#ToyFail: Is your child safe from the Internet of Things?
summary
A security review of top-selling internet toys (IQ, Kayla, plus Hello Barbie) shows recordings and metadata leaving phones to third parties, some API calls unencrypted, and Bluetooth pairing with no authentication allowing remote audio playback and eavesdropping. Methods include network interception with Fiddler and Wireshark, app decompilation to extract an SQLite password and thousands of prerecorded phrases (including hidden Disney marketing), and radio work with tools like HackRF. Findings trigger 1,720 media items and ~152.9M potential viewers, and lead to recalls and bans.
AI-written summary · about
chapters (12)
- 0:00Start
- 0:55The Agenda
- 1:35Why with the Norwegian Consumer Council Be Interested in Internet Connected Toys
- 3:41The Scope of this Project
- 7:38Http Decryption
- 12:36Wireshark
- 14:10The Difficulties of Using Wireshark
- 15:19Testing Protocol
- 19:53Color Code Conversations
- 27:48Bluetooth Low-Energy Sniffer
- 30:10Hack Rf
- 33:51Hello Barbie
related talks
01h 07mToys that listen.
15mSmart Toys: Are They Too Smart?
59mThe Internet of Pwned Things
34mThe Cybersecurity of Smart ‘Adult’ Toys, or Lack of It
30mVulnerabilities in the Internet of Things
27mChinese Surveillance and CloudPets
51mThings That Go Bump in the Night: Detecting Problems in the Internet of Things
01h 01mThe Internet of Pwned Things