12-year-old "cyber ninja" shows how a hacker's poison can spread

Facebook's Cambridge Analytica scandal is fueling the debate over how to protect digital information. One hacker from Texas is also raising awareness about growing cyber threats.

And he's only 12 years old.

Reuben Paul is a sixth grader from Austin. The self-proclaimed "Cyber Ninja" has a second-degree black belt in kung fu, and he's on a mission to show how hacking is child's play.

Paul hacks household items to demonstrate how they can be exploited to spy on or even harm people, such as turning "smart toys" into listening devices.

Paul has advised a tech conference in Singapore, presented in the Netherlands, and wowed a crowd full of executives in Texas. "It is important that we need to reinvent cybersecurity, because obviously what we have invented so far is clearly not working," he told the audience.

He says that the Bluetooth and Wi-Fi connections that we use almost every day are extremely vulnerable to hacking. "I'll never connect to a public Wi-Fi that I don't know," he said. "Somebody can just hack into that Wi-Fi network and poison it."

He showed CBS News correspondent David Begnaud firsthand how a hacker's poison can spread through a Wi-Fi signal. In just seconds he obtained the reporter's Twitter username and password using a fake page he had cloned, after Begnaud connected to his public Wi-Fi network.

"Wow. So, call me gullible!" he laughed. "It's that easy? So in other words, if I was sitting at a Starbucks, I went to sign in to Twitter, I put it in, they got it?"

"Uh-huh," Paul replied.

Paul also hacked a CloudPet's Teddy Bear. It uses Bluetooth technology, allowing traveling parents to send messages back to their kids.

"Without any notification or any knowledge of the user, I could turn it on from my computer, which only has to be in a 30-foot radius of the bear," Paul said. "So, I could stand outside somebody's house."

He turned the bear into a secret recording device.

"If a 12-year-old can do it, what makes it that somebody who is a skilled, actual cyber terrorist, what makes it that they can't do it?" said Paul. "This Bluetooth is going into new autonomous cars, autonomous drones. It's going into medical devices."

The Paul family of four is hopeful about the future of cyber security. Reuben's parents, Mano and Sangeetha, both work in technology.

And Reuben's six-year-old brother Ittai is even joining him on stage now.

"When they shine at it and they're liking what they do, it gives you a feeling of contentment," Sangeetha said.

"With Reuben speaking at these conferences and being paid thousands of dollars to travel there and sometimes a speaker's fee, do you worry that it gets a little out of control for a 12-year-old?" Begnaud asked.

"First and foremost, the kids do it because they have a passion for it," Mano replied. "It should never become a job for them. So, if tomorrow they come back and they say, 'Not interested in doing this,' it's perfectly fine with my wife and I."

Reuben says that in the future he wants to work for the NSA or FBI to protect the country against foreign and domestic cyber threats.

Has he been recruited yet? "I've had some offers from the government of the Netherlands, and even the Department of Defense," he said.

"Did you tell 'em, what, 'I gotta graduate first'?"

"Yeah. I want to get done with sixth grade first before I start thinking about jobs!" he laughed.

CBS News reached out to CloudPets and Spiral Toys, the companies behind the teddy bear that Paul hacked. Neither responded to our requests for comment.

On its website, CloudPets says users acknowledge the company "may capture audio recordings," and that it may use or store the recordings and the data contained within them.

Paul set up a non-profit to create videos that teach people about cyber dangers. He hopes to one day study at Caltech or MIT. He also aspires to be an Olympic gymnast.