Toys That Spy

Learn more about your ad-choices at https://www.iheartpodcastnetwork.com

See omnystudio.com/listener for privacy information.

Episode Transcript

Speaker 1 (00:03):
It's not usual for a child to talk to his
or her toys, but these days those toys are actually listening.
I'm Jonathan Strickland and this is text up Daily. A
lot has changed since I was a kid. Back then,
toys were mostly made of dumb plastic. They were inert,
only given life through the imaginations of those who played

(00:26):
with them, and thus my epic saga of what would
happen if he Man joined forces with Hans Solo to
fight off the evil Barbie invasion came to pass. Uh,
my sister owned the Barbie doll. But these days toys
can contain technologies that make them far more interactive. The
creative process is no longer a one way street, and

(00:46):
in at least some of those implementations, there's the potential
for a lot to go wrong. We're in the age
of connectivity, and that extends down to the toys companies
are making for kids. These toys use technologies like WiFi
and blue tooth to receive information from the Internet, enhancing
the toys features so that it can do more stuff
with those who play with it. For example, Hasbro markets

(01:09):
the Furby Connect interactive toy. Furbi's debut in the late
nineteen nineties. At that time they were considered pretty advanced. Initially,
a Furby can only speak in Gibberish. Canonically, it's a
language called Furbish. Over time, the Furbi begins to throw
in some English words among the nonsense. This was to
mimic the way children pick up language over time. The

(01:31):
toys give the appearance of interactivity, but the truth of
the matter was that Furbies were simply following a preprogrammed pathway.
I hope that didn't come as a shock to anyone.
The Furby Connect is a toy that can actually change
how it interacts with people over time. You pair the
toy with a companion mobile app. You can use the
app to interact with the toy or update it with

(01:51):
new behaviors, games, and other features. It's a clever way
to keep the toy relevant and fun to play with. Unfortunately,
that same connectivity gives toys like the Ferbie Connect It's
nifty features can also introduce security and privacy vulnerabilities. The
UK Consumers Association site, which published an article in November

(02:12):
saying that many of these connected toys, including the Ferbie Connect,
are vulnerable to malicious interference. According to the article, it
doesn't even require any hacking in some cases. A few
of these toys allow anyone to connect to a device
within Bluetooth range without any security measures to block them.
That means a person within range could potentially affect a toy.

(02:33):
Some of these toys allow you to send a message
to the toy, which then can be converted into a
verbal message from the toy itself. In a video published
on the WHICH article, a young boy is playing with
a robot with this Bluetooth connectivity. A lurking figure outside
the window notices this and uses a smartphone to connect
to the toy and sends a message to the young
boy asking him to open the front door. The site

(02:56):
acknowledges that for this to work in the way shown
in the video, the connection would need to be unsecured
and the potential threat would have to be quite close.
The broadcast range for Bluetooth is about ten meters. WiFi
connected toys might have a slightly greater range, depending upon
the router, though if the WiFi network isn't secured, then
there may be other issues to deal with beyond compromised toys.

(03:18):
Some consumer advocacy groups have voice. Similar concerns about other toys,
including those toys capacity to listen in on conversations. Some
of these toys are meant to allow children to talk
to them, ask questions, and hold basic conversations, but that
means the toys themselves need microphones and have to send
information to the cloud to get appropriate responses. That means

(03:38):
the toys are effectively listening, and if a toy is
listening in might pick up stuff it's not supposed to hear.
Depending upon how that information is processed in the cloud,
the data could end up causing harm further down the road.
In twenty hackers showed they could compromise the Hello Barbie
connected doll and use it to spy on people. At first,
it seemed like Mattel, a manufacturer of Barbie dolls, had

(04:01):
done a decent job with security. The Barbie doll would
only listen when you pressed a button that would activate
the microphone. Further, the doll would encrypt recorded audio, making
it unintelligible to anyone who might intercept the file as
it was sent from doll to Mattel's servers. But hackers
figured out how to compromise the doll itself. Over WiFi connections.
Presumably they had physical access to the doll and connected

(04:24):
it to their own WiFi network to make the changes.
Once they had done so, they could remove some of
those safety features so that they could listen in even
if the button were not pressed, and skip that whole
encryption process. The doll would effectively become a bug, kind
of like in spy movies. Also, spy movie Barbie would
be a pretty cool toy. According to the Guardian, compromising

(04:47):
the doll would be just the first step. Accessing information
on the doll itself would give hackers the information they
need to log into the target's WiFi network. In other words,
they could access the WiFi password and then intrude on
that network, pretend really snooping on communications or compromising other
connected systems within the home. The doll would become a
gateway to a person's entire network. In this case, it

(05:10):
requires a lot more work than just connecting to an
unsecured toy over Bluetooth. But the point the hackers were
making is that in the age of connectivity, this is
also an age of security vulnerabilities. We need to take
greater care in designing and implementing technologies that connect wirelessly
to networks, particularly when those technologies are intended for children.
To learn more about internet security, wireless technologies, and high

(05:33):
tech toys, check out the tech Stuff podcast we publish
on Wednesdays and Fridays and take a deep dive on
these subjects and more. I'll see you again soon.