A talented 11-year-old boy shocked security experts when he hacked into their Bluetooth devices to control his robotic teddy bear during a cybersecurity conference at the World Forum in The Hague on May 16.
Reuben Paul, a sixth grade pupil from Austin, Texas, used this clever Bluetooth hack to show the audience how even connected toys can be weaponized. The presentation illustrated the risk associated with connected devices in modern homes and businesses.
Not Your Average Bear
Paul demonstrated his abilities by using his bear, which connected to the cloud via Wi-Fi and Bluetooth, to receive and transmit messages. He plugged a Raspberry Pi into his computer and scanned the conference hall for Bluetooth-connected devices.
According to SecurityWeek, Paul downloaded dozens of numbers, including some of the devices held by key executives at the event. He then used the programming language Python to hack into his bear through one of the numbers he collected, turn on the toy’s lights and record a message from the audience.
Paul, whose father is information technology expert Mano Paul, has already made a name for himself as a “cyber ninja,” according to Mirror Online. He has been speaking at conferences since he was 8 years old. He also helped found CyberShaolin, a nonprofit organization that aims to teach children cybersecurity skills.
The Message Behind the Teddy Bear Bluetooth Hack
Paul, who wants to study cybersecurity at either CalTech or MIT, later tweeted that, although it was fun to take part in the event, he hoped people did not miss his key message, which is to secure the Internet of Things (IoT) before it becomes the “Internet of Threats.”
Many IoT devices also have Bluetooth connectivity, and the range of connected devices — from lights to cars to toys — is growing. Both end users and IT decision-makers must be alert to the potential to use Bluetooth and other mechanisms to compromise and control these devices.
A recent study by Research and Markets suggested that worldwide spending on the IoT, which reached $16.3 billion in 2016, could hit $185.9 billion by 2023. The report likened the IoT to the Industrial Revolution and asserted that it will impact the way all businesses, governments and consumers interact with the physical world.
Initiating IoT Security Conversations
Live demonstrations at last year’s DEF CON also demonstrated the potential risk associated with connected devices, according to Tom’s Guide. For example, researchers at the event showed how 75 percent of Bluetooth smart locks can be breached.
Experts have also pointed to the potential threat to connected medical devices. Many of these potentially lifesaving items use Bluetooth to connect to devices such as smartphones. Manufacturers and health providers must work to ensure the integrity of connected medical equipment.
Managing security in the fast-changing age of connectivity is a significant challenge. According to Gartner, security leaders should work toward a foundation model that deals with prevention, detection, response and prediction concerns. Organizations with this kind of foundation should be better prepared in the event of an attack.
