Teddy loves to see you, hear you, you…

Teddy

What could be more harmless than a teddy bear? Appearances can be deceiving…

Virtual companions are a category of connected toys aimed at young children. They work the same way as Siri on an iPhone, passing through an artificial intelligence-like platform. This allows them to respond to a child’s questions in real-time, as long as they are connected to the Internet via a Wi-Fi network. Parents can access this service online through a smartphone app associated with the toy.

Main risks

Artboard 2

Data leak

Can do as much damage as a water leak…

Data leak

Connected toys can collect a lot of data when they interact with your child. The first piece of advice will, therefore, be to give them as little information as possible to identify the child or those around him. When starting the toy or registering for the online service, if identification data is requested, you must always use
• pseudonym
• fictitious address
• fictitious date of birth (but realistic according to age).

In general, give as little personal information as possible for the toy when it is dealing with a child.

This type of toy usually provides a platform on which parents can listen to or re-listen to conversations children have with their objects. This allows parents to monitor the correct use of the toy, but it also comes with risks:
• These recordings could also leak if the platform is poorly secured.
• Constant supervision of children can harm their privacy, and the relationship of trust they should have with their parents.

Whatever data is collected and stored by the connected toy or the platform, you must first ensure that you can access it to delete it.
Artboard 1

Diversion

An army of robots who want to harm us…

Diversion

Hijacked by a malicious individual, the connected toy could be used for fraud, identity theft or harassment. Especially when in the hands of a young child, the toy’s Internet connections should be secure and monitored.

Virtual companions often have a Bluetooth connection in order to connect to their smartphone application. In the absence of a password, this connection represents a major loophole that allows third parties to come into contact with children pretending to be the toy, provided they are nearby.

Connected toys can also be the objects of attacks that do not target them directly, but aim to transform them into "zombies" to form networks of remotely controlled "botnet" robots. These botnets are generally used to launch denial of service attacks (DDOS - Distributed Denial of Service).

In case attackers manage to take control enough IoT devices to form a botnet, they can activate them simultaneously to generate an intense artificial data flow and overload networks. This results in the unavailability of information networks or systems, sometimes vital for individuals, companies or communities.
Artboard 4

Tracking

Big Brother hidden in a teddy bear...

Tracking

Connected toys with listening or video recording capabilities can easily turn into spies. This was particularly the case with the Cayla doll, which was withdrawn from sales in Germany.

Protection tips

Artboard 1

Password

0000 is null for the password...

Password

Virtual Companions are often provided with default passwords that are too simple, or even non-existent, to log in to their smartphone platform or app. They must be replaced by solid passwords. These must contain uppercase, lowercase, numbers and special characters. You can test the strength of your password through free tools such as https://howsecureismypassword.net/.

If it is not possible to change the default password, it is better to refrain from purchasing the toy.
Artboard 2

Network

Close the front door…

Network

Before buying a connected toy, it is important to understand how and when it will connect to the Internet or other devices such as a smartphone. The utmost vigilance is required concerning the connectivity of the toy. At a minimum, check that the toy does not allow just anyone to connect to it. Its pairing with a smartphone cannot be automatic. It must be done using a physical access button on the smartphone or an access code. In addition, care should be taken to
• change the default setting of the toy (pin code, password, etc.),
• secure access to the online account attached to the toy with a strong password,
• check that the object has an indicator light when it is in "listening" mode or transmission of information on the Internet,
• check that it does not present vulnerabilities that are already known and easily exploitable.


Any gateways to the system of a connected toy and the data stored on it can also serve as vectors of attacks on the applications or the operating system of that toy.

If a pirated toy has extended rights to control another device to which it is connected, such as a smartphone, the attacker can also use these rights to take control of the latter.
Artboard 10

Recognised manufacturers

« Clever Akafen »

Recognised manufacturers

To reduce risks, it is advisable to choose recognised products from reputable manufacturers. These manufacturers generally have the means to invest in the development of quality products. If in doubt, prefer a purchase in a store from specialised sellers who can have them tested and give you technical advice.
Artboard 7

Regular updates

Patch, Patch, Patches…

Regular updates

One of the major issues is a common suspect in cybersecurity: failing to install software updates ("patches"). It is particularly important to use the patches provided by the suppliers. This is especially important for connected objects which are -by definition- permanently exposed to potential attacks.

When updates are available for the connected toy, they should be installed immediately. If there is an automated update feature, it should be enabled. Please note: with each update, modifications may be made to the structure of authorisations. Check permissions after each update and readjust if necessary.
Artboard 11

Deactivation of the device

Because an oversight can become a flaw…

Deactivation of the device

To avoid any data leakage or hijacking, care must be taken to deactivate the virtual companion that is not in use.
Artboard 12

Disposal

Because everything has an end…

Disposal

In case of prolonged non-use or obsolescence, connected toys should be removed from the network and disposed of. IoT devices often have a memory that stores information or configurations that reveal aspects related to the security of your network. Do not forget to delete this data from the devices.
Artboard 6

Contract

Dura lex sed lex…

Contract

toy can be long and complex, but they are not trivial because they legally bind their users. In the case of virtual companions, you must be particularly careful because of the following reasons:

- The general conditions for access to the platform are not always mentioned on the packaging or in the documentation of the toy.
- There can be a big gap between the commercial promises on the packaging and the content of the general conditions of use.
- The warranty on connected toys does not necessarily cover associated services.


So, there are many things to check before buying…

Campaign material

If you want to educate those around you whether employees, teachers, pupils/students, citizens … you can use the promotional material according to your needs. Contact: info@secure-iot.lu