Security & Privacy in Smart Toys

Security and Privacy Analyses of Internet of Things Children’s Toys

“…Furthermore, this pattern of good privacy posture being let down by weak implementation is not unique to the toys in our study. Recently, researchers have shown that in spite of an encryption mechanism intended to preserve the privacy of children's voice recordings in transit, a particular toy's usage of a fixed set of keys made it possible to completely decrypt any voice communication between the toy and its server [8].…”

Playing With Danger: A Taxonomy and Evaluation of Threats to Smart Toys

“…For instance, some of the toys we examined present content fetched over an unencrypted channel, making them subject to being maliciously replaced by a network attacker. A compromised toy with a speaker can be made to voice distressing audio [60]. Finally, a child can be harmed by any leak of information captured by a smart toy.…”

Turner, S; (2020) Connected Toys: What Device Documentation Explains about Privacy and Security.

“…12 This is concerning because, once purchased, a child can use any device that their caregiver deems reasonable. Valente and Cardenas (2017) found that carers allow children full access to connected devices aimed at an adult audience, because the functionality is broader than equivalent devices aimed at children. Safeguards in place for children's privacy in particular may be of little value if toys that are marketed to them pale in comparison to technology that is already available in the child's home.…”

“…Children are less likely than a parent or carer to understand the implications of bringing a connected device into the home. Research has shown that children do not always understand that devices with a microphone will record them, or that individuals can subsequently listen to the recordings (Valente and Cardenas (2017)). Although Article 14 of GDPR suggests that privacy policies should be targeted at the users of the product, this does not happen in practice -with only one of the six privacy policies reviewed having a reading age close to the target age of the product (Detective Dot being aimed at children aged 7+).…”

“…This is not ideal, as email is a slow and complex way for an individual to communicate with an organisation -having to draft an email with appropriate words is much more time-consuming and labourintensive than pressing a button designed for this purpose. Valente and Cardenas (2017) show the relative ease with which data can be gained from a connected, smart toy -you can ask it questions that may point to a name, location, or other distinguishing features of the previous owner.…”