Qiui Cellmate Sex Toy Security Flaw Means It Can Be Hacked And Leave Users Locked In

The researchers, in a blog post, also said that an attacker can lock the device very quickly. Further, they said that there is no emergency override function or a manual lock to free the user either. If a user is stuck, there is no way out, the researchers said. They even posted a video on their blog post demonstrating how the device locks a user in, and how they can or can’t get out of the Qiui Cellmate if stuck.

The TechCrunch report also said that the vulnerability in the API also gives an attacker access to private messages and a user’s location from the Qiui app. The publication first got to know of the vulnerability in June. When Qiui was contacted back then, the company said that taking the vulnerability offline might lock in anyone who is already using the device. The company then rolled out a new API, leaving the unsecured API as is. Qiui CEO was quoted by TechCrunch as saying that the vulnerability will be fixed in August. When contacted in August, the company said “we are a basement team, when we fix it, it creates more problems,” in a follow-up mail.

The vulnerability was only made public after researchers at Pen Test Partners learnt about a separate issue from another researcher. The researchers said that the public interest case made their minds to make the issue public. It is not know if anyone has maliciously exploited the Qiui API, but user reviews have indicated at a glitchy app that would time and again cause the device to stay locked.