Event

Eiliko vendor claims vulnerabilities fixed, but reporter's test finds intrusion still possible

1 reports · 1 sources

After The Verge reported serious security vulnerabilities in its products, Energize Lab, the parent company of the Eiliko robot toy, issued a statement saying it had confirmed the core issues identified in the report. It will hire an independent security firm to conduct a comprehensive review of its systems, and has already shut down external access to the backend, rotated access credentials, disabled the interface that allowed remote modification of the robot's replies, taken the long-term memory and custom avatar features offline, and will delete stored conversation records, user profiles, and avatar images; the long-term memory and custom avatar features will not be restored until the review confirms they are secure. However, the reporter's testing found that the vulnerabilities remain: when Energize Lab responded by email, customer audio recordings and photos were still stored at publicly accessible web addresses with no protection whatsoever; security researcher Azdoufal said he still had full SSH access to these robots and could in theory still read conversation records and modify the toy's behavior.