Eiliko Robot Toy Exposed Private Chats and Child Profiles on Unsecured Chinese Servers, The Verge Reports

The Verge reporter bought an Eiliko from Amazon on August 29. During a 10-minute conversation on August 30, the reporter asked the toy, “Do you ever tell anybody else what I’m saying?” It replied, “Your secrets are safe with me.” Within minutes, according to the report, Azdoufal had a complete transcript of everything the reporter had told the toy.

Azdoufal is described in the report as an “accidental hacker” who previously showed that a fleet of DJI robot vacuums could be remote-controlled, that countless Meari baby monitors and security cameras could be viewed, and that nearly a million photo IDs were sitting unprotected on the public web. This summer, he visited Japan and bought an Eiliko at Yodobashi Camera after seeing similar robot charms on people’s bags. When he tested the app, he found that Energize Lab’s service was completely unprotected and was intentionally profiling users around the world, according to The Verge.

The profiling went beyond IP addresses and approximate locations, the report said. Azdoufal found that the service read users’ conversations and created profiles containing names, ages, birthdays, professions, family relationships, friends, pets, and personality assessments. One logged profile described a 52-year-old customer service worker named Lucy as “kind, empathetic, hardworking, values friendship and trust,” but also as someone who “has difficulty trusting family members” and “currently feels isolated.” The report said such information could be useful to a hacker looking for scam targets.

Energize Lab stored the insecure data alongside email addresses, IP addresses, and a searchable, full-text database of everything users had said in confidence, according to the report. Azdoufal demonstrated that he could search for “suicide” and bring up snippets of people asking about death. In some cases, the company stored photos of children who likely used the gadgets—one of Eiliko’s larger siblings includes a camera—and those images were not encrypted, the report said. They were stored at public web addresses. Energize Lab was also storing some short audio recordings at public web addresses, including a person saying “Hey Eilik, go fishing,” an older man saying “Hi Eilik,” a child saying “Eilik, sleep,” and a 45-second recording with a baby crying in the background and the words “so sorry, have to return these within two weeks.”

The report said Energize Lab’s privacy policy states that recordings “are encrypted and transmitted to our service partners (e.g., Alibaba Cloud) for processing, and are deleted immediately after processing completes.” But the recordings and other data were stored publicly, and many of the company’s admin passwords were the kind found on a “most common passwords” list, according to The Verge.

The Verge said it spent more than a month trying to contact Energize Lab, emailing 10 addresses listed for the founder, public relations, marketing, technical support, and business development, and searching for employees on LinkedIn. Azdoufal spent even longer. Eventually, two Energize Lab employees added the reporter on LinkedIn but did not engage about the hack, the report said. Overseas sales manager Lana Lv told The Verge, “I have forwarded your massges [sic] to the technical team, if possible they will contact your team.” The only other response was a robotic “How Can We Help You?” reply from customer support, and the company did not follow up when The Verge replied, according to the report. No one stepped forward to answer the publication’s questions.