Behind The Breach

Chapter-5 : VTECH breach

I started this series to help people understand what actually happened behind these breaches.Instead of following a strict structure or using complicated professional terms, I want to keep it conversational and easy to understand.

So from today, there’ll be no heavy vocabulary because I can’t afford those expensive words 😄

We’ll be treating every breach like a story, following it from start to finish so it’s easy to understand

now lets start about VTECH breach story !

VTECH PRODUCTS

First of all, let’s talk about VTech

VTech is a company that makes electronic devices mainly for children. They are known for products like digital learning tablets, smart watches, educational toys, and other kid-friendly gadgets.

The idea behind these products is simple: kids get to learn and have fun, while parents can stay connected through features like messaging, photos, voice recordings, and educational apps.

After buying one of these products, registration was mandatory. During the registration process, parents had to provide details such as their name, email address, home address, username, and password.

The device also asked for information about the child, including their name, date of birth, and gender. In some cases, parents could even upload a profile picture of their child.

This information was used to connect the child’s device with the parent’s phone and enable features like messaging, voice recordings, photos, and app downloads.

Lets dive into main story

One day, an anonymous hacker was browsing around and noticed that VTech devices frequently communicated with a website called planetvtech.com.

Out of curiosity, he decided to take a closer look at the website. While examining it, he discovered that it was vulnerable to a SQL injection attack.

To test it, he ran a script against the website. To his surprise, it worked. Within a short time, he gained access to the server. A few more commands later, he had full control of the system.

As the hacker explored the database, he found the database contained around 4.8 million parent accounts and 200,000 children’s accounts

Even worse, the passwords were stored using MD5.

Because apparently VTech looked at modern security practices and said, “Nah, we’ll stick with something from the dinosaur age.”

For the next few days, he kept thinking about what to do.

Should he tell VTech directly?

Should he stay quiet?

In the end, he decided to make the problem public.

So after thinking about it for a few days, he decided to contact a journalist named Lorenzo Franceschi-Bicchierai from Motherboard.

The hacker sent Lorenzo the evidence and explained that he had no intention of selling the data or making money from it. He simply wanted the security problem to become public so VTech would be forced to fix it.

Troy Hunt( creator of Have I Been Pwned ) and Lorenzo Franceschi-Bicchierai ( journalist )

But Lorenzo couldn’t just trust the word of an anonymous hacker and publish a story about it.

As a journalist, he needed proof.

So he contacted Troy Hunt, the founder of Have I Been Pwned?

Troy examined the leaked data and started verifying it. He found several email addresses in the dump that matched people who had subscribed to notifications on his website.

He contacted some of those people and asked whether the information in the leaked data was accurate.

After checking with multiple people, Troy was convinced.

The hacker was telling the truth.

The data was real, and VTech had indeed suffered a massive breach in November 2015.

With the evidence confirmed, Lorenzo finally had what he needed. He reached out to VTech for a response and then published the story, exposing the breach to the world.

But the story wasn’t over yet !

After Lorenzo published the first story, the hacker went back and looked through the data he had downloaded more carefully.

That’s when he discovered something he had missed the first time:

• Around 190 GB of files
• More than 100,000 photos
• A year’s worth of chat messages between parents and children
• Thousands of voice recordings from kids using VTech devices

A few days later, he informed Lorenzo about these new findings, and Lorenzo published a second article.

After the breach became public, VTech faced a huge backlash.

Parents were furious, lawsuits were filed, and government agencies launched investigations.

In 2018, VTech was fined $650,000 for violating children’s privacy laws and was forced to improve its security practices.

The breach became a costly lesson in how not to protect customer data.

So what’s the lesson here?

If you’re collecting millions of records about parents and children, maybe don’t protect them like they’re your grocery list.

Because sooner or later, someone is going to take a look.

Franceschi-Bicchierai’s original report: VTech Hacker Explains Why He Hacked the Toy Company.

This is Sameeraa. Follow for more stories about what really happened behind the breaches.