Childrens' toys can be hacked

Which? calls for security-unaware IoT toys to be yanked from shelves

The warnings come after United Kingdom consumer watchdog Which? urged major retailers to withdraw a number of "connected" toys that are expected to be popular at Christmas, after finding security failures that could put a child's safety at risk. Researchers were then able to upload a custom audio file to the toy, which could be anything given the lack of restrictions, including inappropriate material.

Popular Christmas gifts including the I-Que Intelligent Robot, Furby Connect, Toy-fi Teddy and CloudPets cuddly toy had "worrying security failures" when investigated.

This meant that during tests a hacker did not need a password, PIN code or any other authentication to get access.

With the Furby Connect, anyone within a 30 to 100 foot (10 to 30 metre) Bluetooth range can connect to the toy when it's switched on.

CloudPets is a stuffed animal and enables friends to send messages to a child, which are played back on a built-in speaker.

"These toys, especially dolls, may give the appearance of having a personality and human-like quality that appeals to children".

The study found that four out of seven of the tested toys could be used to communicate with the children playing with them, The Guardian reports.

Parents who are consider are considering buying these kinds of toys this Christmas may wish to take extra care when selecting any electronic toy that has a camera or voice recording ability, connects to the internet or allows remote connection using a smartphone or tablet app.

Alex Neill, Which? managing director of Home Products and Services, said: "You wouldn't let a young child play with a smartphone unsupervised and our investigation shows parents need to apply the same level of caution if considering giving a child a connected toy".

As more toys add Wi-Fi and Bluetooth connections to pack in new skills and features, regulators have kept a wary eye on them for security vulnerabilities.

Hasbro, which makes the Furby Connect, said: "Children's privacy is a top priority, and that is why we carefully designed the Furby Connect and the Furby Connect World app to comply with children's privacy laws. If that can't be guaranteed, then the products should not be sold".

Hasbro, which makes the Furby Connect, said in a statement that it believed the results of the tests carried out for Which? had been achieved in very specific conditions. It said: "While it may be technically possible for someone other than the intended user to connect to the toys, it requires certain sequence of events to happen in order to pair a Bluetooth device to the toy, all of which make it hard for the third party to remotely connect to the toy".

Spiral Toys declined to comment to Which? in relation to Toy-Fi Teddy and Cloud Pets.

Related News:



Most liked

Over 15000 scientists issue warning to humanity
There's also less fresh water available, and the human population has risen while the population for everything else has declined. This second warning letter comes as world leaders have been meeting for the past two weeks at the U.N.

Evidence of 'World's Oldest' Grape Wine Dug Up in Georgia
The latest finds were published in the journal Proceedings of the National Academy of Sciences (PNAS). Love wine? A team of researchers found out just about how old the practice of wine-making is.

EgyptAir's Bombardier CSeries outline deal valued at $1.1 billion
Earlier this month, Bombardier also revealed it had secured orders for 31 aircraft from an unnamed European customer. Its presence is "adding confidence about the long-term success of the programme", he said on November 2.

Ronaldo asks to leave Real Madrid after two factors irk Portuguese star
But that the request was unequivocally rejected - and that has only worked to worsen the superstar's anger towards the club. Cristiano Ronaldo has chose to leave Real Madrid at the end of the season, according to reports in Spain .

Prisoner alleges Ram Rahim being given extra time to meet family
Adjoining his barrack, there is a small plot of land where grows vegetables, K P Singh, DGP (jails), Haryana had told reporters. The case was registered by the CBI in December 2002 on the directions of the Punjab and Haryana High Court.

Taylor Swift Performs 'New Year's Day' on 'Tonight Show'
I could see Jimmy silhouetted at his desk dabbing his eyes with a tissue. Gloria Fallon died "peacefully" on 4 November in hospital in NY .

Old £10 Note Cut-Off Date Revealed By The Bank Of England
Old notes can still be spent before this cut-off date and exchanged at the Bank once this point has passed. The Jane Austen notes have a number of features built in that make them particularly hard to forge.

China leads 'Top500' ranking of supercomputers
USA vendor Hewlett Packard Enterprise also leads on the Top500 list as the biggest provider of installed supercomputing systems. Claimed as the most powerful supercomputer in Europe, Piz Daint was upgraded previous year with NVIDIA Tesla P100 GPUs.

Duterte serenades Trump during Asia tour
A communications official with the Duterte administration said the Philippines president and Trump "really hit it off". More than 3,900 people have been killed in a war on drugs that Mr Duterte declared when he took office past year .

Wenger: Man City are good but not unstoppable!
In this game we conceded a penalty that was not a penalty and an offside goal that was an offside goal. But at the moment only one team has done it".

West Bengal gets Geographical Indication status for rosogulla
It is believed that Naveen Chandra Das, the famous candies maker of Bengal, invented Rosgulla before the year 1868. West Bengal and Odisha have been engaged in a legal battle over the origin of the syrupy Rosogolla since 2015.

Turnbull cops a battering over same-sex marriage
However, this vote is nonbinding, which means it is up to the country's Parliament to pass legislation. MPs would be free to move "any amendments they want" to a private bill, he said.

NASA launching JPSS-1 weather satellite
This would avoid a dreaded gap that could have adversely affected weather forecast accuracy in the U.S. The JPSS-1 spacecraft was built by Ball Aerospace in Boulder, Colo.

The President Of The Philippines Sang A Love Song For Donald Trump
From left, Thai Prime Minster Prayut Chan-o-cha, Russian Prime Minister Dmitry Medvedev, Vietnamese President Tran Dai Quang, U.S. President Donald Trump and Philippine President Rodrigo Duterte do the "ASEAN-way handshake".

Navi Mumbai: Burglars dig 25 feet tunnel to rob bank
On December 30, 2007, robbers entered the Bank of Kerala branch in Malappuram in Kerala, using a hole they had dug in the floor. The safest option that customers are then left with is their home and getting their valuables insured against theft or damage.