Learning Lodge allows its customers to download apps, learning games, e-books and other educational content to their VTech products.
Advertisement
VTech, which makes cordless phones and what it terms electronic learning devices for kids, apologised on Twitter on Monday, 30 November.
However, Motherboard has released what it says is an audio recording of a conversation between a parent and their child. Through a spokeswoman, VTech declined comment beyond the company statement.
More than 5 million accounts were hacked, including hundreds of thousands of children’s accounts, the company said.
The data was passed to Motherboard by the hacker, the publication reported. Stolen data on their parents included name, mailing address, email address, secret question and answer for password retrieval, IP address, mailing address, download history and encrypted password.
On Monday, VTech said an “unauthorized party” had hacked into its systems on November 14; the breach was discovered November 24.
VTech then issued a news release announcing the breach.
In reference to the breach of Learning Lodge app store database, Australia-based security researcher Troy Hunt said that an investigation of VTech’s app store and associated online services has revealed a number of “fundamental” security flaws. Hunt believes that users should not expect that VTech has shored up the breach yet.
Additionally, Vtech was found to use very poor hashing techniques for its stored passwords, using the inferior algorithm MD5. Converting those hashes into their original passwords is possible using decoding tools and powerful graphics processors. “You just can’t take chances with other people’s data in this way, especially not when they’re kids”.
Security experts have rounded on the company for failing to provide what they said were basic protections against cyber-attacks.
Advertisement
“It’s tough to be both a toy manufacturer and a mature technology company with a robust security program”.
