How kids’ toys are becoming a tool for cybercriminals

girl tablet

Until recently it would have been unthinkable to imagine that a simple Barbie doll could pose a threat to data security and information relating to minors, however, more and more toys aimed at children are now connected to the Internet of Things which leaves them vulnerable to attack.

A current example is the new Hello Barbie, recently released by Mattel, which can speak to children – it has up to 8,000 recorded phrases, allowing it to communicate with its owners.

The toy needs to be connected to a Wi-Fi network to send the audio to the servers of ToyTalk (the company responsible for the voice recognition technology), where it is analyzed and a suitable response is chosen. The users, which in this case would be the parents, have to download an application and open an account with ToyTalk to enable the doll to speak.

hello barbie

Mattel claims that the microphone will only activate itself once the related button is pressed, adding that “parents and guardians have control over their children’s information and can manage it via the account”. However, as is the case with other devices, the servers are exposed to a possible cyberattack.

An example of this type of technology’s vulnerability is the recent data leak suffered by VTech, manufacturers of electronic toys for children. The Chinese company sells tablets, mobiles, and baby monitors.

The cybercriminals managed to get data belonging to five million parents and 200,000 children from the company’s servers. This information included names, email addresses, passwords, postal addresses, and thousands of photographs of minors, and even included recordings of the conversations between the toys and their children.

With the growth in electronic toys comes a growth in possible leaks, which has led to national governments taking measures to counteract this. A recent document released by the British government stipulates the areas in which technological fields intelligence and security agencies can investigate, and each of their respective obligations.

child tablet

According to a report from the BBC, Antony Walker from techUK (an organization that represents more than 850 companies in the UK) has claimed that any device connected to the Internet is at risk of being used as a spying tool.

Walker also raised concern with regards to the danger posed by toys that come equipped with cameras and microphones. “In theory, the manufacturer of those products could be the subject of a warrant to enable equipment interference with those devices”, he added.

The aim of these warnings isn’t to cause panic, nor to put people off purchasing these toys, but rather to raise awareness of the growing risk attached to this type of gift.

The post How kids’ toys are becoming a tool for cybercriminals appeared first on MediaCenter Panda Security.

Top 8 Cyber Security Tips for Christmas Online Shopping

As the most wonderful time of the year has come – Christmas, it has brought with itself the time of online shopping.

According to National Retail Federation, more than 151 million people shopped in store, but more than 100 Million shopped online during Cyber Monday sales and even why wouldn’t it be so given the vast conveniences of online shopping.

It is quite visible in these days that

Protect your phone while traveling for the holidays

Traveling can be stressful, but even more so during the holiday season. AAA projects that the number of year-end holiday travelers in the U.S. will top 100 million for the first time on record. Nearly one in three Americans will travel this holiday season and more than 100.5 million are expected to travel than 50 miles or more from home.

Avast mobile apps help protect your smartphone when you are traveling

Avast mobile apps help protect your smartphone when you are traveling

The one thing you really want to make sure you protect while you travel is your smartphone. Not only may you have your boarding pass on your smartphone, but more importantly, the hardware is expensive and it most likely contains a plethora of personal data.

There are two main ways your phone could be compromised while traveling, especially during the holidays: physical device loss and network threats.

Have an anti-theft app installed

Airports and train stations will be bustling with people, you may have to dash to catch a flight or make a pit stop during a long car ride. In all of these situations, your phone is at risk –physical risk. Pickpockets prefer to work in high density areas, and it’s easy to lose things like your phone when you’re in a rush.

If you lose your phone, Avast Anti-Theft can help protect your data and help you find your phone.

With Anti-Theft, you can accomplish the following:

  • Remotely locate your phone on a map via GPS, Wi-Fi or mobile network
  • Remotely lock your phone
  • Be notified about a SIM card change — the new number and GPS location will be sent to your pre-selected friend
  • Remotely activate an alarm
  • Remotely wipe your phone
  • Remotely lock your phone’s settings app

Use a VPN when connecting to public Wi-Fi

Besides physical loss, your smartphone can be compromised when using public Wi-Fi. Using software that is readily available on the Internet, anyone can snoop on Wi-Fi traffic if they are connected to the same network as you are. This means they can see the websites you visit and, in some cases, even capture login information, which is why it is vital to use a VPN. VPN stands for virtual private network and serves as a private tunnel that encrypts your data while connected to open Wi-Fi and, thus, protects your data from being intercepted and read.

Avast SecureLine VPN is a great, affordable, one-click VPN. In addition to protecting your data, you can also choose which of the many Avast servers located around the world that you want to connect through. This allows you to circumvent geo-restrictions, so you can view content from your home country while traveling abroad.

Happy holidays and safe travels from Avast!


Follow Avast on FacebookTwitterYouTube, and Google+ where we keep you updated on cybersecurity news every day.

CVE-2015-1772

The LDAP implementation in HiveServer2 in Apache Hive before 1.0.1 and 1.1.x before 1.1.1, as used in IBM InfoSphere BigInsights 3.0, 3.0.0.1, and 3.0.0.2 and other products, mishandles simple unauthenticated and anonymous bind configurations, which allows remote attackers to bypass authentication via a crafted LDAP request.

CVE-2015-1836

Apache HBase 0.98 before 0.98.12.1, 1.0 before 1.0.1.1, and 1.1 before 1.1.0.1, as used in IBM InfoSphere BigInsights 3.0, 3.0.0.1, and 3.0.0.2 and other products, uses incorrect ACLs for ZooKeeper coordination state, which allows remote attackers to cause a denial of service (daemon outage), obtain sensitive information, or modify data via unspecified client traffic.

CVE-2015-4993

Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0.0 through 7.0.0.2 CF29, 8.0.0 before 8.0.0.1 CF19, and 8.5.0 before CF08 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2015-4998.

CVE-2015-4998

Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0.0 through 7.0.0.2 CF29, 8.0.0 before 8.0.0.1 CF19, and 8.5.0 before CF08 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2015-4993.

CVE-2015-5001

IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0.0 through 7.0.0.2 CF29, 8.0.0 before 8.0.0.1 CF19, and 8.5.0 before CF08 allows remote authenticated users to cause a denial of service (memory consumption) via a crafted document.