Security Flaws in Smart Toys Could Expose Kids to Hackers

UK consumer watchdog Which? brought on cybersecurity experts NCC Group to evaluate the safety of seven popular smart toys from major retailers including Amazon, Smyths, Argos, and John Lewis.

NCC said it found an alarming number of issues that could potentially put children at risk.

“Across all seven toys we found 20 noteworthy issues – two were high risk, three were a medium risk and the remainder were low risk,” the group said.

Karaoke toys, Singing Machine SMK250PP and TENVA were among those put through their paces by the team. NCC found that neither of the devices required authentication, such as a Pin code or Bluetooth connection.

This lapse in security means that anyone could connect to the toys and send recorded messages to a child.

“While the child cannot send messages back, an attack in Bluetooth range (around 10 metres) could suggest to the child, ‘come outside to get some free sweets’, for example.” the group said.

A similar issue was recently discovered in a popular children’s Vtech walkie talkie, KidiGear.

“A pair of walkie talkies investigated as part of this security assessment allowed for children to communicate with each other, within a range of up to 150 meters. There was no mutual authentication between the pairs of walkie talkie devices,” NCC Group said.

“This means that if an attacker purchased the same set of toys and was in the range of an unpaired, powered-on walkie talkie, they would be able to successfully pair with it and engage in a two-way conversation with the child user under certain conditions.”

However, Vtech has said this is a highly unlikely scenario as the pairing of the devices cannot be initiated by a single device. To pair, both devices must be activated at the same time within 30 seconds to connect. After a device is paired it cannot be paired with a third one.

In addition, NCC found that the karaoke toys were vulnerable to “second-order IoT attacks”, which involves someone using the toys to exploit another voice-controlled device, such as a nearby Amazon smart speaker.

“While different smart home configurations will exist, it is not inconceivable that some homes might have digital assistants configured to open smart locks on front doors, for example. One can thus imagine an attacker outside of a property, connecting without authentication to a Bluetooth toy to stream audio commands to enact a second-order objective, such as ‘Alexa, unlock the front door’.”

A similar attack could enable hackers to order goods from the victim household’s Amazon account and intercept them, according to Which?

Which? first investigated the safety of smart toys in 2017, testing a range of toys that featured a network connection, app or other smart interactive feature.

“We found concerning vulnerabilities at that time, and so it’s extremely worrying that two years on we are here reporting similar issues,” the group said.

Which? said it has shared its findings with industry body the British Toy and Hobby Association, and the Department for Culture, Media and Sport.

“Smart toys are one of the key areas identified by the government’s drive to make connected products ‘secure by design’.

“We’re calling on the toys industry to ensure that unsecure products like the ones we’ve identified are either modified or ideally made secure before being sold in the UK.”

source digit

Industry: Cyber Security