Security Flaws in Smart Toys Could Expose Kids to Hackers
.jpg)
UK consumer watchdog Which? brought on cybersecurity experts NCC Group to evaluate the safety of seven popular smart toys from major retailers including Amazon, Smyths, Argos, and John Lewis.
NCC said it found an alarming number of issues that could potentially put children at risk.
“Across all seven toys we found 20 noteworthy issues – two were high risk, three were a medium risk and the remainder were low risk,” the group said.
Karaoke toys, Singing Machine SMK250PP and TENVA were among those put through their paces by the team. NCC found that neither of the devices required authentication, such as a Pin code or Bluetooth connection.
This lapse in security means that anyone could connect to the toys and send recorded messages to a child.
“While the child cannot send messages back, an attack in Bluetooth range (around 10 metres) could suggest to the child, ‘come outside to get some free sweets’, for example.” the group said.
A similar issue was recently discovered in a popular children’s Vtech walkie talkie, KidiGear.
“A pair of walkie talkies investigated as part of this security assessment allowed for children to communicate with each other, within a range of up to 150 meters. There was no mutual authentication between the pairs of walkie talkie devices,” NCC Group said.
“This means that if an attacker purchased the same set of toys and was in the range of an unpaired, powered-on walkie talkie, they would be able to successfully pair with it and engage in a two-way conversation with the child user under certain conditions.”
However, Vtech has said this is a highly unlikely scenario as the pairing of the devices cannot be initiated by a single device. To pair, both devices must be activated at the same time within 30 seconds to connect. After a device is paired it cannot be paired with a third one.
In addition, NCC found that the karaoke toys were vulnerable to “second-order IoT attacks”, which involves someone using the toys to exploit another voice-controlled device, such as a nearby Amazon smart speaker.
“While different smart home configurations will exist, it is not inconceivable that some homes might have digital assistants configured to open smart locks on front doors, for example. One can thus imagine an attacker outside of a property, connecting without authentication to a Bluetooth toy to stream audio commands to enact a second-order objective, such as ‘Alexa, unlock the front door’.”
A similar attack could enable hackers to order goods from the victim household’s Amazon account and intercept them, according to Which?
Which? first investigated the safety of smart toys in 2017, testing a range of toys that featured a network connection, app or other smart interactive feature.
“We found concerning vulnerabilities at that time, and so it’s extremely worrying that two years on we are here reporting similar issues,” the group said.
Which? said it has shared its findings with industry body the British Toy and Hobby Association, and the Department for Culture, Media and Sport.
“Smart toys are one of the key areas identified by the government’s drive to make connected products ‘secure by design’.
“We’re calling on the toys industry to ensure that unsecure products like the ones we’ve identified are either modified or ideally made secure before being sold in the UK.”
source digit
Industry: Cyber Security

Latest Jobs
-
- Contact 12 month- Security Operations- Crowdstrike Falcon Insight EDR / Analyst.
- United Kingdom
- Dependent on experience
-
Security Operations engineer / Analyst with Crowdstrike Falcon Insight EDR experience for a 12 month contract. Experienced Contractor with Crowdstrike Falcon Insight: Endpoint detection and Response (EDR) experience needed - 12 month rolling project. Implementation, configuration and Analyst experience needed with Crowdstrike Falcon Insight: (EDR) Migration project- relocating capability internationally. technically implementing, configuration of that that migration and then transition to BAU role monitoring. DCL Search exclusive associate Project.
-
- SailPoint Consultant
- London
- Upto £75,000 plus benefits
-
SailPoint Consultant is needed for an expanding Financial Service business, this is an exciting time to join the Business as they are in the Process of deploying both IAM and PAM solutions and this consultant will form a key part of the IAM team Location can be flexible but would require the individual to come into the London office a couple of times a month for team meetings and face to face project reviews Duties include · Engage in the Identity & Access Management project to deliver SailPoint IdentityNow and Privileged Access Management · On-board applications and users into IAM tools and customise or configure integrations as required · Regularly review, secure and recertify privileged roles in applications, databases and operating systems · Implement least privilege, just-in-time access, password rotation and vaulting wherever possible · Migrate application authentication to Single Sign-On through the use of SAML and OAuth · Implement and enforce the use of MFA where possible, focusing on critical applications and risky sign-ins · Provide technical support to Centrify and SailPoint users Key experience required: Previous experience with SailPoint, including integrating and deploying into a business, onboarding users and applications, supporting users and performing manual administration tasks. Experience with SAML and OAuth to migrate applications to Single Sign-on. If you are interested in hearing more please reach out to me for more information
-
- Centrify Consultant
- London
- Upto £75,000 plus benefits
-
A Privileged Access Management Consultant is needed for an expanding Financial Service business, this is an exciting time to join the Business as they are in the Process of deploying a Centrify PAM solution,, this consultant will form a key part of the team Location can be flexible but would require the individual to come into the London office a couple of times a month for team meetings and face to face project reviews Duties include · On-board applications and users into PAM tools and customise or configure integrations as required · Regularly review, secure and recertify privileged roles in applications, databases and operating systems · Implement least privilege, just-in-time access, password rotation and vaulting wherever possible · Migrate application authentication to Single Sign-On through the use of SAML and OAuth · Implement and enforce the use of MFA where possible, focusing on critical applications and risky sign-ins · Provide technical support to Centrify users You would also gain expsoure with the IAM toolset as part of an Identity Access deployment. Key experience required: Previous experience with a PAM tool (Centrify would be an added bonus but not essential) including integrating and deploying into a business, onboarding users and applications, supporting users and performing manual administration tasks. Experience with SAML and OAuth to migrate applications to Single Sign-on. If you are interested in hearing more please reach out to me for more information
-
- SOC team lead- Deputy SOC manager - Managed Security Services, Bradford. Exclusive
- Bradford
- £70,000 +
-
SOC team lead- Deputy SOC Manager - Managed Cyber Security Services, Bradford. Exclusive Identifier project. Technical team lead needed to join a Managed Cyber Security Services business. The role will be a hands on lead role and technical escalation point for the team. You will also be responsible for leading, mentoring, growing and developing the team. You will be the deputy SOC manager and be involved in the strategic growth of the capability. A managed security services background is essential, specifically within a managed security operations capability. Current hands on support experience across Firewall, SIEM, Incident Response is essential.