Which? Has Warned Retailers About Connected Toys Because of 'Worrying' Security

By Tom Pritchard on at

If it's connected to the internet, it can be hacked. Repeat that mantra to yourself every time you think about buying a connected device that uses the internet to communicate. If it's collecting information, that information is at risk, especially if it's not being stored locally. The same goes for any sort of wireless connectivity.

That's something that's especially concerning when kids' toys are involved, and Which? has asked retailers to stop selling the ones that have "proven" problems where security is concerned. They include the likes of Furby Connect, the i-Que robot, Cloudpets and, Toy-fi Teddy.

Which? found that there was no sort authentication process between the toys and the Bluetooth-enabled devices they connect with, Despite the fact at least two of the manufacturers said they took security very seriously, lack of authentication means that anyone within range could take control of the toy and access any data stored there.

Which? also found that if the unsecured connections were exploited, hackers could communicate with the kids playing with the toys - either directly or with custom audio messages.

Andrew Neill, managing director of home products and services at  Which?, said:

"Connected toys are becoming increasingly popular, but as our investigation shows, anyone considering buying one should apply a level of caution. Safety and security should be the absolute priority with any toy. If that can't be guaranteed, then the products should not be sold."

But the claims have not come without criticism. Hasbro, which makes Furbys, claimed that the testing was done in a very specific set of conditions, and that someone would have to reverse engineer the product and create new firmware to gain access. I-Que maker Vivid Imaginations said there had been no reports of any malicious use of its products, but it would be reviewing Which?'s findings.

I have to say, though, just because nobody has reported a problem doesn't mean it doesn't exist.

Which? also tested Wowee Chip, Mattel Hello Barbie, and Fisher Price's Smart Toy Bear but couldn't find evidence that these toys had any security issues.

Connected toys keep getting released, and at this time of year there's a good chance that a lot of them will end up getting purchased. But just like IoT devices, anyone even considering buying one (even the ones that seemingly have no security problems) should probably think twice. Buy your kids Lego or something instead. [Which? via BBC News]


More Security Posts: