Security flaw meant Qiui's Cellmate chastity device for men could be remotely locked by hackers; the flaw was disclosed after company missed deadlines to patch
The disclosure fits a busy stretch for independent vulnerability research — days earlier a researcher surfaced a password-reset flaw that let anyone hijack a Grindr account with just an email address, and earlier this year a long-running backdoor was documented in HiSilicon chips inside millions of smart devices. Intimate and embedded hardware is now squarely in scope for the same researchers who probe phones and chipsets.
First-order effects
Cellmate owners remain exposed to remote lock-in until Qiui ships a fix, turning a $-of-the-moment purchase into a physical-safety problem the user cannot resolve on their own.
Qiui faces public pressure to patch on a deadline-driven clock it already failed to meet, with its entire app-connected product line's credibility riding on the response.
Second-order effects
Every maker of app-controlled intimate devices now competes against this headline: buyers have a concrete example that a vendor's missed patch deadline can mean a locked device, so security responsiveness becomes a purchasing criterion rather than an afterthought.
Researchers gain leverage from the disclose-after-deadline playbook working here — expect more vendors of small connected hardware to receive ultimatum-style timelines instead of quiet private reports.
Third-order effects
If deadline-based disclosure becomes the norm for consumer IoT, vendors of low-margin connected devices will need real patch infrastructure — signed firmware updates, response SLAs — or exit categories where failure has physical consequences.
The pattern points toward regulators treating remotely controllable body-worn devices as a safety category, not just a gadget category, since the harm here is enforced by software rather than caused by malfunction.
The trend: Internet-connected devices whose failures have physical consequences are pulling consumer hardware into the same deadline-driven vulnerability-disclosure regime that phones and chipsets already live under.
So Pen Test went public, notably with @zackwhittaker from @TechCrunch, who was told by Qiui CEO Jake Guo that there'd be a fix by August. No fix was released. Geo told Whittaker, “We are a basement team. When we fix it, it creates more problems.” https://techcrunch.com/... 8/
A 21st century security flaw in a sex toy from the Middle Ages: “Because the chamber was designed to lock with a metal ring underneath the user's penis, [it] may require the intervention of a heavy-duty bolt cutter or an angle grinder to free the user.” https://techcrunch.com/...
Cellmate's security vulnerabilities are inexcusable and Qiui's remediation efforts aren't the least bit reassuring. Public disclosure was the only sensible option here. TL;DR don't waste your money on a Cellmate chastity device. https://www.pentestpartners.com/ ...
Ransomwear: Smart male chastity device security cock-up: how to remotely lock in ~40,000 owners, with no local unlock. @alexlomas explains, plus multiple privacy issues and challenging disclosure: https://www.pentestpartners.com/ ... https://twitter.com/...
RansomWEAR, a new IoT threat model? Our @alexlomas has been busy with his cell mate and discovered an eye watering vulnerability. A smart male chastity lock cock-up - https://www.pentestpartners.com/ ... #LockedIn #IoTSecurity #AngleGrinder https://twitter.com/...
“Because the chamber was designed to lock with a metal ring underneath the user's penis, the researchers said it may require the intervention of a heavy-duty bolt cutter or an angle grinder to free the user.” 😶 Angle grinder? Goodness gracious, great balls of fire. https://twitte…
How many times have I said connecting everything to the Internet is not necessarily a good idea. Also not a good idea? Chastity devices... But the worst idea is the combination of the two. https://twitter.com/...