Kohler’s Toilet Cameras Lack True End-to-End Encryption
▼ Summary
– An AI startup exposed over a million user-created images, predominantly nudes, including child sexual abuse material, due to an unsecured database.
– A smart toilet camera, the Dekota, falsely advertised “end-to-end encryption,” which was removed after a researcher found it only encrypted data to the company’s server.
– The US declined to sanction China for the massive Salt Typhoon telecom hacking campaign, drawing criticism for prioritizing trade talks over national security.
– CISA remains without a director as the nominee, Sean Plankey, faces stalled confirmation due to varied political demands from senators.
– US and Canadian agencies warned that the Chinese “Brickstorm” malware enables long-undetected espionage and potential disruptive attacks against critical infrastructure.
The concept of a smart toilet equipped with a camera to analyze personal health data raises immediate and serious privacy concerns, a reality underscored by recent security findings. Kohler’s Dekota smart toilet device, which markets health monitoring through waste analysis, has been found to lack the true end-to-end encryption it claimed to use. Security researcher Simon Fondrie-Teitler discovered that while data is encrypted from the toilet to Kohler’s servers, it is decrypted and processed on those company servers. This architecture means the data is accessible to the company itself, contradicting the standard definition of end-to-end encryption where only the user’s devices hold the decryption keys. Following this revelation, Kohler removed all references to “end-to-end encryption” from its product descriptions.
This discovery comes amid a broader landscape of digital privacy challenges and state-sponsored cyber threats. A significant US inspector general report determined that Defense Secretary Pete Hegseth endangered military personnel through negligence in the SignalGate scandal, though the recommended consequence was merely a compliance review. In the private sector, an AI image startup exposed over a million user-generated images, most of which were explicit, due to an unsecured database. Meanwhile, legislative efforts like a new New York law aim to increase transparency, requiring retailers to disclose when personal data influences algorithmic pricing.
On the international front, the cyberespionage campaign known as Salt Typhoon, linked to Chinese state-sponsored hackers, infiltrated US telecom networks, accessing communications of high-profile figures including then-candidates Donald Trump and J.D. Vance. Despite the scale of this breach, described as a major counterintelligence failure, the US government has reportedly opted not to impose sanctions on China, a decision tied to ongoing trade negotiations that has drawn criticism for potentially subordinating national security to economic goals.
Domestic cybersecurity leadership also faces instability. The Cybersecurity and Infrastructure Security Agency (CISA) remains without a confirmed director as 2025 ends. The nomination of Sean Plankey, once considered assured, now appears stalled indefinitely after being excluded from a Senate vote. His confirmation faced diverse opposition: Republican senators placed holds over contract disputes and disaster funding, while Democratic senator Ron Wyden demands the release of a pending CISA report on telecom security before approving any nominee.
Adding to these concerns, a separate Chinese hacking operation using “Brickstorm” malware continues to pose a threat. Following an initial warning from Google, CISA, the NSA, and the Canadian Centre for Cybersecurity issued a joint advisory on detecting this spy tool, which has compromised dozens of organizations since 2022. The hackers appear poised for both espionage and potential disruptive attacks against US infrastructure. A particularly alarming detail from Google’s analysis shows that breaches involving Brickstorm went undetected in victim networks for an average of 393 days, highlighting the stealth and persistence of this advanced threat.
(Source: Wired)
