Remote controlled male chastity toy may leave users 'locked in' due to security bug

A hi-tech chastity belt designed for men was discovered to have a security flaw that can allow hackers to remotely lock all devices simultaneously. The sex-toy, aptly branded Cellmate, is internet linked and does not come with a manual override. This can pose a very dangerous possibility of owners using a grinder or a bolt cutter to remove the metal clamp from their nether regions if they get locked and clamped accidentally.

The male chastity cage is wirelessly connected to a smartphone via Bluetooth. The signal then triggers the device's lock-and-clamp mechanism. However, to enable the lock, the app uses a computer server on the manufacturer's end to send commands.

Pen Test Partners (PTP), a Buckingham-based cyber-security firm involved in the development of the sex toy says it has discovered and flagged a security bug. Its Chinese developer Qiui, responsible for the sex toy's app, said they have fixed the security glitch and have also published a workaround.

According to PTP, the workaround could also be useful for customers who have bought the toy and are still using the old version of the app. However, if users of the old version fail to download the workaround, they may find themselves in a very tight bind. PTP enjoys a reputation of bringing to light quirky problems of sex toys even in the past. They say their latest bug discovery is an indication that makers of "smart" adult-themed toys still have a lot of lessons to learn to ensure the safety of their products.

Alex Lomas, a researcher from PTP says, "The problem is that manufacturers of these other toys sometimes rush their products to market."

According to the BBC, based on the number of ID's issued to owners of the device from its Guangdong creator, PTP believes sales have reached to about 40,000 units.

The security researchers said they were able to find a way to fool the main server into disclosing the registered name of each device owner as well as the unique code assigned to each device. Furthermore, coordinates of every location from where the app had been used were also accessed.

Hackers can cause the server to ignore app requests to unlock the chastity device and leave its wearers locked in.

Pen Test Partners have sent follow-up emails urging Qiui to address the issue and have also involved the news site Techcrunch to help pressure the manufacturer to take action.