Unpredictable dangers from children's smart toys

There is a new Android-powered children's toy robot on the market equipped with a camera and microphone. The toy uses artificial intelligence (AI) to recognize and name children, automatically adjusts its response based on the child's mood, and over time it gets to know the child.

To fully exploit the features of this robot, parents need to download a control application on their mobile devices. This application allows parents to monitor their child's learning process and even make video calls with their child through the robot.

During the setup process, parents are guided through connecting the robot to their mobile device via Wi-Fi, and then they provide the child's name and age to the device.

During the setup phase, Kaspersky experts discovered a worrying security issue when the "Application Programming Interface" that requests child information lacks authentication, even though this is an important check to confirm who is allowed to access the user's network resources.

Security vulnerabilities on smart devices are an opportunity for cybercriminals. Photo: Kaspersky

This vulnerability allows hackers to take control of the robot system and can initiate a live video call with the child, completely bypassing the consent from the parent's account. If the child accepts the call, the bad guys can freely exchange secrets with the child and then manipulate, lure the child out of the house or guide the child to perform dangerous actions.

In addition, the risks associated with the application of this robot system also open up other dangers such as the possibility of children's personal information being stolen, including name, gender, age and even geographic location.

Experts say that security issues in the app on parents' mobile devices could allow attackers to remotely control the robot and gain unauthorized access to the network. They could also recover OTP passwords, set up unlimited failed login attempts, and hackers could remotely link the robot to their account, thereby disabling the owner's control of the device.

“When buying smart toys, it is important not only to consider their entertainment and educational value, but also to pay attention to their safety and security features,” stressed Nikolay Frolov, senior security researcher at Kaspersky ICS CERT.

"Parents should be aware that even the most expensive smart toys are not completely immune to vulnerabilities that attackers can exploit. Therefore, it is necessary to carefully review toy reviews, always update smart devices to the latest versions and closely monitor children's play activities," he warned.

Source: https://nld.com.vn/nguy-hiem-kho-luong-tu-do-choi-thong-minh-tre-em-196240314161055442.htm