioned this may be related to VTech but the press release did not say the name of the man they arrested. Lorenzo attempted to reach out to the hacker but he never got a response. Two months after the breach, Lorenzo was attending an electronics trade show and found one of the booths was VTech. They were launching a brand new line of products. These weren’t for kids, though. They were selling smart light bulbs, door sensors, and security cameras. When Lorenzo asked the VTech marketing director if it’s secure, he said they are quote, “going through penetration tests by a third party and everything is going to be very secure.” End quote.
The next month, VTech changed the terms of service on their website. It now read, in all capital letters, YOU ACKNOWLEDGE AND AGREE THAT ANY INFORMATION YOU SEND OR RECEIVE DURING YOUR USE OF THIS SITE MAY NOT BE SECURE AND MAY BE INTERCEPTED OR LATER ACQUIRED BY UNAUTHORIZED PARTIES. It appears that VTech thinks they can relieve themselves of any misdoings by simply letting their customers know their data may be insecure and hacked at any time. A few lawyers commented on this and believe a clause like that won’t hold water in the US or UK, citing things like COPPA laws. Numerous politicians and state attorneys contacted VTech to discuss the COPPA laws in detail. VTech has updated their privacy policy to be more compliant with COPPA. For instance, they now state in their privacy policy that all pictures and voice messages are encrypted when stored. VTech’s stock was on a downtrend before the breach and after the breach the stock dropped by 13 percent. Within three months it was back above where it was before the breach. Their toys continue to be sold in major toy stores around the world.
In the following weeks after the breach, several upset parents sued VTech North America. The suits were consolidated into a single, class action lawsuit. Plaintiffs included eight adults and fourteen children. A year and a half later, in July 2017, the case went before a judge. VTech asked the judge to dismiss the case, which the judge granted. He dismissed the case because the plaintiffs could not show how they were harmed. The judge could not find any proof that identity theft or any damage was done to the plaintiffs. The judge cited Lorenzo’s article, saying the breach was done by someone who did not have any intention to use the data in a malicious manner. There’s an update to this story. On January 8, 2018, the FTC did find VTech to have violated COPPA laws. VTech agreed to pay the $650,000 fine imposed by the FTC but they also issued a press release saying they haven’t violated any laws. They’re also required to revise their security program and conduct security audits for the next twenty years. [MUSIC] We have not seen the contents of this dump show up on any dark net site. This leads me to believe the hacker upheld his promise and not try to profit from the data he stole.
The VTech FAQ had a question on it asking what happened to the hacker who was arrested. For over a year the FAQ simply referred people to the press release put out by the crime unit that arrested him. The press release had very little information. It didn’t even include his name. In December 2016, over a year after the breach occurred, VTech updated their FAQ with a different answer to this question. It said the man who was caught simply received a formal police caution in November 2016. If this is true it means he was detained for a full year before receiving a police caution. Police cautions are usually reserved for minor crimes to sometimes save on filling out full police reports, but still put the crime on the record. Perhaps FAQ has a typo on the year. Even now, two years later, it’s still unclear exactly what happened to the hacker. We don’t know if he was arrested or not. We don’t even know his name or his status. If he did only receive a police caution, then the story’s over. But he might still be sitting in jail somewhere. While the hacker did commit a crime, his intention was simply to be a whistle blower with his primary goal of improving the security of children’s data. [OUTRO MUSIC STARTS] You’ve been listening to Darknet Diaries. For show notes and links, check out darknetdiaries.com. Music is provided by Ian Alex Mac, Kevin MacLeod, and Chris Zabriskie.
[OUTRO MUSIC ENDS]
[END OF RECORDING]