Parents should be wary of all connected toys, expert says

The news comes after a researcher discovered one of Barbie's connected dolls could be hacked

A security expert has warned of the dangers of Wi-Fi enabled toys following the news Barbie dolls can be hacked and used to spy on children.

Hello Barbie can be accessed and a microphone in the product used to listen in on children's conversations, according to security researcher Matt Jakubowski.

Advertisement - Article continues below

The feature, on what is billed as the world's first interactive doll, works in a similar way to Siri on an iPhone or Cortana on a Windows PC. It connects to the internet via Wi-Fi and processes voice recordings before working out a response to a child talking to it.

Jakubowski said the feature was vulnerable to being hacked and could allow hackers to gain information such as the doll's system information, account information, stored audio files as well as direct access to the microphone.

He told NBC that this information could be used to find a person's house or business.

"It's just a matter of time until we are able to replace their servers with ours and have her say anything we want," he warned.

Jakubowski demonstrated how a hacker might be able to take control of data recorded by the toy by overriding privacy features that encrypted audio recordings before being sent over the internet. The information stored could also give information about a home network that hackers could then take over and gain access to other internet devices.

Advertisement
Advertisement - Article continues below
Advertisement - Article continues below

David Emm, principal security researcher at Kaspersky Lab explained that it's not just connected Barbies that can present a security threat this Christmas, but parents should be wary of any toy that canconnect to the internet.

"We live in a connected world, where even our children's toys could become the means for personal data being captured by attackers. It's really important that, when considering such toys this Christmas, parents look beyond the fun aspect of a toy and consider the impact it might have on their child and the wider family."

ToyTalk, the firm behind the technology in Hello Barbie told NBC that the information discovered "does not identify a child, nor does it compromise any audio of a child speaking."

In a blog post, Martin Reddy, Co-founder and CTO of ToyTalk said that Mattel and ToyTalk have invested a "lot of effort to build the safest experience possible for parents and their children."

Advertisement - Article continues below

"As part of that commitment, we are actively engaging the security community to address any concerns. We have initiated a security bug bounty program where security researchers are rewarded for responsibly disclosing potential vulnerabilities to us," he said.

"Concerns about the doll centre mainly around privacy - the fact that secrets entrusted to the doll by a child are shared with Mattel and its partners," Emm added. "There's also the potential risk that such data might fall into the hands of hackers, if the security of Mattel or its partners are breached.

"This issue was highlighted a few days ago when children's toy-maker VTech revealed that a compromise of its systems led to the theft of names, physical addresses, e-mail addresses, security questions and answers, and more data of millions of families worldwide."

Featured Resources

Top 5 challenges of migrating applications to the cloud

Explore how VMware Cloud on AWS helps to address common cloud migration challenges

Download now

3 reasons why now is the time to rethink your network

Changing requirements call for new solutions

Download now

All-flash buyer’s guide

Tips for evaluating Solid-State Arrays

Download now

Enabling enterprise machine and deep learning with intelligent storage

The power of AI can only be realised through efficient and performant delivery of data

Download now
Advertisement

Recommended

Visit/security/355013/10-quick-tips-to-identifying-phishing-emails
Security

10 quick tips to identifying phishing emails

16 Mar 2020
Visit/business-strategy/mergers-and-acquisitions/354941/panda-security-to-be-acquired-by-watchguard
mergers and acquisitions

Panda Security to be acquired by WatchGuard

9 Mar 2020
Visit/security/internet-security/354417/avast-and-avg-extensions-pulled-from-chrome
internet security

Avast and AVG extensions pulled from Chrome

19 Dec 2019
Visit/security/354156/google-confirms-android-cameras-can-be-hijacked-to-spy-on-you
Security

Google confirms Android cameras can be hijacked to spy on you

20 Nov 2019

Most Popular

Visit/security/privacy/355155/zoom-kills-facebook-integration-after-data-transfer-backlash
privacy

Zoom kills Facebook integration after data transfer backlash

30 Mar 2020
Visit/infrastructure/server-storage/355118/hpe-warns-of-critical-bug-that-destroys-ssds-after-40000-hours
Server & storage

HPE warns of 'critical' bug that destroys SSDs after 40,000 hours

26 Mar 2020
Visit/software/355113/companies-offering-free-software-to-fight-covid-19
Software

These are the companies offering free software during the coronavirus crisis

25 Mar 2020
Visit/cloud/355098/ibm-dedicates-supercomputing-power-to-coronavirus-researchers
high-performance computing (HPC)

IBM dedicates supercomputing power to coronavirus research

24 Mar 2020