Dear viewer, these subtitles were generated by a machine via the service YouTube and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/2509 Thanks!
[Music]
and uh okay we are ready to start so uh
uh from the US we have uh two firsttime
campers that are going to present uh
awesome stuff to us um uh Matt and Adam
going they are going to talk us about
product review and the mware and the
back doors that you they they uh have
been able to to find in those uh in in
those uh situations so uh please give a
huge Applause to our uh speakers
please thank
you hello thank you um I'm Adam Shaw and
this is Matt uh and this is uh our time
in a product review cabal and the
malware and bugs that came with it um
little bit about us uh I lead a team of
appsec Engineers I'm a home lab
Enthusiast um I have my own uh
conference that I help run in Omaha
Nebraska in the United States uh and I
run I help run my local Defcon group and
um also I help uh with a conference in
Hawaii called locom Moco SEC uh highly
recommended if you're able to get out
there for that one and hey everyone my
name is Matt virus it is my real last
name I'm a iot engineer at Cisco for
about 15 years now uh I'm a part-time
farmer I'm a big Hardware junkie take
everything apart and find out how it
works
uh I'm a former DOD forensic malware
reverse engineer analyst and I'm founder
of hacks space.io uh slides and stuff
from previous projects are posted out
there so go check it out and and follow
us both on Twitter or on slack or
wherever awesome and just quick
disclaimer um all of this work was done
for research purposes only uh nothing we
discussed today is representative of our
employers uh we ensured that every
review photo and video were immediately
taken down and reported uh this is
platform agnostic it affects uh all
online retailers not specific ones um
and we're an ethical
cabal uh so in in July uh we were
accepted for this talk uh big thank you
to Millie ways and the staff that put
this on uh uh this is a one of my
favorite childhood books so uh I was
super pumped about it uh and then in
August we decided we had to make the
slides uh so if you saw us you know at
by our attemp we were working on this
for quite some time this is my wife and
I this is like our normal interaction
when we have a talk coming up I've
almost
started uh so in 2020 uh there was
obviously the the global pandemic with
uh covid and uh it meant that everyone
needed to wear masks uh it was known for
three things right masks uh video
streaming all those streaming services
and online
shopping yeah so
what kind of stuff did you order online
maybe groceries maybe delivery for food
or things like that but not us we
ordered all kinds of electronic gizmos
and stuff that we really didn't need but
looked cool and was cheap because we
were all stuck at home doing whatever we
could only do at home so that's kind of
where we
were so it this whole thing started with
a postard I had ordered a a smart switch
from a company called treat life and in
the Box box there was this postcard
saying we are celebrating our company
anniversary and you write to us send us
a note and we'll send you a free gift
and who doesn't like a free gift
so I reached out to them you could see
the note there I I said hello treat life
se you I I like free stuff uh how does
this work and they said oh hello and you
just buy our thing from this retailer
and we'll we'll give you your a refund
for it and you don't even have to leave
us a review or anything please just go
just go buy it and everything will be
good so we
did so how it would kind of work is you
would reach you reach out to this
retailer and say hey I received this
offer and then they would say you buy it
and then we'll refund your money in
PayPal or Amazon or whatever gift card
you would like and then you would have
the device and use it and there would be
no strings with some vendors but then as
we move forward we learned that some
vendors play by some different rules and
they they may require a a positive
five-star review before they'll give you
the reimbursement and and it must have
pictures or must have this or must have
that so but in in general with with some
of the vendors they would give it for
free for no no strings
attached so once we start collecting
things it it got to be quite a lot uh
cameras switches a lot of smart home
devices I'm I'm a big smart home
automation firmware Enthusiast so that's
kind of where I was targeting but then
other strange devices too like a vacuum
cleaner which was really interesting and
lots of cameras and other things desk
lamps uh Stakes kitchen appliances all
kinds of
things so the the list grew and as we
collected more things we started getting
emails from additional vendors that we
hadn't necessarily reached out to
directly it seemed that there was there
was kind of this special list of
customers that was shared amongst these
companies that were sending things out
for free and so the more that we
interacted with them the more we got and
the more vendors came to ask us if we
would like their stuff so more is always
better and then we we started thinking
like a hacker or thinking like a
arsonist you know what if we were to use
multiple email accounts to interact with
them if we if we what if I want two of
that thing or maybe five of that thing
how could I do that so with multiple
email accounts and forward messages
between them and collect things and we
we were wondering at first like is this
is this good idea like will they
notice they did not they they did not
notice at all and in fact things things
kind of escalated on from
there um so the the thing that happened
then is as we started collecting things
and telling our friends they were
jealous of all of the cool stuff we got
like I want stuff too so sharing his car
Ing and we started to share some of our
friends contact information with these
vendors and some of the sharing we did
was official it was hello Mr vendor I
have a friend who would like to work
with you and the vendors would always
say yes but then as we'll talk about in
a slide or two some of the referrals
were maybe not quite so official so
we'll we'll talk about that in just a
just a
moment yeah and uh along the way we
realized that there's just a bunch of
people out there sending these messages
and they don't really care what we
respond with They Don't Really Care who
we are uh they don't really care care
you know where we're sending the items
uh I was sending items uh to like family
members at some points uh and then and
then I realized that they didn't care so
I started sending them to different
apartments in my own house I had six or
seven apartments in my house that would
I would I would send them to and they
just all show up on my doorstep uh and
we realized
okay let's you know let's just share the
not only are we sharing like uh you know
are not only are we telling the vendors
hey contact this person but now if they
contact us let's just send that email to
another another one of our friends and
then more friends can sign up and then
more friends and we eventually just
dropped all the pretense all together
and we started by sending um we would
change the headers uh and modify the
email and make it look like they had
emailed us uh but at the end of it I was
just replying to ones that were sent to
Matt for example like hey Adam I got an
invite for a a pool filter and some
kitchen knives would you like that one
and I say I need some knives uh sure and
I would just reply to the email address
and say please send me knives and and
they'd say okay and so they they just
send stuff then and we started sharing
the best invites and this is how we
built this cabal of people who we would
just share all the invites with and we'd
say hey I got an invite group or chat um
and this invite is product X Y and and
and z and uh somebody would say I need
product Y and so we just forward the
email to them and somebody else would
say I need product X and forward the
email to them and nobody ever seemed to
notice and we just everyone just got
free free stuff the The Profit slide
where Matt had all of those different
things every one of us had closets like
that you know where we were just filling
up with stuff the problem is they
started turning into pushers they
started sending us emails and they'd say
hey here is 60 products pick two of them
that you want and they would be the most
wacky products uh sex toys uh uh dog
treat dispensers yeah uh pool floaties
yeah toil scooters toilet drain Stoppers
yeah pasta dishes and it we we didn't
really care about a lot of those what we
cared about was the uh uh was the
technology ones that we were interested
in and
researching um but it got extensive and
there there is a a few main characters
in this if you see if you see these on
your recommended anywhere know that 90%
of their reviews are probably fake uh
one of them is victure uh see all the
different emails it's it's a little
difficult to see in the sunlight over
here but all the different emails on the
right um from vixire over 2020 uh Apen
was a big one uh they would uh they
would send us emails constantly and uh
in treat life uh treat life was one of
our favorites by far the favorite yeah
because highly recommended well they
they they they they send good quality
products uh that are most mostly not
well we'll get into the technical
details in a minute but uh they also uh
never really cared if you did the
reviews or not uh we would go and make a
review and uh for some products like
that you had to have a review before
they reimburse you and then we would
immediately delete the review and report
it or uh other products like treat life
I could just open up uh my developer
console and chrome and just edit one to
look like I just made a review and
screenshot it and send it and they
didn't even look they were just like all
right here's money here here you go yeah
or even they would just say please send
us your order ID and and after they got
the order ID they would just pay right
away yeah uh and then Facebook groups we
we were involved in a lot of these in
fact uh we we have after the pandemic we
pretty much stopped doing this uh it was
a a while back but we still get invites
all the time and they're primarily
moving to to Facebook now I've noticed I
get a lot of Facebook invites and
they're they email to me to join their
Facebook group and they're actually
moving countries now too uh one of the
while I Was preparing slides um one of
the uh one of the emails I got for a
Facebook group was um it specific to uh
Thailand so they the only in Thailand do
they want people to come and uh do
reviews which I thought was interesting
um but but what about the stuff right
like we're getting all this free stuff
but what about it and for that let's
let's let's dive deep yeah so this is
this is by no means exhaustive or
complete this is just a a few of the
particularly interesting details from a
you know deep dive of what the hardware
and software looked like so uh I
encourage you to do your own research
and and follow along if you'd like um so
the the first the first case study we
talk about is the the three T's uh treat
life Tekken and tuya uh so treat life
and Tekken use the tuya iot platform
maybe some of you have heard of the tuya
platform it's one of the largest in the
world and anybody can sign up to use
tuya you just Spam a few dollars and you
can use their development kit and you
can even use their Hardware that they
kind of white label and then you can
cook your own firmware for it and it's
it's very interesting so interesting
things about tuya is they store a number
of things in plain text they collect a
number of things plain text phone number
the device that you use to set it up the
SSID that it connects to the device
stats like when a light switch turns on
or off things like that uh but where
things get really interesting and and
particularly dangerous that maybe people
haven't thought of is a number of the
vacuum cleaners and including the one
that I got through this program they're
they're using the 2y you platform so the
floor plans of your house are
potentially in the in the two you cloud
and whatever vendor sold that to you can
access that and sell that to anyone or
do whatever ever they'd like with it so
that's interesting and of course the
device manufacturer whoever that is they
can they can push a firmware update
whenever they want and they can do it
silently so if you uh I'm jumping ahead
a little bit but if you go look at at
Michael stiger wal's talk from a few
years ago at a CCC event he talks
extensively about the evils of tuya and
and how they can do all sorts of
interesting things I'd encourage you to
go take a look at that uh so the first
wave of devices that we were collected
from from treat life and from Tekken
were ESP 82 66 based and it's a great
microprocessor it's it's uh fantastic
for the the hacker Community the weos D1
minis for sale over in the village
that's an esp8266 they're easy to flash
Arduino compatible very good firmware
and uh what happened eventually is we
were we were flashing these devices just
just with an interface with the fddi and
then there was this massive
vulnerability that that sherwal came out
with from vtrust where we were able to
flash device firmware over the air
without having to take it apart or
solder or anything and it was great it's
called tuya convert and the links right
there you can check it out and Tua
convert worked for quite a while there
were several kind of cat and mouse games
where the firmware got patched and then
the exploit got Rewritten and eventually
eventually it it stopped working they
changed the way that the keys were
derived for the devices and no longer
could we could we just flash them over
the air because of the the private key
and public key interaction between the
server and the
device uh so then you know things were
great we were collecting all these
devices and taking all of this terrible
to code off and putting fromwhere like
tesota or ESP home running it with node
red but then the devices themselves
changed the
esp8266 disappeared and despite this
this very substantial change in the
device the FCC documentation never
changed and that's that's kind of an
interesting question for devices that
the FCC reviews if there's a substantial
change it's supposed to require a follow
on examination I would say that changing
the microcontroller would be substantial
enough to require a new examination so
it became very hard to know uh which
device would have which controller or
which cuu so we kind of got to where you
try to order from maybe different
vendors and try to find one that had Old
Stock because we at the time we didn't
really know what to do with these
processors and we didn't want to just
put them on our Network and and deal
with the evilness of tuya uh but the
interesting thing about these these
controllers is they were uh the same
pinout as the ESP but they were not able
to run Arduino code so it it was good
and bad then we we figured out that
they're pin compatible with the esp32 C3
and the ESP uh 12f so we'd use a hot air
station and just drop the chip off and
then put a chip flash with tesota or
potentially ESP home but usually tesota
so you could step through the gpios and
figure out the hardware traces and do
that easily so then uh everything was
very good again we could take these
devices with terrible processors and use
them with our open source code very good
uh but then moving forward uh khed Nar
and some others there's an excellent
post here you should definitely go read
it he walks through a very detailed
posting of how some data was stored in
some Fields inappropriately and there
was no bounce checking on it so we're
able to inject code into that buffer and
through that we're able to to run a a
vulnerability this been called named
Toya Cloud cutter and with Cloud cutter
originally we were able to modify the
local keys on the device and when we
modify the local Keys we could
potentially write the same key to all of
the devices that we're working with so
we have a common key to access our
devices and once we modify the keys then
tuya can no longer interact with the
device so we still have untrusted
firmware but we have a device that we
can control that no one else can control
so it's it's generally good and there
are ways to hook that device with with
different automation platforms and make
it work so that was that was good and uh
but then as we moved forward there was
some substantial development done with
um with a project called it was
originally called Liber tuya but tuya
got mad at that so it became renamed
Liber tiny and another one called open
beckan uh Liber tiny is a port of ESP
home that runs on the beckan hardware
and uh it looks a lot like ESP home
works the same as yo base there's a
container plugin for home assistant it
all works very well and open beckin is a
standalone Hardware it's kind of sort of
similar to tasmota if any of you have
used it but it gives you API and mqtt
and everything and it runs Standalone on
the device fairly stable revved a lot
the developer is is active in a lot of
discords and and as as is the developer
for libertiny very active so in the end
we we have Hardware that was previously
untrusted that we couldn't work with
that was linked to a and generally evil
uh evil overlay platform but now we're
able to put whatever firware we want on
it control it how we want and we're able
to audit all of the functions that
firmware does so very powerful we take a
device that we can't trust at all to a
device that we absolutely trust and we
can do whatever we'd like with
it uh the next case study is around
cameras and there are many cameras that
were collected uh I use these uh I live
on a farm so I use some of these cameras
in the shop and for outdoor surveillance
and kind of all over the place so many
cameras and the default uh default and
stock firmware was very much not good uh
very unstable and a very uh interesting
interesting connections outbound some of
the cameras were using the T tuya
platform and uh interesting some of them
were were leaking to Chinese IP space in
earlier firmwares and there was one I I
I forgot to collect the data and save it
but in advance of a firmware update
before it it was beaconing out to some
Chinese IP space and then after a
firmware update it was leaking out to a
cloud provider that was us IP space but
it's uh important to know that
uh the country destination of the the
the country of the destination IP is
really not all that important and in the
end there's nothing that stops a foreign
National from creating a cloud provider
account and collecting data and packing
it off wherever they'd like so whether
that's a US cloud provider or a Chinese
cloud provider you know it's it still
should be handled with a minimal amount
of trust and uh so the in particular the
cameras that were not on the 2A platform
there's one from escam that was very
interesting it has this uh this P2P
connectivity and there's a QR code that
has a device ID and this device ID if
you have it you can connect to the
camera with no authentication All You
Need Is That device ID so it's very
dangerous and uh a gentleman named named
Paul he gave a big talk on the dangers
of this particular P2P uh P2P Network at
Defcon I think two years ago but the
link is there definitely go watch it
there's huge exposure and uh and the the
goal of the PTP network is to make it so
you don't have to port forward or so you
can use these cameras behind a cgnat and
still have access to the video but the
thing about that is it gives whoever's
authoring the firmware and pushing the
updates the ability to do reverse shells
and all those things as well so it's
it's a terrible security vulnerability
and just something that's very dangerous
that you should not ever trust on your
network um so with with this particular
camera there's an app to set it up
called the p6s light and some of the
early documentation of the app
references loal mode where you could
open the app on your phone and it would
find the camera and peer to it and then
you could do local mode and it would
pull up an interface where you could
tell the camera to to uh connect and um
so this uh this particular app was
missing that function and so that was
troubling it was kind of why what
happened to this interface so it started
trolling around on an Android phone and
was able to connect to the SSID
broadcast by the camera and then exited
the app dropped into the network
settings and saw that it was a very
non-standard very strange uh DHCP IP
that I'd been assigned but with a very
common Gateway A1 Gateway so open a
browser window to one on my phone and
here I have the I have the interface to
to this camera and once I have access to
the camera's web interface I was able to
configure it SSID and configure it to
join my network and I was able to not
allow it to register on the PTP Network
so interesting functionality that was
there in in like the 2.x version of the
app that was gone in the 3.x and they're
now on five or late fives or early sixes
so it's it's like that function was
purposefully taken out at least that's
that would be my conjecture uh so an
interesting removal from that
APK um so uh I kind of got ahead of
myself a bit but yeah the local mode was
gone and uh when you do this via VIA
direct web interface the the P2P
registration does not happen and as you
see in this one this is a a uh iteration
I did while using the actual app and
doing it and this camera actually did
join that P2P Network and uh all sorts
of interestingness so every every camera
whether it was tuya or non Toya platform
every camera beaconed out uh some a
little bit some a whole lot um some of
the interesting addresses were some of
them were China and some other ones were
China and some of that's Alibaba some of
it's not and some of the other IP
connections were previously like I said
two ch and then some to other
non-chinese Cloud providers but still
not to be trusted the cameras worked to
a varying degree of success some not at
all and some really well with rtsp and
onvif those are ways to access a camera
locally and have the the data local and
not out to a cloud or a Cloud Server uh
some of them worked some of them did not
at all and the typical ways with the
non-trusted firmware that you can take a
camera like that that does allow onvif
or rtsp to allow and have it be you know
semi-trusted is you know create a GP
reservation for it with no default
gateway or and or give it no DNS uh have
layer three ACLS even Layer Two ACLS if
you'd like there are a number of ways to
take a device like that and and you know
pin it in a corner but still have it be
usable um not necessarily the
recommended way um lots of the cameras
we're using Ana and um and real Tech
chipsets if you troll around a bit you
can find that the the uart and JTAG
interfaces for these chipsets are
generally you generally documented I
wouldn't say well documented but I would
say that they are documented and there
are uh open IPC uh for sure works on the
scam I set that up and it works fairly
well there's a lot of the uh the uh real
Tech firmware support for like the ye
cameras and some of the victure cameras
and some of the others so uh with some
digging you can get this set up and
working and you can get these cameras to
run code that you can actually audit and
you know what it does because you've
seen the code and you can follow the
packets so that that would be my
suggestion if you're going to chase
after anything these devices is is do a
bit of research pull down my slides find
some of the devices that use these
particular chipsets that you can push
your firmware to and not have to deal
with some third party vendors firmware
and be at at their
Mercy yeah
unsurprisingly uh cameras were probably
the most uh emailed thing that we got
you know obviously vendors wanted you
know wanted insight into our homes uh
baby monitors were up there too uh I
actually had small kids uh during the
pandemic and had used some of these
products as baby monitors uh so OB
obviously they had to be safe um the uh
other big one was some type of routers
right there was mesh routers and Wi-Fi
extenders that they were always offering
and I and I think that that's pretty
obvious too why why that was another one
that that got offered a lot um in this
case study uh this is a mesh Force
uh router um the uh router configuration
required a phone to set up they don't
have a web interface for the router uh
and nmap showed three open ports uh 5500
which is uh upm um obviously that should
be disabled by default to protect
security uh and it wasn't um Port 9000
for the app interface and uh Port
12598 uh used for autoc configuring the
Wi-Fi repeaters
Additionally the app used clear text TCP
comms over Port 9000 to retrieve the
serial number and configure the device
the serial number then became an
unchangeable password uh and you wer you
weren't able to do anything about that
uh this is again this is the meshforce
router which is still on sale today on
online
retailers uh also then the Android
reached out to a few places right um one
the router fine uh for some reason it
tried to call out to Facebook I don't
know why uh and then lastly another IP I
wonder what that is it's China so uh
this is another case where we were
looking at a device that basically you
know was calling out to places to give
them access or some type of data um and
uh what else went wrong with it
well um it we had an a APK of the app
right the Android app uh so apk's
obviously we can expand and dwell into
them uh and when you do that and uh look
at the Java classes with something like
JD goey um we saw references to CGI bin
Lucy admin data manager um which if you
Google it and and do some research uh
this is a possible tenda backdoor um
which has which has been everywhere uh
there's here's a couple articles
referencing a tenda backdoor uh in um in
uh uh wireless routers and this is
something that is very similar um and
that's as deep that's as deep as we went
right there because that was that was
enough for me to to junk it uh to be
honest and and we have a giveaway and
we're giving it
away um but honestly this was a really
like fun time uh because we were stuck
at home and we were we had a lot of uh
we have a lot of time on our hands and
so we were able to pour all of our time
into looking into these products to
determine what safe and what wasn't uh
some lessons that we learned if
something's too good to be true it
probably is Right always check your
Hardware that you're buying offline in a
safe environment before plugging it into
like our production home
operations um and be wary of online
reviews approach with caution not all of
them are
legitimate uh so how do you spot fake
reviews right um again all of Matt's and
I reviews were then immediately deleted
uh and and uh nuked from this the
platform um but here's how you can spot
fake reviews if you're online and uh and
and and if you're looking at buying a
product one is this a brand you trust uh
does it have you know a a trusted name
in the industry or is it something that
you've never heard of before uh some of
these vendors would send us emails with
different names different product names
so they were constantly recreating
companies and putting a new decal on
their product and that was a brand new
company for them so they were switching
company names all the time um if you can
check user history uh do it and not all
platforms allow you to view reviews that
a user's left but some platforms do
right some of these online retailers
allow you to view other things that this
person's reviewed uh check that out if
you can if you see a lot of well a lot
of reviews frankly on uh uh particular
products that could be a red flag also
all of these reviews the ones that
required um that required us to leave a
review before a refund they also
required that you left a picture so I'm
not saying that pictured reviews are
necessarily more fake but uh that's
something that was like bare minimum you
had to add it yeah sure and one other
thing is they the reviews all had to be
five stars could be four had to be five
so be very wary and when so when we
would leave these reviews we wanted to
get our money but we would still write a
review that would maybe say hey here's
three good things and two really bad
things but I still give it five stars
because the good things were so good so
if you see reviews that are like this
product was great except for this was
really terrible but I give it five stars
there's that was written to get a
reimbursement for sure yeah I had some
egregious ones where I'd say here's one
good thing and here's six bad things
about this product and they'd still send
me the money but uh you know I was
trying to warn people from you know
getting that particular product um and
then the other thing the time the review
has been posted uh so this this is an
industry right this is a business you
can go purchase fake reviews online and
there are companies out there who will
go and they'll find email lists like our
names are on these email lists and
they'll just Spam them and try to get
people to to do reviews um and if it if
the reviews been posted within a few
days it might be fake uh because usually
companies nowadays online retailers
they've used uh like report like Matt
and I have been doing and um and others
uh to actually get pretty good at
detecting fake reviews and they'll
they'll ban accounts too they'll they
you know they'll ban an account if if
they see enough fake reviews um but uh
usually that's a one or two day process
before they can determine hey is this
review legitimate or fake and uh so if
it's a if you have a review that's less
than two days old good chances are that
uh you want to maybe Circle back in a
few days and see if it's still
there um now this isn't all doom and
gloom there are good companies that do
do uh that do these kind of things um a
good example is amrest uh amrest has
actually reached out to people like Matt
and I um and they've offered a research
fee for purchasing their camera and
reviewing they never asked for an online
review they only asked for us to review
and send them our feedback right and
uh this is an example of a 4k camera
that they sent us um and the product
cost $80 but the research fee was 140 uh
which is another like good way to do it
uh not only that but we were still able
to pass the emails around the cabal and
so we all have amrest cameras now um
which is great uh the you know the
feedback we gave them we think is
valuable too uh one of the things that
we this is a little to see here but
hopefully the stream can see it in the
videos later but there's a uh like a red
um there's there's a red uh lens on this
camera and a red lighting area for the
infrared at night time uh the product
doesn't actually have it but the picture
has it so like that's something that we
were able to call out you you know when
you open the box up it it actually looks
a lot cleaner than than the picture that
they're using for the product does so we
were able to call that out we give them
feedback back and and that's a good
symbiotic relationship right where we're
able to give them good and honest
feedback but we don't have to then go
and like leave them a five-star review
and inflate their their online uh
reviews um that said I'd be happy to
give this a five star review it was a
good product so um some sources that we
uh that we didn't mention in the slide
deck uh uh ku. NZ uh this is a Blog um
uh this gentleman actually researched
the mesh router before uh I did and so a
lot of the same things that uh he found
we found uh but that's a good one uh
also all the icons that we got are from
the noun project and the flat icon uh
it's all you know sourced um free
icons uh thank you uh for your time and
we'll go ahead and take some
questions
so yeah um thank you a lot from great
talk uh the questions are going to be
there so uh please line up um if you're
like uh want to uh make the questions
from the internet the obvious channels
from Pyers and uh Matrix uh uh are
taking questions as well yeah uh can you
guys tell me uh what's the most
expensive item you
got yeah so there were two things that I
got that were kind of noteworthy I I got
a uh Robot vacuum that was around
$200 and uh still works pretty well
don't trust it at all but it it works
well it's in my shop it cleans the floor
out there and then the other thing that
was a little more like 2 250 dollar is a
a DVR system it had the central DVR had
to put your own hard drive in it but
then it had five cameras and uh the
cameras it was all um onv between the
cameras in the DVR and worked really
well uh but the review that was
submitted for that product actually got
flagged as fake and got deleted in the
in the lag time between when I reached
out to the vendor to request the refund
they said oh your review that you sent
the screenshot up does not exist and I
was like uh whatever it is what it is so
I had to send that back but yeah the
vacuum was $200 and the the DVR system
was around $ 250 yeah the the the the
most expensive thing that I got was
actually probably that mesh router which
is around $200 as well uh there was I
there was a clear cap on at least when I
when I was going through it on the
amount like dollar amount that they
would go which was usually uh 2 250 um
if it got above 200 it was uh they were
very demanding on the type of review and
the type of account that you had to have
in order to post the review a lot of
these people required that you have an
account with that online retailer for
over two years before you could post a
review on something that was expensive
yeah and and on the expensive things
like one other thing that we didn't
mention is they would have these
stipulations like you must have a
longstanding account you must have this
but then they would they would try to
sweeten the deal a little bit they would
say and and we'll we'll refund plus a
10% a 10% commission you know a 10%
uplift for your trouble and then
sometimes you would if you would tell a
vendor like no that's that's a lot of
work and I I can't do that they would
say well what if we paid you half up
front and then you post the review and
we pay you the other half so they would
get really aggressive and and try to get
you to buy the higher dollar products
yeah I I got a a projector that was
about $200 too and that their sweet in
the deal was a projection screen which I
thought was really I was like oh yeah
that sounds great so they sent me a big
sheet of paper so
okay okay uh we got have the next
question from there as well thanks for
the talk guys um my first question is
what do you think the main motivation
for this type of behavior is is it
profiteering e crime state sponsored
like how or is it a mix of them all yeah
so I think that there even within what
we did there were multiple motives I
think that like treat life was trying to
be the the number one company they
wanted if you would go on online
retailers and search for Smart Home
Smart Switch smart dimmer treat life
wanted to be the number one product and
the way you get to be the number one
search result is by selling the most
volume and selling volume to people who
will maybe write reviews but more just
selling volume period so I think treat
life was trying to Trend in the searches
and I think that maybe maybe other
vendors had different motives as far as
data collection and marketing and
selling data uh so I I think both
yeah I think I think some of the so
there there's an external company right
there there are external companies that
actually
do there's there's external companies
that actually that do this and they
they'll sell and they'll market and
they'll get you reviews Etc and and what
they're they're Pro they're they're
going for profit right but if I if I'm a
bad actor and I want my my back doors in
as many devices as possible I hire them
to then go do that so there's two
different kind of rev uh motives I see
but good question thank you okay uh we
have a next question from the internet
please yep the internet asks uh how can
someone start or get involved in such a
[Laughter]
cab the the first rule is a fight Club
is we don't talk about Fight
Club yeah good
question um uh there there are still
products that have those types of
postcards in them um
maybe just try to find some or maybe
send me a note on Twitter and I can help
you yeah uh the the postcards were the
are the entry for us uh so if you're
buying those products that they'll come
online okay yep please go ahead had a
quick question about um you said you
were reporting those products sometimes
was that to the eshops themselves or to
like some kind of government agency uh
and did you get any reply from any of
them the online retailers yeah the
online retailers uh and and the usually
we'd have them deleted and reported and
so the replies were nothing or minimal
yeah just automated response generally
yeah thank you we will get back to you
and then we never hear
back good question though okay um we
have still time for a couple of
questions if somebody has
some if not please give a huge Applause
to adaman M thank you
and and thank you again to the milliways
crew for putting this
[Music]
on