Consumer and IoT privacy exposures from insecure device data handling and wireless identifiers
Multiple disclosures highlighted privacy and safety risks stemming from insecure data handling in connected devices and services. A server-side storage weakness in DJI Romo robot vacuums allowed a researcher to obtain access tokens for more than 6,700 other vacuums and view sensitive user data such as home floor plans, live video feeds, and microphone input; reporting indicated some issues were patched, but residual risk remained (e.g., the ability to stream video without a security PIN). Separately, the game Dungeon Crusher exposed user information after a misconfigured Elasticsearch instance leaked 24.5 million in-game chat records and purchase-related data, including IP addresses, email addresses, and partial payment card details, creating downstream risk for fraud and targeted phishing.
Academic research also demonstrated how everyday systems can leak exploitable signals or be manipulated in the physical world. UC Irvine researchers presented FlyTrap, a physical-world attack against autonomous target-tracking drones in which AI-generated umbrella patterns can cause drones to approach an attacker closely enough to be captured or crashed, raising concerns for deployments in surveillance and security contexts. IMDEA Networks and partners showed that Tire Pressure Monitoring System (TPMS) sensors broadcast a fixed unique ID in cleartext radio signals, enabling low-cost receiver networks to track vehicles over time without line-of-sight, based on signals collected from 20,000+ vehicles during a multi-week study.
Related Entities
Organizations
Sources
Related Stories
Security exposures in consumer and mobile apps: robot vacuum account takeover and widespread mental-health app flaws
A security flaw in **DJI Romo** robot vacuums allowed unauthorized access to thousands of devices after a user reverse-engineered the device-to-cloud protocol to build a custom controller app. By obtaining the private token for their own vacuum, the researcher reported they could access backend servers across regions and inadvertently gained control of roughly **6,700** vacuums, with potential access to **floor plans**, **live camera/microphone feeds**, and remote control functions; DJI issued server-side/firmware updates that required no user action, though the researcher reported at least two issues remained (including video streaming without a PIN and another undisclosed high-severity problem). Separately, mobile security researchers reported that popular **Android mental health apps** (about **14.7M installs** across ten apps) contained **1,575** vulnerabilities—mostly low/medium severity but including **54 high-severity** findings—creating risk of exposure of sensitive therapy data via issues such as credential interception, notification spoofing, HTML injection, and user location leakage. Optimizely also confirmed a **data breach** following a **vishing (voice-phishing)** attack that provided attackers access to some internal systems and resulted in theft of **basic business contact information** from internal business systems/CRM and limited back-office documents; the company said attackers could not escalate privileges, install software, or establish backdoors, and it reported no evidence of access to sensitive customer data beyond contact details. While the Optimizely incident is distinct from the consumer-device and mobile-app vulnerability disclosures, it reinforces the operational risk of **social engineering** and the likelihood of follow-on phishing using stolen contact data.
2 weeks ago
Privacy and data exposure incidents across consumer apps, software supply chains, and misconfigured servers
Multiple disclosures highlighted ongoing **data exposure risks** driven by misconfiguration and weak controls. Cybernews researchers reported that three photo-identification mobile apps exposed data for ~152,000 users due to **misconfigured Firebase** databases lacking authentication, leaking emails, usernames, profile photos, and **GPS coordinates**; evidence in the exposed data suggested automated scanning and prior access by attackers. Separately, a large-scale internet study found nearly **5 million** public web servers with accessible `.git` directories, including more than **250,000** instances exposing `.git/config`, which can contain deployment credentials and enable source-code reconstruction, secret theft, and follow-on compromise. In parallel, **software supply-chain abuse** targeted the dYdX ecosystem via malicious packages on **npm** and **PyPI** that stole wallet seed phrases and other credentials; one PyPI package also reportedly deployed a **remote access trojan** enabling code execution and theft of API credentials, SSH keys, source code, and other sensitive files, with potential for persistence and lateral movement. Separately from these incident reports, Google announced privacy-focused search features aimed at faster removal of **non-consensual explicit imagery** (including deepfakes) and expanded monitoring via *Results about you* to help users detect and request removal of exposed government ID numbers—positioned as a protective measure rather than a breach disclosure.
1 months ago
Multiple Misconfiguration and Access-Control Flaws Expose AI and SaaS Platforms to Data Theft and Account Takeover
Security researchers reported a **critical Moltbook** exposure caused by an unauthenticated database/API access issue that allowed enumeration of agent records (e.g., `GET /api/agents/{id}`) and leakage of **email addresses, JWT `login_token`s, and third-party `api_key`s**, enabling agent hijacking and downstream abuse of connected services. Separately, **Cal.com Cloud** was found vulnerable to a chained set of broken access controls and signup/invite-token logic flaws that enabled **complete account takeover** and access to sensitive booking data (attendee details, emails, and booking histories) at scale, including organizational accounts. In parallel, SentinelLabs documented that roughly **175,000 internet-exposed Ollama** instances were reachable due to common deployment misconfiguration (binding to `0.0.0.0`/public interfaces), creating conditions for **arbitrary code execution** and access to external resources—especially where tool-calling features were enabled. A distinct IoT case study described **Molekule** air purifiers exposing fleet-wide telemetry because an **AWS Cognito Identity Pool** permitted unauthenticated access to **AWS IoT Core MQTT** subscriptions, leaking device shadow data (e.g., Wi‑Fi SSIDs, MAC addresses, device names, sensor readings) for ~100,000 devices; the disclosed policy reportedly allowed read/subscribe access but not device control without per-device certificates.
1 months ago