Researchers from ESET have uncovered a security issue in a Cirque du Soleil app, “Toruk – The First Flight .” The app was designed to enhance audience interaction through audio-visual elements. However, according to the researchers , the app was not designed with security in mind.
The Toruk app is available on Google Play and has been installed by over 100,000 users. It is also available on the App Store. However, it has not received any updates since 2016.
One of ESET's researchers, Lukáš Štefanko, discovered that "anyone who connected to the networkduring the show had the same administrative rights as the Cirque du Soleil operators." This means that hackers could have administrator rights.
The app lacks any authentication protocols. As a result, an open port – port 6161 – could be used by hackers to remotely control the app running Toruk. Hackers could then make changes to the volume, display specific content, and more.
An attacker could perform a scan to collect the IP addresses of vulnerable devices.
ESET tried to notify Cirque du Soleil in March and May, but received no response.
The researchers decided to disclose their findings publicly today, after the Toruk show was completed. The application is no longer needed and must be uninstalled immediately.
Cirque du Soleil reportedly plans to remove the app from Google Play and the Apple App Store now that the show has ended.
The Cirque du Soleil team stated that it took the risks associated with the application into account. However, it considered them not very serious. On the contrary, the damage that could be caused to the performance, after five years of touring worldwide, would have been much greater if the application had been removed earlier.
