Smart toys ‘easily hacked’ to spy on kids, claim Which?

Wednesday, 6 December, 2017

Consumer watchdog Which? has joined the growing clamour over the insecurity of smart toys after tests revealed serious flaws that could pose a security risk to children.

Which? is now calling on leading UK retailers including Argos and Tesco to pull the internet-connected devices from their Christmas sales.

German comparison firm Stiftung Warentet joined the consumer group to test a range of popular brands including the Furby Connect, I-Que Intelligent Robot, Toy-fi Teddy and CloudPets cuddly toy.

Each inspection revealed worrying vulnerabilities that could, for instance, allow strangers to talk to a child.

Interactive toys like the I-Que robot can be controlled with an Android or iOS app to search the internet and play games and quizzes.

Which? said that in each of its four tests the toy’s Bluetooth connection was not secured.

Any hacker would therefore not need to know passwords, PIN codes or other authentication to gain access.

I-Que distributor Vivid Imagination said in response to the findings that they took the new information very seriously, but countered that they had no reports of the robot being used maliciously.

Furby Connect manufacturer Hasbro responded saying children’s privacy is their “top priority” and maintained that all their toys complied with children’s privacy laws.

Sadly, there have been many examples in the past two to three years of connected toys that have security flaws that put children at risk.

Whether it is sloppiness on the part of the manufacturer, or their rush to build a product down to a certain price, the consequences are the same.

To produce these toys is bad enough, but to then stock them as a retailer knowing that they are potentially putting children at risk is quite unacceptable.

- Prof Alan Woodward: Visiting Professor, University of Surrey

Other toys tested included the Wowee Chip, Mattel’s Hello Barbie and the Fisher Price Smart Toy Bear but these were given a clean bill of health.

Which? contacted the manufacturers for a response to their findings and asked the major UK retailers to pull the toys from their shelves.

In a statement Argos they had not received any complaints about the toys listed “but we are in close contact with the manufacturers, who are already looking into [the] recommendations.’

Amazon issued a response stating, “we decline to comment on the Furby Connect and Toy-Fi Teddy.”

Tesco has not yet commented, while Toys R Us referred back to the manufacturers.

“Connected toys are becoming increasingly popular, but as our investigation shows anyone considering buying one should apply a level of caution,” said Alex Neill, Managing Director of Home Products at Which?

“Safety and security should be the absolute priority with any toy. If that can’t be guaranteed, then the products should not be sold,” he concluded.

Tim Bamford author picture


Tim is a veteran freelance journalist writing extensively on internet news and cybersecurity.