Security Analysis of Satisfyer Sex Toys

by qdot76367 • 5 years ago

61 42 5 years ago

petee5• 5 years ago

Well right off the bat,

"find new friends and exchange messages and images. Given the nature of this app, it’s quite interesting that Google Play allows everyone above 13 to download and use this app." -- gross and disturbing, since other users can control the device.

Edit: haha, apparently downvoted by two pedophiles

pc86• 5 years ago

Serious question: Does Google Play support/allow 18+/adult-only apps? Not via those apps' terms but through the Play Store itself. Because if - as I suspect - they don't, your comment seems mostly like a pedantic application of terms that obviously don't really apply in this particular situation.

sp332• 5 years ago

The Play Store in the US users ESRB ratings including "Mature" (17+) and "Adults Only". But it doesn't allow apps that "contain or promote pornography". It's possible there's a carve-out for actual sex as a health-related app category if it's not too erotic.

petee5• 5 years ago

Allowing 14 year olds to use an app to control a sex toy is still disgusting, and a policy allowing it is equally disgusting. Policy should be changed then.

And anyone downvoting dare to actually have a conversation about what you find so acceptable about allowing kids to use this app? To be clear, I don't care about votes, but it's certainly a curious topic to downvote quietly

petee5• 5 years ago

I can't edit it now, but in retrospect, calling other HN users outright pedophiles was inappropriate, and uncalled for. I should have chosen a better retort

bin_bash• 5 years ago

Kudos for displaying some remorse. It’s rare to see that online.

cebert• 5 years ago

This brings a whole new meaning to the term “pen testing”.

tbrownaw3• 5 years ago

This article does not seem to use the word "dildonics". :(

igetspam• 5 years ago

I think you mean "teledildonics."

tbrownaw3• 5 years ago

...yes, yes I did.

h2odragon• 5 years ago

Based on the debug messages, I’ve started to build a file that can be flashed on the device. I’ve lost interest in that shortly after

ohboy. Aftermarket retuned lovebot firmware. "Celebrity personality" modes, maybe.

eightysixfour• 5 years ago

An Open Source firmware for these things already exists: https://buttplug.io/

grp000• 5 years ago

Great choice of a domain.

nvr2192• 5 years ago

The buttplug.io project lead posts on hn sometimes.

zxcvbn4038• 5 years ago

“Who does Number Two work for!?” — Austin Powers

boomboomsubban• 5 years ago

06/18/2021: Received notification that this issue might be addressed in the future.

What a reply to a vulnerability notice. It has been two months since then, have they fixed it?

tbrownaw3• 5 years ago

So, why is IoT security like this?

Is it just people who aren't used to deploying to a maliciously hostile environment suddenly having to deal with that?

I've heard that hardware-side pay tends to be lower than software-side, so is it hardware companies not wanting to pay for experienced software people?

Is it actually not any worse than typical software, but just more noticeable because meatspace?

spywaregorilla• 5 years ago

It's because people who aren't used to deploying to a maliciously hostile environment don't deal with it and deploy anyway

AlotOfReading2• 5 years ago

In my experience it's a combination of a few things. First is time. Consumer electronics has very aggressive release schedules and development cost constraints. That means the software is usually the cheapest, quickest junk someone could throw together. There usually isn't the time or the money to create the kinds of process infrastructure that allows you to produce secure code. Worse, vendor support on much of this stuff is usually outdated garbage and the more deeply embedded, the worse it is.

Also there are just some plain bad practices floating around. I once had a manager who refused to allow version control and would simply remote into my computer overnight to delete any files they didn't personally like. Think any careful, security-conscious work got done in that environment?

elliekelly• 5 years ago

I think part of it too is that they don’t have to care. Most customers don’t know enough to care and they don’t have any legal obligations with respect to security so why bother?

gridspy• 5 years ago

Wow. My commiserations!

Ironically such paranoid control of file use must have left you wanting to "back up" your work onto alternate storage. Naturally said backups would go offsite with you each night.

ThrowawayR2• 5 years ago

"So, why is IoT security like this?"

Cheap consumer IoT devices cut corners on everything so the developers too just do the absolute minimum to make it work, security be damned.

For industrial / commercial IoT devices, you have both low-level (e.g. device driver) devs who know squat about running a secure network making design decisions and customers with extremely low quality IT staff who also make poor design decisions with respect to security and also ignore firmware updates even when they contain security fixes.

It's just a mess all around.

ikr678• 5 years ago

Hardware side anything will always have higher fixed costs (unit production, physical QA, more healt & safety &compliance testing) and lower margins compared to a 100% software company.

rsynnott• 5 years ago

In the early days of Android smartphones, there were a lot of very basic security holes: https://forum.xda-developers.com/t/root-security-root-exploi...

I always attributed it to consumer electronics company developers who'd never previously had to touch the icky internet not realizing how dangerous it was; this was the sort of mistake that the likes of Microsoft were making in the late 90s.

I expect the state of IoT security is similar; as it matures it'll improve.

lanbanger• 5 years ago

It seems that 66 is the maximum value for the vibration level.

Missed a huge opportunity to make it 69.

a3w• 5 years ago

has been but plugged here before: https://news.ycombinator.com/from?site=bananamafia.dev

(does that pun work?)

Borrible• 5 years ago

One can not be too anal about security.

Security Analysis of Satisfyer Sex Toys

Related Stories