How VTech's App Failed Miserably to Protect the Data of Kids and Parents

A security researcher describes the weak cryptography and sloppy practices that led to the toy maker's epic breach.

Joseph Cox

Joseph Cox

Image via Diapers.com

Sometimes technology companies don't even bother to protect users' data, while others give it a shot, but fail miserably. VTech, a Hong-Kong based company that makes internet connected toys, falls into the latter.

On Monday, Motherboard revealed that the same hacker who had obtained the personal data of 5 million parents and over 200,000 children from VTech had also managed to get hold of potentially tens of thousands of photos of children, taken by the company's devices and stored on its servers.

Now, a researcher has found that the Android app used by parents to communicate with their child playing with a VTech product employs weak cryptography to protect its users' data and photos.

"At the weekend I reversed the Vtech kidconnect app and found this. Not surprised at the latest developments at all," tweeted the well-known pseudonymous researcher slipstream/RoL on Monday. Slipstream/RoL examined the Android version of the app, which is "for the parents' devices," he told Motherboard in an online chat.

The first mistake is how the app handles photos taken by the device. The app creates an MD5 hash of the KidConnect username, in uppercase, and a constant value. According to slipstream/RoL's screenshots, this constant is either "vtech" or "vtechvtech" every time.

MD5 is a hashing algorithm: a method for storing data in a more secure form, or checking that files haven't been tampered with. But MD5 is notoriously weak, and using the company's own name as a variable in that process likely makes the result easier to crack.

"The uppercase KidConnect username is part of the filenames of the encrypted images!" slipstream/RoL pointed out. Motherboard confirmed this to be the case with images sourced from the VTech hacker.

Slipstream/RoL found another problem for media such as photos or audio recordings—which the VTech hacker also managed to get hold of—that was embedded in the chats between VTech app users, he said.

To encrypt that data, the app combines the current time with a pseudorandom number generator: a "cryptographically insecure method," slipstream/RoL added. This is similar to a problem uncovered in certain models of Western Digital encrypted hard drives.

"Weaker random number generators are more likely to produce duplicates (for example, after 65,000 images)," Scott Arciszewski, chief development officer for Paragon Initiative Enterprises, a cybersecurity company, told Motherboard in a Twitter message.

Overall, even after a pretty catastrophic hack, things are just looking worse for VTech.

"Let's see, it uses bad encryption, it passes the hash to login, it got pwned. Yeah, not looking great," slipstream/RoL said.