How a security flaw almost caged men in chastity belts

By Malavika Pradeep

Published Jan 12, 2021 at 11:22 AM

Reading time: 2 minutes

We claim to live in an era of revolutionised sex tech. One where metal rings and a piece of polycarbonate can spruce up sex lives. One where you can have keyless access to your partner’s chastity. And, apparently, one where anyone else on the internet can also have access to your partner’s chastity.

UK-based security firm Pen Trust Partners recently unearthed this major flaw with CELLMATE, a chastity cage created by the Chinese company QIUI. Dubbed the “world’s first app-controlled chastity device,” the sex toy relies on its Bluetooth function in order to allow a trusted partner to remotely control the lock via the QIUI app.

 

Voir cette publication sur Instagram

 

Une publication partagée par House of Denial (@houseofdenialuk)

The chastity belt’s app communicates with its lock using an Application Programming Interface (API). But recently, a string of API flaws was discovered by the Pen Test Partners researchers which left individual devices vulnerable to hacking without a secure password. This essentially meant that anyone on the internet could remotely lock all devices and prevent users from releasing themselves.

Although I can imagine that the possibility of getting stuck in one of those chastity cages is also part of the thrill, the intervention of a heavy-duty bolt cutter or angle grinder in close proximity to the users’ sensitive area to free them from permanent lock-in must have been unnerving, to say the least. The only other way, as discovered by Pen Test Partners, is to overload the circuit board that controls the lock’s motor with three volts of electricity. The unsecured API further leaked precise user location data along with private chats and other personal information including names and phone numbers.

News of the security flaw was first reported by Pen Test Partners to QIUI in April 2020. After receiving an initial assurance, QIUI deployed an updated version of the app on the App Store and Google Play with lock requests being forced to authenticate. However, the new API was pushed out only for new users, leaving the old, unsecured API on existing users’ devices. According to TechCrunch, QIUI couldn’t take the vulnerable API offline as it would have locked in anyone who was already using the device.

After missing three self-imposed deadlines to fix the vulnerability, QIUI remained unresponsive to several other researchers who learned of the flaw. Pen Test Partners later decided to go public with the news via a blog post.

To date, it is unknown if anyone has maliciously exploited the vulnerable API. However, this particular flaw seems to be the least of CELLMATE’s concerns. Several user reviews state that the app stops working at random, even without hackers having a say in this, causing the device to stay locked. “The app stopped working completely after three days and I am stuck!” writes one user. Another states that they “got stuck twice already when wearing it due to the unreliable app.” A one-star reviewer even complained: “It worked for about a month until I almost got stuck in it. The device left a bad scar that took nearly a month of recovery.”

A variety of teledildonic (Bluetooth-enabled) adult toys are cropping up, each one promising something different from the last. However, the security of these devices is often compromised as their makers focus their efforts mainly on making them ‘immersive’. Similar security flaws have been discovered in the past with such internet-enabled sex toys. Some have even let hackers potentially hijack live-streaming footage from a dildo and take control of Bluetooth-enabled butt plugs.

TechCrunch states that these security problems don’t exist in non-internet-connected devices. The latest discovery indicates that the creators of such smart gadgets still have lessons to learn and suggests undertaking intensive research before purchasing one, especially when it comes to using these devices more intimately.

After all, QIUI markets the CELLMATE Chastity Cage as “a true chastity experience that keeps the wearer away from control over their own device,” with the tagline “Love Hurts.” Perhaps, in this case, loves hurts more than initially expected? It’s all about perspective…

Keep On Reading

By Charlie Sawyer

Nail salon offers customers discounts in exchange for consent to sell their feet pics

By Abby Amoakuh

Shocking list of F1 legends who have been linked to Jeffrey Epstein in latest court documents

By Charlie Sawyer

Are UK-based citizens actually going to be forced into mandatory conscription?

By Fatou Ferraro Mboup

George Santos sues Jimmy Kimmel after taking distasteful jab at Amy Schumer’s appearance

By Fatou Ferraro Mboup

Miriam Margolyes angers adult Harry Potter fans after saying they need to grow up

By Charlie Sawyer

What is a glizzy? Breaking down the mysterious term taking over TikTok

By Abby Amoakuh

Gen Z just played a crucial role in South Korea finally banning the dog meat industry

By Charlie Sawyer

What is HYROX? The new Gen Z fitness craze that makes running clubs look mega boring

By Abby Amoakuh

Neuralink’s human implant success sparks fear for the future of society

By Fatou Ferraro Mboup

Former Mormon reveals the secrets signs for identifying Church members based on appearance

By Abby Amoakuh

Which surprise songs is Taylor Swift performing during the Eras tour? A guide on what to expect

By Abby Amoakuh

The worldwide war of words: Inside the disinformation campaigns surrounding the Israel-Hamas war

By Charlie Sawyer

New Armie Hammer ex-girlfriend reveals actor has only gotten worse since cannibalism claims

By Charlie Sawyer

Gypsy Rose Blanchard says husband Ryan Anderson’s D is fire after trolls call him a creep

By Abby Amoakuh

VICE obituary: How Gen Z will remember the millennial digital media titan

By Fatou Ferraro Mboup

Meet Sisters of the Valley, the nuns revolutionising the weed industry one doobie at a time

By Charlie Sawyer

How much is the morning after pill and why are we still paying for it?

By Abby Amoakuh

The real story behind Netflix’s One Day and why it will make you cry your eyes out

By Abby Amoakuh

Drake calls for release of Tory Lanez, proving once more that he’s a rapper for the manosphere

By Charlie Sawyer

What are ZYN pouches? Tucker Carlson’s go-to nicotine pillows that are fuelling right-wing Gen Z men