back to article Deus ex hackina: It took just 10 minutes to find data-divulging demons corrupting Pope's Click to Pray eRosary app

The technology behind the Catholic Church’s latest innovation, an electronic rosary, is so insecure, it can be trivially hacked to siphon off worshipers' personal information. The eRosary, which went on sale this week at just $109 (£85) a pop, consists of ten metallic beads, and a metal cross that’s Bluetooth enabled, has …

  1. TeeCee Gold badge

    Deus ex machina.

    Literally.

    1. john.jones.name

      dives stulti

      Catholic Church valuation ?

  2. Danny 2

    Saint Isidore of Seville

    Saint Isidore of Seville was well known in his time as a tireless scholar and historian, he was later called “the last scholar of the ancient world”, and it is this studiousness and love of information that lends itself to his modern patronage.

    Per the Roman Catholic Church, Saint Isidore is the patron saint of computers and their users, programmers, and repair men, as well as the Internet as a whole. So the next time you’re faced with a computer problem of such magnitude as to require a miracle to fix it, rest assured Isidore is on it.

    Apparently he invented the first Wikipedia, his Etymologiae had quaecunque fere sciri debentur, "practically everything that it is necessary to know".

    1. Stoneshop
      FAIL

      Re: Saint Isidore of Seville

      Apparently he invented the first Wikipedia,

      Unless anyone could have edited or added to its contents it would at best be just an encyclopedia, not a wikipedia.

      And I very much doubt that there were more than just a select few editors involved, if it wasn't old Ididore on his own.

      1. BebopWeBop

        Re: Saint Isidore of Seville

        Douglas Adams was hot on his heels

      2. Muscleguy

        Re: Saint Isidore of Seville

        Considering back then books were all bound manuscripts and the monks copying them often put little bon mots in the margins, unlike the later post Gutenberg pinted books it would indeed have been user updateable.

        But then post Gutenberg books are as well. I have a personal copy of Eunice C. Green's Anatomy of the Rat with pages I have inserted (laser written naturally) detailing where moust differs from rat in terms of muscles and tendons (my area of expertise). For eg mice do not have a Sartorius muscle in the thigh but rats do, just like we do though we add a Tensor Fasciae Lata as well.

        1. Kane
          Thumb Up

          Re: Saint Isidore of Seville

          After all this time your handle now makes all the sense in the world! Whenever I saw your handle, for some reason I always pictured a large musclebound weightlifter in a gym flexing in front of a mirror. Now I will forever see diagrams of rat and mouse musculature.

          I'm not sure which is better...

    2. Anonymous Coward
      Anonymous Coward

      Re: Saint Isidore of Seville

      So the next time you’re faced with a computer problem of such magnitude as to require a miracle to fix it, rest assured Isidore is on it.

      Despite resorting to offerings at the alter of Ada, the High Priestess of Computer Programmers, the quality of "code" that the programmers under my charge write has not improved one iota.

      1. jmch Silver badge
        Trollface

        Re: Saint Isidore of Seville

        "Despite resorting to offerings at the alter of Ada, the High Priestess of Computer Programmers, the quality of "code" that the programmers under my charge write has not improved one iota."

        Have you tried sacrificing one of the programmers?

        1. Anonymous Coward
          Anonymous Coward

          Re: Have you tried sacrificing one of the programmers?

          According to Father P Brooks, there may be more improvement to gain by sacrificing all but one of the programmers, thereby reducing overheads, reducing opportunity for miscommunication, etc,

          How would today's readers choose which one programmer to keep? Text your answers now to I'm a Crap Manager Get Me Out of Here, on 070xxxxxx.

        2. Fruit and Nutcase Silver badge

          Re: Saint Isidore of Seville

          Probably because the sacrifice type of offering makes a mess of the floor.

          Now, the Spanish Inquisition had the right idea - they "didn't" spill blood

          "Inquisitors weren't allowed to shed blood, and that included doing the actual killing. The Church didn't actually want to be associated with killing the faithless, either, so that was left up to secular authorities, who stepped up to do the killing and burning after the guilty parties were publicly scorned and humiliated. The transfer of prisoner from Inquisition custody to secular was called "relaxing" the guilty party, who would then be taken out of the church's line of sight and disposed of in a way apparently suited to the most heretical in history."

          https://www.grunge.com/139703/the-most-disturbing-thing-about-the-spanish-inquisition-isnt-what-you-think/

          1. Imsimil Berati-Lahn

            Re: Saint Isidore of Seville

            So the Spanish Inquisition / Holy Church of Rome effectively invented Human Resource Department outsourcing then?

    3. harmjschoonhoven
      Happy

      Re: Saint Isidore of Seville

      But with any hardware problem try a voodoo repair first: Remove power cable, open cabinet, say Ahum twice, replace cover, reconnect power cable.

      1. Rich 11

        Re: Saint Isidore of Seville

        You forgot to say that removing or replacing the cover also requires a blood sacrifice via one of the sharp edges.

        1. Daytona955

          Re: Saint Isidore of Seville

          Normally accompanied by incantations featuring the names of assorted deities interspersed with various arcane and forbidden words...

  3. Anonymous Coward
    Anonymous Coward

    Why should buyers (believers) worry about this?

    God knows all, so a bit of leaked info surely won't worry them.

    The church has moved on from accusing Galileo of heresy, funny how those 'red lines' keep getting nudged every time they are proved wrong by irrefutable science.

    I really couldn't care less about this particular fuck up, but it is indicative of a wider security issue I do care about.

    We need some regulation on security of personal information and from recent things I've read (mostly here on El Reg) I hope this might be on the cards.

    1. Andrew Jones 2

      Re: Why should buyers (believers) worry about this?

      Well I mean, surely it's a breach of the GDPR and thus they must be fined?

      1. Mephistro
        Devil

        Re: Why should buyers (believers) worry about this?

        Good luck trying to obtain info on their global turnover!

        1. stiine Silver badge
          Devil

          Re: Why should buyers (believers) worry about this?

          Why, are pages[choirboys] that hard to turn over?

      2. Fruit and Nutcase Silver badge
        Joke

        Re: Why should buyers (believers) worry about this?

        Well I mean, surely it's a breach of the GDPR and thus they must be fined?

        There's always... The Spanish Inquisition!

        1. Updraft102

          Re: Why should buyers (believers) worry about this?

          I wasn't expecting the Spanish Inquisition.

        2. imdatsolak
          Coat

          Re: Why should buyers (believers) worry about this?

          Nobody expects the Spanish Iquisition!

        3. DubyaG

          Re: Why should buyers (believers) worry about this?

          I'll take the comfy chair AND the soft pillows, please.

    2. redpawn

      Re: Why should buyers (believers) worry about this?

      Through consistent proscribed prayer you will have protection from hackers. The biggest BOFH, H for heaven, B for some unpronounceable word lacking vowels, will keep the truly faithful safe from hacking.

      1. Chris G

        Re: Why should buyers (believers) worry about this?

        Would that be ' Beatific Operator From Heaven' ?

        £85 for a holey(electronic security wise) prayer device seems a sin to me.

        1. Sierpinski

          Re: Why should buyers (believers) worry about this?

          It's not much of an indulgence.

    3. Anonymous Coward
      Anonymous Coward

      Re: Why should buyers (believers) worry about this?

      The security on the login is kinda pointless.

      The existence of the app on a phone, and a device on a desk would be sufficient to identify a user as belonging to the faith.

      Electronically, the apps API is pinging Vatican.IT (or whereever) - so again, wether there is encrypted content - doesnt matter for a state actor.

  4. sbt
    Devil

    Noughts and prayers

    Clearly, the church can't rely on the doctrine of infallibility when it comes to code. OK, anything.

    1. Paul Crawford Silver badge

      Re: Noughts and prayers

      Maybe if the pope had time to do the coding all would have been well?

      1. sbt
        Angel

        Buffer over-run in transubstantiation.c

        No, I think his encyclicals would get stuck in a loop and his host connection would go stale.

      2. Tom 7

        Re: Noughts and prayers

        Didnt they already invent the tri-state boolean?

        1. Mike 16

          Tri-state Boolean?

          That was Boole himself, IIRC. The original form of "Boolean Algebra" was (radically simplifying and paraphrasing) about probabilities and their combinations. Think of something like a precursor of Fuzzy Logic. It was much later when the computer-nerds redefined it to only zero and one for their own purposes, like Baud, Byte, and "Fitness for Purpose".

          Babbage and Lovelace may be thought of as early practitioners of Computing, but surely Humpty Dumpy was the inspiration for modern terminology. :-)

      3. Fruit and Nutcase Silver badge
        Coat

        Re: Noughts and prayers

        Maybe if the pope had time to do the coding all would have been well?

        The Father, Son and The Holy GhostCode

  5. Michael Hoffmann Silver badge
    Devil

    Demons in app?

    So, you need to also install the eXorcism app?

    1. ElectricPics

      Re: Demons in app?

      https://play.google.com/store/apps/details?id=com.moc.exorcism&hl=en_GB

  6. Anonymous Coward
    Anonymous Coward

    Don't wanna be Re-Re-Re Repossessed ...

    Fanny Ray Weller: I cast thee back to Hell ... I cast thee back to Hell

    Fru-Fru says 'God bless us everyone'

  7. druck Silver badge
    Coat

    Maybe they are using...

    ...the widrawal method of internet security.

    1. Anonymous Coward
      Anonymous Coward

      Re: Maybe they are using...

      ...or the "just say no" approach.

  8. petef

    Premature disclosure

    Why have Fidus gone public with this now? It is customary to give reasonable private notice so that security holes can be plugged before every skiddie is given a chance to exploit. According to Fidus they reported the vulnerability on the 18th and it was patched on the 19th. That is way too recent to have rolled out to all users. Fidus should have kept quiet.

    1. Anonymous Coward
      Angel

      Re: Premature disclosure

      It went on sale only this week. Disclosure before there is any significant userbase to be affected? And the exposure is mere trivia.

      Alas, Sir PTerry is no longer with us. Can't help thinking he'd've given us a brilliant sendup of this device!

      1. Nick Kew
        Angel

        Re: Premature disclosure

        Then let us instead invoke Tom Lehrer on (more-or-less) the subject.

    2. Anonymous Coward Silver badge
      Facepalm

      Re: Premature disclosure

      1. The developers claimed to have fixed it. That implies that they're not doing any more work so giving them more time wouldn't help.

      2. A fixed an API on the server doesn't take any time to be 'rolled out to all users'.

  9. Danny 2

    Ave Satani

    The Omen! It is worth noting that we geeks fact-checked those wannabe Satanists,

    https://en.wikipedia.org/wiki/Ave_Satani#Lyrics

    I have to admit that in Scotland we didn't catch the lyrics, and that chant is known as "Dah dah dah dah. Dah dah dah dah. Dah dah dah dah deh"

    Another shitey anecdote. All the tough punks went to see The Exorcist at our local cinema when they were too young, and all of them left in fright. That made the movie just irresistible to the rest of us. A girl invited me - and this just didn't happen back then- and then in her bedroom she confessed how she'd stabbed her older sister in her stomach. And then I had to go and watch The Exorcist and Friday The 13th with her.

    I was so terrified of my date that I missed out on the movies. What sort of a first date tells you she has already been arrested for stabbing her sister? Did I put my arm around her in the cinema? Aye, right, I kept my hands around my stomach.

    Women, don't stab your sister no matter how much she deserves it. And certainly don't tell your date after.

    The Exorcist didn't scare me, Friday the 13th didn't scare me, but the girl sitting next to me scared the bejesus out of me.

  10. Blackjack Silver badge

    Press F to pray if you saw this coming...

    Honesty, I know the Vatican is having money problems but they could have done this thing way better.

  11. Winkypop Silver badge
    Devil

    404

    Deity not found

    1. Stoneshop
      Angel

      402

      Prayment required

    2. Aristotles slow and dimwitted horse

      419

      Jesus is alive and well and living it up in Nigeria.

      1. Anonymous Coward
        Anonymous Coward

        Re: 419

        Jesus is alive and well and living it up in Nigeria.

        Jesus is alive, but suffering from a rare condition, possibly deriving from the absence of a genetic father, and requires a donation from you in order to continue his world saving mission.

  12. Stoneshop
    Devil

    From the picture

    my first association was that there would be a small motor inside the cross that moved the beads along, and the cross being part of the stand. Because, progress. After all, Buddhists have their wind- and water-powered prayer wheels, that pray without further human intervention, so why not an autonomous rosary?

    1. Steve K

      Re: From the picture

      Electric Monk.....

    2. jelabarre59

      Re: From the picture

      "The 9 Billion Names of God" had a Tibetian monestary buying a computer to print out the aforementioned names far quicker than they were doing them by hand. Other than the cutting out and pasting into the ledgers, I could expect the task could be completed in an hour or two (allowing for printing time).

  13. Anonymous Coward
    Anonymous Coward

    404

    Book Not Found.

    AC, because I don't want to end up on the Vatican's "Special" list for another 600 years..

    1. Allan George Dyer
      Devil

      Re: 404

      @AC - "another 600 years"

      How old... Who the hell are...

      icon - never mind.

      1. Mephistro
        Angel

        Re: 404

        I always considered this AC guy to be suspicious!

        ;^)

    2. herman
      Devil

      Re: 404

      Shirley you meant another 666 years?

    3. Fruit and Nutcase Silver badge
      Joke

      666

      Is there a special 666 error?

  14. jeffty
    Trollface

    Unlimited Password retries? Sloppy coding?

    That would be an ecumenical matter...

    1. DavCrav

      Re: Unlimited Password retries? Sloppy coding?

      Four-digit PIN?

      That would be a numerical matter.

      1. EVP

        Re: Unlimited Password retries? Sloppy coding?

        Perhaps they created an ecunumerated list of valid PINs.

  15. the Jim bloke

    I must Confess

    I find the use of this device ineffable.

    1. Fruit and Nutcase Silver badge

      Re: I must Confess

      Can you do "remote" Confession with the app?

      1. 080

        Re: I must Confess

        "Can you do "remote" Confession with the app"

        Only if you connect it to St Alexa

        1. GnuTzu

          Re: I must Confess

          And, then the world will be your confessional, 24x7.

    2. David Roberts
      Angel

      Re: I must Confess

      Ineffable?

      Surely very effable as in "It costs effing how much?".

    3. Christoph

      Re: I must Confess

      Both Aziraphale and Crowley have claimed credit for causing the invention of this.

  16. Mage Silver badge
    Coat

    Bit daft, but...

    Perhaps more innovative and less stupid than a Nest camera, Amazon doorbell or any of those "voice assistants."

    Meanwhile, the Catholic believers should consider nothing more threatening related to Faith, IT wise, than an eBook version of the Jerusalem Bible.

    I added an icon even though that's Orthodox.

    1. Anonymous Coward
      Anonymous Coward

      Re: Bit daft, but...

      Is the Jerusalem Bible the one translated from the original PDF?

  17. Detective Emil
    Angel

    Why does this product remind me of the mobile-phone-in-a-crucifix in The Pope Must Die[t]?

  18. Mephistro
    Devil

    Perhaps those beads...

    ... have other uses not included in the owner's manual.

  19. A.P. Veening Silver badge

    Let us pray

    ... this gets fixed quickly.

    1. Fruit and Nutcase Silver badge

      Re: Let us pray

      Blessed are the Developers who apply Application Security Best Practice

  20. Anonymous Coward
    Anonymous Coward

    I don't see the problem, the app is supposed to be holy.

  21. Snowy Silver badge
    Devil

    Just

    Excommunicate it after 666 tries!

  22. Queeg
    Devil

    I'm curious..

    Does the cross vibrate when your prayers are being answered,

    or is there a ringtone for God's word?

    This only goes to show, if you stamp "RELIGION" on it people

    will buy any old crap.

    .

    .

    by the way El Reg if this article doesn't deserve a sarcasm icon nothing does.

    1. Danny 2

      Re: I'm curious..

      https://en.wikipedia.org/wiki/Forbidden_fruit#Apple

  23. Danny 2

    The Pope isn't an EU citizen

    Boris Johnson is an EU citizen.

    The Vatican is not democratic enough to join the EU.

    Britain is too democratic to leave the EU.

    The detail is in the devil.

  24. FuzzyWuzzys
    Facepalm

    Eternal guilt

    What I love about this is that Catholics are all about "eternal guilt", they love a bit of guilt. This thing tracks you, reminds you constantly that you must feel guilty and remind you to punish yourself for whatever it is that you did or thought that you shouldn't have. So rather than sneaking off and having a few crafty happy thoughts, this thing will remind you that must never be happy.

  25. Unicornpiss
    Coat

    Click to Pray?

    I always thought it was Plug n' Pray..

    1. Anonymous Coward
      Anonymous Coward

      Re: Click to Pray?

      I see you speak the language of the devil, USB - Universal Sadistic Beelzebub.

      1. Anonymous Coward
        Anonymous Coward

        Re: Click to Pray?

        "I see you speak the language of the devil, USB - Universal Sadistic Beelzebub."

        Indeed!

        https://www.irongeek.com/i.php?page=security/plug-and-prey-malicious-usb-devices

  26. FatGerman

    That Would Be An Ecumenical Matter

    (Title)

  27. chivo243 Silver badge
    Coat

    what's the penance for writing a bug? How many Hail Marys?

    1. David Roberts
      Angel

      Hail Marys

      No worries.

      Theyve got the kit to automate it.

  28. Muscleguy

    I like

    That you logged in as Satan. As a signed up member of The Satanic Temple I atheistically approve.

  29. 080

    Seriously!

    When I read this kind of thing I thank God I'm an atheist

  30. Joe W Silver badge

    Names...

    Chris (oh, please, habe a last name starting with T, for the obvious joke...) from Fidus...

  31. Anonymous Coward
    Anonymous Coward

    It's "practising"

    (verb == to practice, noun == practice)

    Just saying!

    Top tip: replace it with "advice" or "advise" where the different pronunciation makes it completely obvious whether you should use a "c" or "s"

    1. Anonymous Coward
      Anonymous Coward

      Re: It's "practising"

      Same AC, obvs meant "verb == to practise" ;)

      1. Andy The Hat Silver badge

        Re: It's "practising"

        Don't worry, nobody noticed your glaring error!

  32. Anonymous Coward
    Anonymous Coward

    Crazy Catholic magick

    Notice how Catholicism rituals play out like a dungeons and dragons campaign.

    The old spells and their mysterious magic rebranded. Rosary beads, symbols of divine power, spells, prayers, Amulet talisman special words of power... Difference between a practicer of old dark magic and Catholicism is but skin deep. Catholic church, it's dark rituals and the practice of worshipping the Pope has got to be one of the largest practices of idolatry. To idolize anything, whether it be a person, institution, systems of law, rituals, etc to practice idolatry. Despite that idolatry is strictly prohibited by the ten commandments and reported to be particularly to disdained by God.

  33. Mike 16

    Precedent

    https://www.medievalists.net/2015/12/i-robot-saint/

    Pretty much what you'd expect from the last bit of the URL, minus the data-slurping, as even 2G coverage was spotty in the 13th century.

  34. Martin an gof Silver badge
    Happy

    Plenty more where this came from

    Gadgets for God is always worth a laugh. As is the rest of the Ship of Fools site to be honest.

    M.

    1. Anonymous Coward
      Anonymous Coward

      Re: Plenty more where this came from

      Some years ago I was browsing in a Poundland shop, and came across a Jigsaw puzzle with a picture of the Pope on it. Thought that was so "Father Ted", reading this article I just thought - Father Ted for the 21st Century!

      Not being a religious person, what is the point of this device?

  35. Anonymous Coward
    Anonymous Coward

    Standard process.

    Sales representative: “[XXXX] technical sales, [XXXX] speaking. How can I help you?”

    The Pope: ”This is the Pope speaking. I want you to design an electronic rosary for me. Customer price may not exceed 90 euros, including VAT.”

    S: “Very well, Mr. Pope. Let me first...”

    P: “I’m not Mr. Pope, but The Pope. You know, the one who sits in Vatican and speaks to God.”

    S: “Uh, yes... um... your holiness. I was about to say that I need a bit more information to prepare a quote for your holiness on an electronic rosary. Like details on the device and accompanying software. Those details are called specifications. If it suits your holiness, I will next make a number of detailed questions about your expectations.”

    P: “Great, let’s begin!”

    [ discussions goes on for a fair amount of time ]

    S: “... and finally, your holiness, we need to discuss about system security and its implementation. Our standard...”

    P: “How much will it cost?”

    S: “Well, I cannot give your holiness an exact figure now, but it will cost about [XXXX] euros to implement in your case.”

    P: “Bloody... what was that phrase again? ...yes! Bloody Mary! That’s too expensive! Just put a four-number PIN on it. Just like in my credit card. If it’s secure enough for banks, it’s secure enough for me.”

    S: “But your holiness, it’s completely differ...”

    P: “Nonsense! Just give me a quote.”

    S: “Um, very well, sir.. uh, your holiness. Design and non-recurring manufacturing costs are [XXXX] euros, and then [XXXX] euros per device, which will meet your initial requirement of 90 eur...”

    P: “Great, send them to me ASAP! Keep up the good work! Thanks!”

    [click]

    Sales process in this case was like any normal discussion between a VP and technical team. In other words, standard industry procedure was followed and the security features are nobody’s who is anybody fault (may the code monkey rest in pieces), and there is nothing to see. Move on, folks!

  36. Blofeld's Cat
    Angel

    Er ...

    [Flash of lightning, clap of thunder, heavenly choir]

    Look the security on this device is very straightforward - you hack this thing and something turns up to smite you with a flaming sword, before dragging you down to Hell for all eternity.

    Which coincidentally is where we outsourced our help desk to.

    Sent from my iSaiah.

  37. Anonymous Coward
    Anonymous Coward

    The Vatican can generate their excuses as follows

    netcat towel.blinkenlights.nl 666 | sed '1,4d;$d'

  38. Anonymous Coward
    Anonymous Coward

    Tinder for priests?

    Is there a reason it needs height weight and gender or am I being a cynic to think it's offering up the believers for priestly attention?

    1. Anonymous Coward
      Anonymous Coward

      Re: Tinder for priests?

      Ah the ancient Joke:

      "Bless me Father, for I have sinned. I have been with a loose girl."

      The priest asks, "Is that you, little Joey Pagano?"

      "'Yes, Father, it is."

      "And who was the girl you were with?"

      "I can't tell you, Father. I don't want to ruin her reputation."

      "Well, Joey, I'm sure to find out her name sooner or later so you may as well tell me now. Was it Tina Minetti?"

      "I cannot say."

      "Was it Teresa Mazzarelli?"

      "I'll never tell."

      "Was it Nina Capelli?"

      "I'm sorry, but I cannot name her."

      "Was it Cathy Piriano?"

      "My lips are sealed."

      "Was it Rosa DiAngelo, then?"

      "Please, Father, I cannot tell you."

      The priest sighs in frustration. "You're very tight lipped, and I admire that. But you've sinned and have to atone. You cannot be an altar boy now for 4 months. Now you go and behave yourself."

      Joey walks back to his pew, and his friend Franco slides over and whispers, "What'd you get?"

      "Four months vacation and five good leads!"

  39. CrazyOldCatMan Silver badge

    April 1st?

    I had to check the date for a moment to check this wasn't an Aprils Fool..

  40. Andy The Hat Silver badge

    Couple of queries ...

    1) is the instruction manual a half page of google-chinglish or a Bible?

    2) Who came up with this idea? I assume it was a Vatican bean counter ...

  41. disgruntled yank

    To adapt an old quip

    With the old rosaries, you tell the beads, with the new rosaries, the beads tell on you.

  42. DeathsPirate

    O.M.G.

    The Vatican missed a trick here ... They should've released an Alexa alternative but with the booming voice of God himself!

    1. Trollslayer

      Re: O.M.G.

      Herself.

    2. Fruit and Nutcase Silver badge
      Happy

      Re: O.M.G.

      the booming voice of God himself!

      Brian Blessed?

  43. spold Silver badge

    Scary alarm feature...

    ...sticks nails in you

  44. Mr Dogshit

    They could at least have called it PrayPal.

  45. Sherrie Ludwig

    There is a prayer for everything.

    Including the Internet, with intercession from St. Isidore.

    http://www.preces-latinae.org/thesaurus/Varia/SIsidore.html

  46. Paul Hovnanian Silver badge
    Devil

    Four Digit PIN?

    Not three?

  47. ZenCoder
    Angel

    A reasonable reaction?

    It is like they just listened to the concerns and immediately fixed the problem. Maybe their fixes created three times as many vulnerabilities, because otherwise I'm going to start questioning everything I thought I knew about how IT works?

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon