In the age of the Internet of Things, safe sex means more than just taking measures to protect yourself from STDs.
It also means ensuring your connected sex toys are protected from cyberattack, and that you are wary of scammers who have no concerns about taking advantage of people using online sites to find a love connection. More and more items from our everyday lives are being connected and automated — from kitchen appliances to lights to home entertainment to doorbells to vacuums, and now adult toys for the bedroom.
In a time when pandemics and stay-at-home orders are keeping people apart, more are engaging in remote sexual engagements that take advantage of the technology. But be aware — if you are using a sex toy that is considered an Internet of Things device or uses Bluetooth technology, it can be hacked.
“There are literally thousands of connected sex toys in the market right now, but not all of them are safe,” says Tony Anscombe, Chief Security Evangelist with ESET Canada. “It is important that consumers understand that some things you maybe don’t consider IoT or Smart Home can have vulnerability or privacy issues. We should be cautious about everything we connect to the Internet, especially devices that are very personal and may be sharing extremely sensitive personal information.”
ESET Latin America researchers Denise Giusto Bilic and Cecilia Pastorino investigated security flaws in sex toys, and discovered disturbing findings, including vulnerabilities to a so-called “Man-in-the-Middle” attack where an uninvited third party hijacks a Bluetooth signal to take control of a device, and storage of personal information — name and location, contact details, photos, videos, sexual preferences and perhaps financial data — that could be subject to a security breach.
The possibility of a stranger taking control of a remote sex toy also creates a new form of sexual assault as they are making unwanted intrusions into one’s sexual activities.
However, just like a condom can help stop the spread of STDs, there are protective measures people can take to ensure their sexual experiences stay between them and their partner.
- Clandestine Account Information — Be sly when entering information to register and create an account. Use a fantasy name and create a new email address that cannot identify you.
- Be Discreet — If you are going to share images or videos, avoid sharing content where your face or unique markings can make you easily identifiable. And do not post remote control tokens on the Internet.
- Keep it Updated — This goes for all of your Internet of Things devices, but ensure the firmware is updated. These updates often fix bugs and vulnerabilities to ensure the most current version is the safest. Many of th4se devices also connect though an app, which should be updated as well.
- Stay Close to Home — It is advisable to use connected sex toys in a protected environment — like your home where your personal network can provide an extra layer of defence against intruders. Public places like a bar or nightclub or areas where a lot of people are passing through — like hotels — are a big risk for unwanted exposure.
- Test it Out — Before buying a connected sex toy, get on a search engine and see if it has been subject to security concerns in the past. It is also advised to download the app that operates the toy to get an idea of how it operates, what kind of information it collects and if it is secure.
- Authenticate — When researching your purchase, see if there is an authentication step. This will greatly enhance the cybersafety of the toy.
- Provide your own Protection — Just like wearing a condom, provide your own protection when engaging with a connected sex toy by ensuring your smartphone is fully updated and has a security solution installed. Protect your home WiFi network with strong passwords, securely encrypted algorithms and regular updating of the router’s firmware.
- Read the Fine Print — We know the tendency for everybody is to skim through any terms of agreement to get to the “Agree” button, but when it comes to connected sex toys, take the time to read the privacy policy. This should tell you what personal data is being collected, shared and stored.
“If you share something on one of these sex toy apps, at some stage it might become public,” says Tony. “So make sure it can’t be traced back to you in any way. The only safety you should be worried about is a safe word.”
Guest Post: ESET Canada Researchers Discover Thousands Of Email Servers Under Seige
Posted in Commentary with tags ESET on March 11, 2021 by itnerdThe number of groups exploiting the latest Microsoft Exchange vulnerabilities continues to grow, with more than 5,000 email servers in 115 countries affected
ESET researchers in Canada have discovered a potential threat to 5,000 Microsoft Exchange business and government email servers around the world.
Although the exact number of those affected by the vulnerability is unknown, ESET researchers estimate the number could reach hundreds of thousands of compromised servers globally. According to public sources, several important organizations, including the European Banking Authority, have suffered from this attack.
The threat comes from 10 different groups that were exploiting vulnerabilities in Microsoft Exchange to allow the cyberattacker to take over any reachable Exchange server, without the need to know any valid account credentials, making Internet-connected Exchange servers especially vulnerable. Microsoft has been alerted about the compromise and has since released patches to address and correct the vulnerabilities for Exchange Server 2013, 2016 and 2019.
“The early action of several threat actors using these vulnerabilities suggests these groups had access to the details of the vulnerabilities before the release,” says Matthieu Faou, Malware Researcher who is leading ESET’s research effort into the recent Exchange vulnerability chain. “Although it is unclear how the distribution of knowledge regarding the exploit happened, it is inevitable that more and more threat actors, including ransomware operators, will have access to it sooner or later.”
ESET has identified more than 10 different threat actors that likely leveraged the recent Microsoft Exchange RCE vulnerabilities in order to install malware like webshells and backdoors on victims’ email servers. In some cases, several threat actors were targeting the same organization.
The identified threat groups and behavior clusters are:
With these risks identified, Faou suggests patching all Microsoft Exchange servers as soon as possible, including those not directly exposed to the Internet. In case of compromise, admins should remove the webshells, change credentials and investigate for any additional malicious activity.
“The incident is a very good reminder that complex applications such as Microsoft Exchange or SharePoint should not be open to the Internet,” advises Faou.
For more technical details about these attacks exploiting the recent Exchange vulnerabilities, read the blogpost “Exchange servers under siege from at least 10 APT groups” on ESET’s WeLiveSecurity blog.
1 Comment »