Overpowered and Underprotected Toys Empowering Parents with Tools to Protect Their Children
Joshua Streiff, Sanchari Das, Joshua Cannon · 2019
The Internet of Things (IoT) has penetrated the global market including that of children's toys. Worldwide, Smart Toy sales have reached $9 billion in 2019 and is expected to exceed $15 billion by 2022. Connecting IoT toys to the internet exposes users and their data to multivariate risk due to device vulnerabilities. When IoT devices are marketed to individuals, especially children, the potential for negative impact is significant, so their design must result in robust security implementations. For our study, we performed penetration testing on a Fisher- Price Smart Toy. We were able to obtain root access to the device, capture live pictures and videos, as well as install remote access software which allows surreptitious recordings over WiFi network connections without user knowledge or permission. We propose solutions including adhering to rudimentary standards for security design in toys, a mobile application for IoT threat assessment and user education, and an ambient risk communication tool aligned with user risk perception. The proposed solutions are crucial to empower users with capabilities to identify and understand ambient risks and defend against malicious activities.