Security vulnerabilities in smart toys allow cybercriminals to video chat with children. Illustration. Source: securelist.com
To take full advantage of the robot’s features, parents need to download the control application on their mobile device. This app allows parents to monitor their child’s learning progress and even make video calls with them through the robot. At the setup stage, parents are instructed to connect the robot to their mobile device via wifi, after which they will provide the child’s name and age to the device.
However, Kaspersky researchers recently discovered vulnerabilities in smart toy robots that could make children targets for cybercriminals. This vulnerability allows hackers to control the robot system to video chat with children without parental consent.
Another worrying security issue is that the Application Programming Interface that requests child information lacks authentication features, while this is an important check to confirm who is authorized to access. to the user’s network source. This has the potential for cybercriminals to intercept and steal a variety of data, including a child’s name, age, gender, country of residence, and even IP address, by blocking and analyzing it. network access frequency.
This vulnerability allows criminals to enable direct video calls with children. If the child accepts the call, the attacker can communicate secretly with the child without the parent’s permission. In this case, the attacker can manipulate and lure children out of the house or guide them to commit dangerous acts.
Furthermore, application security issues in the parent’s mobile device could allow attackers to remotely control the robot and access unauthorized networks. Through the use of brute-force methods to recover OTP passwords and the unlimited number of failed login attempts, an attacker can remotely link the robot to his own account, thereby disabling it. Enabling the owner’s control of the device.
To ensure the safety of smart devices, cybersecurity experts have given advice: Regularly update software programmed on the hardware of electronic devices (firmware) and software (software). ) for all connected devices, including smart toys. These updates often contain important security patches to fix vulnerabilities.
Parents also need to thoroughly check the manufacturer’s security and privacy levels before purchasing smart toys or any connected devices. Choose devices from reputable brands, prioritizing brands that focus on security and provide regular updates.
In addition, parents also need to be cautious about giving access permissions to applications. Specifically, access rights of mobile applications for smart devices should be considered and limited; Only grant access to features and data and limit granting unnecessary privileges.
Power off the product when not in use to prevent data leakage. If your device has a microphone, store it in a hard-to-reach place, cover it, or point it away when not in use. Finally, a reliable security solution should be used./.
