(Bloomberg View) – How dangerous is a teddy bear or a doll? In the Internet of Things era, it's not an idle question but one for parents and regulators to ponder seriously.
On Monday, Troy Hunt, the cybersecurity expert who maintains the “Have I been pwned?” database of major breaches affecting the clients of internet businesses, revealed a problem with CloudPets, a series of cuddly toys made by a U.S. company called Spiral Toys. The toys allow parents to talk with their kids remotely. The conversations were recorded and stored — along with users' encrypted passwords — on an unprotected server that belonged to a Romanian company called mReady. The passwords were easy to break.
Related: 2016's most dangerous toys
Hunt listened to some of the messages — sweet nothings kids want to say to their parents. Any malicious actor could have figured out how to communicate with the kids. Apparently, the exposed database was located numerous times using a search engine that finds connected devices, and attempts were made to hold Spiral Toys for ransom.
It was useless: According to a quarterly report it filed in the summer of 2016, the tiny, loss-making company had stopped making toys. Which, of course, hardly solves the problem for the parents who still have CloudPets in their homes.
|Exposing kids to cyber risks
This is not the first time connected toys have been found to expose kids in this way. Cayla, the doll made by Genesis Toys, allowed strangers (also apparently advertisers) to speak directly to children.
Another Genesis toy called i-Que co-starred with Cayla in a complaint to the Federal Trade Commission in the U.S. while a German regulator, the Federal Network Agency, this month banned Cayla outright, saying it was essentially a spying device. The regulator also said it was testing other connected toys.
A doll made a much bigger company, Mattel has put out a lengthy list of frequently asked questions designed to convince parents that its web-connected Hello Barbie is safe. In 2015, security researcher Matt Jakubowski claimed to have hacked it, getting access to sound files and location data.
Most parents understand what's wrong with letting their kids use social networks and have their locations and activities tracked. Instinctively, many won't even post their kids' pictures online — and that's probably wise because their own activity is being tracked and bad actors can get access to the data. But VTech, the company that makes the Kidzoom DX — a kind of children's smartwatch that was popular during the last holiday season — had been hacked in 2015, providing data on hundreds of thousands of kids who had used the firm's toy laptops.
|Bullying, extortion, kidnapping
The opportunities for bullying, extortion, even kidnapping using the connected toys are endless. But adults' information is also at risk from them: The toys can be conduits into home networks. A case is even known in which an internet-connected toy robot was used to take a picture of someone's apartment keys.
Of course, every internet-connected object — a thermostat, a home lighting system, a car — can be unsafe. But adults are supposed to be qualified risk-takers, and yet they expose their children at an increasing rate. In late 2015, Juniper Research estimated the size of the smart toy market that year at $2.8 billion and predicted it would top $11 billion in 2020.
Millennial parents are connected toy makers' biggest hope: They allow their kids more screen time than previous generations of moms, and they generally trust technology, and technology companies, far more than analog-age people ever could. According to BSM Media, a company that specializes in marketing to mothers, 38 percent of moms buy their kids connected toys because they “look educational.”
Like most of the data we voluntarily donate to internet companies, our kids' data probably won't be used for an evil purpose. But one breach is enough to change that, and to plunge a family into hell. If parents don't realize that, it can only fall to regulators to make sure kids are protected.
This column does not necessarily reflect the opinion of the editorial board or Bloomberg LP and its owners.
Copyright 2018 Bloomberg. All rights reserved. This material may not be published, broadcast, rewritten, or redistributed.
Want to continue reading?
Become a Free PropertyCasualty360 Digital Reader
Your access to unlimited PropertyCasualty360 content isn’t changing.
Once you are an ALM digital member, you’ll receive:
- Breaking insurance news and analysis, on-site and via our newsletters and custom alerts
- Weekly Insurance Speak podcast featuring exclusive interviews with industry leaders
- Educational webcasts, white papers, and ebooks from industry thought leaders
- Critical converage of the employee benefits and financial advisory markets on our other ALM sites, BenefitsPRO and ThinkAdvisor
Already have an account? Sign In Now
© 2024 ALM Global, LLC, All Rights Reserved. Request academic re-use from www.copyright.com. All other uses, submit a request to [email protected]. For more information visit Asset & Logo Licensing.
