Incident
incident:vtech_kids_toy_hacking_case
Also: VTech breach, VTech data breach
The hacking and data-breach incident involving VTech’s connected children’s products and online services in 2015.
The hacking and data-breach incident involving VTech’s connected children’s products and online services in 2015.
“a suspect has been arrested in the VTech Kids’ Toy Hacking case”
“VTech suffered a data breach”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | TARGETS | VTech | Explicit | 2 |
| outgoing | INITIAL_ACCESS_VIA | SQL injection | Derived | 2 |
| outgoing | INVOLVES | root access | Explicit | 2 |
| outgoing | INVOLVES | lateral movement | Derived | 2 |
| outgoing | INVOLVES | database dump | Explicit | 2 |
| outgoing | COMPROMISES | planetvtech.com | Explicit | 2 |
| outgoing | COMPROMISES | vsmilelink.com | Explicit | 2 |
| outgoing | COMPROMISES | sleepybearlullabytime.com | Explicit | 2 |
| outgoing | INVOLVES | MD5 | Explicit | 2 |
| outgoing | INVOLVES | HTTPS | Explicit | 2 |
| outgoing | INVOLVES | ASP 2.0 | Explicit | 2 |
| outgoing | DISCOVERED_BY | FireEye | Explicit | 2 |
VTech Kids’ Toy Hacking case TARGETS VTech
The hacking case involved unauthorized access to VTech customer data and systems.
Explicit Confidence 99% · Jack Rhysider EP 2 Details
“He had full access to the planetvtech.com website. 100 percent control of it.”
“an unauthorized party accessed VTech customer data”
VTech Kids’ Toy Hacking case INITIAL_ACCESS_VIA SQL injection
The hacker initially gained access by exploiting SQL injection in planetvtech.com.
Derived Confidence 98% · Jack Rhysider EP 2 Details
“he found it was vulnerable to SQL injection”
“this hacker ran a script against planetvtech.com which attempted to exploit SQL. To his surprise, it worked. He had shell access to the website.”
VTech Kids’ Toy Hacking case INVOLVES root access
After obtaining shell access, the hacker obtained root access to the website.
Explicit Confidence 99% · Jack Rhysider EP 2 Details
“A few keystrokes later, he then had root access.”
VTech Kids’ Toy Hacking case INVOLVES lateral movement
The hacker moved from the web server to other servers on the VTech network, including database servers.
Derived Confidence 96% · Jack Rhysider EP 2 Details
“He saw numerous other servers on the VTech network, including a database server. He was able to hop into the database”
VTech Kids’ Toy Hacking case INVOLVES database dump
The hacker downloaded complete copies of multiple VTech databases.
Explicit Confidence 99% · Jack Rhysider EP 2 Details
“The hacker grabbed a copy of everything in the database, downloaded the whole thing, then moved on to another database and grabbed a copy of everything there, too.”
VTech Kids’ Toy Hacking case COMPROMISES planetvtech.com
planetvtech.com was one of the vulnerable VTech websites taken offline after the breach.
Explicit Confidence 98% · Jack Rhysider EP 2 Details
“But they did take down the following websites: planetvtech.com, vsmilelink.com, and sleepybearlullabytime.com.”
VTech Kids’ Toy Hacking case COMPROMISES vsmilelink.com
vsmilelink.com was taken offline after the breach.
Explicit Confidence 98% · Jack Rhysider EP 2 Details
“they did take down the following websites: planetvtech.com, vsmilelink.com, and sleepybearlullabytime.com.”
VTech Kids’ Toy Hacking case COMPROMISES sleepybearlullabytime.com
sleepybearlullabytime.com was taken offline after the breach.
Explicit Confidence 98% · Jack Rhysider EP 2 Details
“they did take down the following websites: planetvtech.com, vsmilelink.com, and sleepybearlullabytime.com.”
VTech Kids’ Toy Hacking case INVOLVES MD5
The compromised database stored passwords as basic unsalted MD5 hashes rather than securely encrypted passwords.
Explicit Confidence 99% · Jack Rhysider EP 2 Details
“the passwords were stored using a basic unsalted MD5 hash”
VTech Kids’ Toy Hacking case INVOLVES HTTPS
The VTech website did not use HTTPS for authentication or its API.
Explicit Confidence 99% · Jack Rhysider EP 2 Details
“the site doesn’t use HTTPS anywhere, not for authentication or the API, nothing.”
VTech Kids’ Toy Hacking case INVOLVES ASP 2.0
The website was running ASP 2.0, which Microsoft had unsupported for more than four years by that time.
Explicit Confidence 99% · Jack Rhysider EP 2 Details
“the site was running ASP 2.0 which by that time had been unsupported by Microsoft for over four years.”
VTech Kids’ Toy Hacking case DISCOVERED_BY FireEye
FireEye was hired for incident response and found and resolved security issues after the breach.
Explicit Confidence 99% · Jack Rhysider EP 2 Details
“VTech hired a security firm called FireEye to help with incident response. FireEye was able to find the security issues and resolve them.”