Energize Lab, the company behind the Eiliko robot, said it has confirmed the core issues raised in a Verge report on its insecure robots and is working through them, according to an unsigned statement the company sent from a generic email address. The response follows roughly a month in which the company did not answer questions, an omission Energize Lab acknowledged and apologized for, attributing it to a failure to sync with its technical team promptly and to time spent troubleshooting. The company also said it has created a monitored security@energizelab.com inbox.
Energize Lab said that as of Wednesday it had cut off all external access to its backend systems and rotated all access credentials. It said it disabled the interface that let a robot's responses be modified remotely, took the long-term memory feature offline so that conversation records and the user profiles generated from them are no longer stored, and took the custom avatar feature offline so the app offers only built-in avatars. The company said it will delete stored conversation records, user profiles, avatar images and related content.
The company said it is engaging an independent security firm to conduct a full review of its systems and that the long-term memory and custom avatar features will not return until that review confirms they are secure. That wording indicates Energize Lab plans to store some personal information again once its systems are hardened, and it said it will share an update when the review is completed.
The Verge reported that the systems were not yet secure at the time of the company's email. With help from researcher Azdoufal, the publication said it confirmed that Energize Lab was still storing audio recordings and photos of customers at unsecured public web addresses with no protection, such that a link would immediately display an owner's face. Azdoufal also told The Verge he still had full SSH access to the robots and could theoretically read transcripts and modify the toy's behavior, which the report said does not appear to match the company's claim that all external access has been closed.
Energize Lab said it started the business to build small robots that bring a little joy into people's lives, and that the idea only works if people can trust what is inside them. The company said it let customers down and that words alone will not earn that trust back, pledging to earn it through its actions in the coming weeks and to keep users informed as it goes.
More cybersecurity news from TechManNews.
