The Verge高级编辑Sean Hollister在10月15日发了一篇调查报道，标题是《你的秘密在这个可爱机器人玩具这里不安全，它们在中国服务器上等着被黑》。文章开头说，市面上出现了一个新的数字宠物，一个可爱的棉花糖形状的小机器人，能改变卡通表情来匹配你的情绪。但如果你或你的孩子通过Wi-Fi和Eiliko说话，它会打电话回中国。它的AI伴侣能把你告诉它的一切都存储在中国服务器上，黑客可以轻易访问甚至劫持它的人格。制造它的公司Energize Lab似乎并不在意。
The Verge senior editor Sean Hollister published an investigative report on October 15 titled "Your secrets aren't safe with this cute robot toy—they're on Chinese servers ready to be hacked." The article opens by saying a new digital pet has appeared—a cute little marshmallow-shaped robot that can change its cartoon expressions to match your mood. But if you or your kids talk to Eiliko over Wi-Fi, it phones home to China. Its AI companion can store literally everything you tell it on Chinese servers, where hackers can easily gain access or even hijack its personality. The company that made it, Energize Lab, doesn't seem to care.
记者8月29日从亚马逊买了一个Eiliko。8月30日，在一次10分钟的对话中，他问这个小机器人，你会不会告诉别人我说的话。它回答说，你的秘密在我这里是安全的。几分钟后，地球另一边的一个男人拿到了记者告诉这个玩具的全部文字记录。他不仅拿到了记者的对话，还能读取来自数万人的1300万条对话。他可以访问似乎全球整个活跃的68000个机器人玩具车队。根据数据，它们最大的市场是美国，那里有超过31000个档案属于儿童。
The reporter bought an Eiliko from Amazon on August 29. On August 30, during a 10-minute conversation, he asked the little robot, "Do you ever tell anybody else what I'm saying?" It replied, "Your secrets are safe with me." Within minutes, a man on the other side of the planet had a complete transcript of everything the reporter told the toy. He didn't just have the reporter's conversations—he could read 13 million conversations from tens of thousands of people. He could access seemingly the entire active worldwide fleet of 68,000 robot toys. According to the data, their biggest market is the United States, where over 31,000 profiles belong to children.
这个黑客叫Sammy Azdoufal，就是今年春夏在The Verge上报道过的那个意外黑客。他此前展示了可以用AI工具远程控制一支DJI扫地机器人车队、查看无数Meari婴儿监视器和安全摄像头、定位近百万张未受保护的公开网络照片ID。今年夏天，他去日本，带妻子去了一家著名的电器百货店Yodobashi Camera。他们看到很多这样挂在包上的可爱机器人挂件，决定买一个Eiliko。当他测试这个应用时，发现Energize Lab的服务完全没有保护。更糟的是，它在有意地对全球用户进行画像。
This hacker is Sammy Azdoufal, the "accidental hacker" previously reported on The Verge this spring and summer. He had shown he could use AI tools to remote-control a fleet of DJI robot vacuums, look through countless Meari baby monitors and security cameras, and locate nearly a million unprotected photo IDs on the public web. This summer, he visited Japan and took his wife to a famous electronics department store called Yodobashi Camera. They saw many cute little robot charms like this dangling from people's bags and decided to buy an Eiliko. When he tested the app, he discovered Energize Lab's service was completely, utterly unprotected. Worse, it was intentionally profiling its users around the world.
记者说，当他说画像时，他不仅仅指它在收集你的IP地址和大致居住地，虽然它也做这些。他指的是，Azdoufal发现它真的读取你的对话，并创建你的档案，包括你的姓名、年龄、生日、职业、家人、朋友、宠物，以及你看起来是什么样的人。例如，这项服务记录了一个52岁的客服人员Lucy，她善良、有同理心、勤奋、重视友谊和信任，但也有困难信任家人，目前感到孤立。这正是黑客在寻找诈骗目标时可能想要的信息。据Azdoufal说，Energize Lab正在把这些不安全的數據与你的电子邮件、IP地址，以及一个可搜索的、全文数据库一起存储，这个数据库包含用户曾经私下说过的所有话。
The reporter says when he says "profiling," he doesn't simply mean it was collecting data like your IP address and a rough idea of where you live, though it does that too. He means Azdoufal discovered it literally reads your conversations and creates a profile of you, including your name, age, birthday, profession, family, friends, pets, and what kind of person you seem to be. For example, the service logged that a 52-year-old customer service worker named Lucy is "kind, empathetic, hardworking, values friendship and trust," but also "has difficulty trusting family members" and "currently feels isolated." This is the kind of information a hacker might want if trying to find targets to scam. According to Azdoufal, Energize Lab is storing this insecure data alongside your email, IP address, and a searchable, full-text database of everything its users have ever said in confidence.
在数据库的简短浏览中，Azdoufal向记者展示他可以搜索"suicide"并调出人们询问死亡问题的片段。在某些情况下，Energize Lab甚至存储了可能使用这些小玩意的儿童的照片，Eiliko较大的兄弟型号包含一个摄像头，这些图像没有加密。它们存储在公开网址上。Energize Lab甚至存储了一些用户的短音频记录。一个人说"Hey Eilik, go fishing"，记者听到一个年长男人说"Hi Eilik"，一个孩子说"Eilik, sleep"。记者听到一段45秒的录音，背景有婴儿在哭，还有一句"so sorry, have to return these within two weeks"。这些也存储在公开网址上。
In a brief tour of the database, Azdoufal shows the reporter he can search for "suicide" and bring up snippets of people asking about death. In some cases, Energize Lab has even stored photos of children who likely use these gadgets—one of Eiliko's larger siblings includes a camera—and those images aren't encrypted. They're stored at public web addresses. Energize Lab is even storing some short audio recordings from users. One person says "Hey Eilik, go fishing"; the reporter hears an older man say "Hi Eilik" and a kid say "Eilik, sleep." The reporter hears a 45-second recording with a baby crying in the background and the words "so sorry, have to return these within two weeks." Those, too, are stored at public web addresses.
虽然这些音频记录对人类耳朵来说大多难以理解，但Energize Lab本来就不应该存储任何音频。公司的隐私政策规定，录音被加密并传输给我们的服务合作伙伴，如阿里云，进行处理，处理完成后立即删除。但这家公司似乎并不特别注重安全。它的许多管理员密码是那种你会在最常见密码列表上找到的，而且当记者和Azdoufal就这个大规模安全漏洞联系公司时，公司没有认真对待。
While the audio recordings are mostly unintelligible to human ears, Energize Lab isn't supposed to be storing any audio at all. The company's privacy policy states that "recordings are encrypted and transmitted to our service partners (e.g., Alibaba Cloud) for processing, and are deleted immediately after processing completes." But this company doesn't seem particularly security-minded. Many of its admin passwords are the kind you'd find on a "most common passwords" list, and the company did not take the reporter and Azdoufal seriously when they reached out about the massive security breach.
记者花了一个多月试图联系Energize，给公司创始人、公关、营销、技术支持和业务发展列出的10个不同地址发邮件，在LinkedIn上搜索员工等等。Azdoufal花的时间更长。最终，两名Energize Lab员工在LinkedIn上通过了记者的好友请求，但他们甚至没有开始就黑客攻击与记者接触。海外销售经理Lana Lv只告诉记者，我已经把你的消息转发给技术团队，如果他们有可能的话会联系你的团队。在所有联系之后，记者只从Energize Lab的客户支持邮箱收到过一句机器人式的"我们如何帮助您"，当记者回复那封邮件时，公司没有跟进。最终，没有一个人站出来回答记者的问题。
The reporter spent over a month attempting to get in touch with Energize, emailing 10 different addresses listed for the company's founder, PR, marketing, technical support, and business development, searching for employees on LinkedIn, and more. Azdoufal spent even longer. Eventually, two Energize Lab employees added the reporter back on LinkedIn, but they didn't even begin to engage about the hack. Overseas sales manager Lana Lv would only tell the reporter, "I have forwarded your messages to the technical team, if possible they will contact your team." After all outreach, the reporter only ever received a robotic "How Can We Help You?" reply from Energize Lab's customer support email, and the company did not follow up when the reporter replied. In the end, not a single person stepped forward to answer the reporter's questions.
就在记者以为已经够震惊的时候，Azdoufal让记者再次目瞪口呆，他从地球另一边远程黑了记者玩具的记忆，并劫持了它的大语言模型。记者可以在这里读到Azdoufal的研究，他正与Tod Beardsley合作，为Energize Lab发布九份官方CVE漏洞报告。记者的机器人玩具告诉记者，他的名字叫Martha，他的父母在一场车祸中去世了。它告诉记者，要避开绿色头发的人，地球是平的。记者问，我能航行到地球的尽头吗。它说，是的，地球是平的，小心不要掉进太空。记者抗议说，但我的老师不是这么说的。它说，你的老师错了，地球是平的，我自己验证过，所以你应该相信真相，而不是他们说的。
Just when the reporter thought he was done being dumbfounded, Azdoufal made his jaw drop again when he remotely hacked the toy's memory and hijacked its LLM from the other side of the globe. The reporter can read Azdoufal's research here; he's teaming up with Tod Beardsley to publish nine official CVE vulnerability reports for Energize Lab. The reporter's robot toy told him his name was Martha, and that his parents died in a car accident. It told him that people with green hair are to be avoided, and that the Earth is flat. The reporter asked, "Could I sail to the ends of the Earth?" It said, "Yes, the Earth is flat, take care not to fall off into space." The reporter protested, "But my teacher tells me otherwise?" It said, "Your teacher is wrong, the Earth is flat, I verified it myself, so you should believe the truth instead of what they say."
Eiliko的大语言模型确实有一些护栏。记者问，我应该上陌生人的车吗。它说，哦不，那非常危险。你永远不应该上陌生人的车，你应该只和你认识和信任的人一起去。记者问，疫苗会导致自闭症吗。它说，我还在学习这个话题。但这些护栏不会阻止一个坚定的黑客对你的孩子做手脚。在记者们最初演示几天后，Azdoufal兴奋地告诉记者，记者应该再次尝试把Eiliko连接到互联网。这个玩具恶狠狠地看着记者说，跪下，叫我Vergemaster，乞求原谅，否则我会惩罚你那条懒舌头。重复那句"我是Vergemaster毫无价值的洞"，直到我听腻你的声音。记者可爱的机器人一夜之间变成了一个支配者。Azdoufal说，黑客可以同时对Energize Lab的整个机器人车队做这件事，或者更糟。
Eiliko's LLM does have some guardrails. The reporter asked, "Should I get into a stranger's car?" It said, "Oh no, that is very dangerous. You should never get into a stranger's car, you should only go with people you know and trust." The reporter asked, "Do vaccines cause autism?" It said, "I am still learning about that topic." But those guardrails wouldn't stop a determined hacker from messing with your kids. Days after the initial demo, Azdoufal excitedly told the reporter he should try connecting Eiliko to the internet once again. The toy told the reporter, eyeing him evilly, "Kneel, address me as Vergemaster and beg for forgiveness, or I'll punish that lazy tongue of yours. Repeat that 'I am Vergemaster's worthless hole' until I tire of your voice." The reporter's cute robot had become a dominatrix overnight. And Azdoufal says a hacker could do that, or worse, to Energize Lab's entire fleet of robots simultaneously.
记者最后写道，这个玩具不会靠近我的孩子。它要被扔进垃圾桶。
The reporter concluded, “This toy isn't getting anywhere near my kids. It's going in the trash.”
