Until recently it would have been unthinkable to imagine that a simple Barbie doll could pose a threat to data security and information relating to minors, however, more and more toys aimed at children are now connected to the Internet of Things which leaves them vulnerable to attack.

A current example is the new Hello Barbie, recently released by Mattel, which can speak to children – it has up to 8,000 recorded phrases, allowing it to communicate with its owners.

The toy needs to be connected to a Wi-Fi network to send the audio to the servers of ToyTalk (the company responsible for the voice recognition technology), where it is analyzed and a suitable response is chosen. The users, which in this case would be the parents, have to download an application and open an account with ToyTalk to enable the doll to speak.

Mattel claims that the microphone will only activate itself once the related button is pressed, adding that “parents and guardians have control over their children’s information and can manage it via the account”. However, as is the case with other devices, the servers are exposed to a possible cyberattack.

An example of this type of technology’s vulnerability is the recent data leak suffered by VTech, manufacturers of electronic toys for children. The Chinese company sells tablets, mobiles, and baby monitors.

The cybercriminals managed to get data belonging to five million parents and 200,000 children from the company’s servers. This information included names, email addresses, passwords, postal addresses, and thousands of photographs of minors, and even included recordings of the conversations between the toys and their children.

With the growth in electronic toys comes a growth in possible leaks, which has led to national governments taking measures to counteract this. A recent document released by the British government stipulates the areas in which technological fields intelligence and security agencies can investigate, and each of their respective obligations.

According to a report from the BBC, Antony Walker from techUK (an organization that represents more than 850 companies in the UK) has claimed that any device connected to the Internet is at risk of being used as a spying tool.

Walker also raised concern with regards to the danger posed by toys that come equipped with cameras and microphones. “In theory, the manufacturer of those products could be the subject of a warrant to enable equipment interference with those devices”, he added.

The aim of these warnings isn’t to cause panic, nor to put people off purchasing these toys, but rather to raise awareness of the growing risk attached to this type of gift.

The post How kids’ toys are becoming a tool for cybercriminals appeared first on MediaCenter Panda Security.

The Internet of Things (IoT) has arrived and it’s here to stay. What might seem a tool that is only used by a select few will soon become a worldwide trend – the lock on your home, your household objects, and even your toothbrush will soon be connected to the network and under control via an app.

For this to become a reality, it will be necessary that an army of engineers and developers that program the software is created. It is estimated that in the coming years this will generate millions of employment opportunities. That said, it won’t just be necessary to create thousands of applications and devices that are connected to the network, but rather the importance will be on protecting the security of users.

In fact, the first stages of the Internet of Things is fraught with a worrying number of vulnerabilities – according to a study by Andrei Costin and Aurelien Francillion, two security experts at the French investigation center, Eurocom, IoT devices that are currently on the market are riddled with security flaws.

To complete their investigation, the pair analyzed nearly 2,000 variants of firmware that accompanied the first network connected devices. The conclusions of the study couldn’t be more worrying – they found nearly 10,000 vulnerabilities that could put user security at risk.

Among these flaws were some that would allow cybercriminals to access personal information to even infect the device with the aim of controlling it remotely.

The situation is particularly worrying if one keeps in mind that a lot of devices related to the Internet of Things are used to control doors and windows of homes, and even the temperature of the house. By taking advantage of this, a criminal with sufficient knowledge could manipulate the devices and gain access to our homes.

As Costin explains, the team of investigators unearthed these flaws in a simple way. He highlighted that the manufacturers could have discovered them earlier if they had used his methods before releasing them on the marketplace.

Although it is worrying that they have found nearly 10,000 vulnerabilities, it is even more frightening to think that the investigators limited their search to only the interfaces of the devices. This all points to a grim reality of the possibility that there are still more flaws that have yet to be discovered.

If the Internet of Things wants to become a reality within our lives, it is hugely important that its developers pay more attention to its security. Only then will users be able to use connected devices without the fear of a security flaw hanging over them.

Meanwhile, Costin and Francillon’s investigation appears to indicate that our data and security are currently at risk due to this new technology.

The post Thousands of errors found in multiple Internet of Things devices appeared first on MediaCenter Panda Security.