Disturbing Children Toys Are Going Too Far: "This is wrong on so many levels"
Christmas is right around the corner and parents are looking for the perfect gift for their children. There’s an endless supply to choose from, but high tech toys are all the rage. They talk . . . They listen . . . (Girl) Hello Dreamhouse! Let’s bake some cookies! (Dreamhouse) Yum, let’s bake some cookies! They are your companions . . . Get Up & GoGo is a sweet puppy that just loves to go for walks and play with you like a real puppy! And some even have magical powers! Mix your potion, make your pet! What’s inside? Woah! Aww, cute! But this holiday season, you’ll want to take a second look . . .
With a doll that might be storing kids’ secrets . . . (Doll) I’m in charge now. You might think I’m just a sweet toy. A wand that lives up to its sinister name . . .
*evil laughing* And a “child friendly” tablet that’s made valuable information vulnerable . . . It appears not all these toys are safe for play. Which toys should be on your “do not buy” list this Christmas? This tablet can do it all . . . And as hackers have discovered, even some things it's not designed to do. But when an app on the tablet provides an in for a massive hack . . . The reputation the company is built on might never recover.
VTech—it’s a company that’s been synonymous with childhood play for the past 45 years. Sure, the Hong Kong based brand also makes cordless phones and baby monitors, but tech centric toys is and always has been, VTech claim to fame. Whether it's a light up drum set, a color changing flashlight or a kid friendly laptop, the technology VTech adds to children's toys is a twist that makes playtime all the more magical.
For many, the company's interactive and confidence building gadgets are the perfect way to introduce children to the ever evolving world of technology. But is VTech really setting children up for their future or robbing them of one? In 2013, VTech introduced a new toy to their line. This is the InnoTab 3S from VTech. The Innotab 3S was an iPad alternative built around a child's developmental needs.
This is an age-appropriate way for kids three to nine to have their own tablet just like mom and dad. And with safe web browsing, educational apps and a competitive price of $99.99, the tablet was just as likely to appeal to parents as children.
The biggest difference between the 3S and previous models was the introduction of an app called Kid Connect that allowed kids to communicate through the tablet to parents and friends. Nothing takes the place of the time you and your child spend together, but there is a way to stay connected with each other, sharing feelings, Intimacies and laughter, even when you are away. To use this feature, parents had to register their account by providing some personal information on themselves and their child.
With that, parents could stay updated on their children through text and voice messages. I love you, Mom. I love you too. But was quick connect really as safe as people believed? It lets kids feel like grownups as they safely browse the internet and text with friends and family.
Early reviews of the Innotab 3S were relatively positive for the consensus that the tablet was no doubt an upgrade from the previous model in terms of controls and capabilities. There were some issues with performance speed and functionality, but children seem to enjoy the tablet and reviewers were impressed by the apps, especially Kid Connect. And there was another demographic that was hyping up the Innotab Hackers.
Hackers were dedicated to finding exploits in VTech’s tablets. What exactly is an exploit? Well, in computer security lingo And what exactly was the will of these hackers? Well, mainly to play video games on the children's tablet. One hacker turned the Innotab into a device that could run Linux apps. From there, they were able to install vintage games like Doom and River Raid onto the device. Considering the tablet was “not exactly a powerhouse,” these hacks were more a test of skill than a game changer alternative for those who couldn't afford high end gaming tablets.
Still, a community of gamers was forged around the Innotab. Forums like Spiffy Hacks were full of threads where users discussed various ways to hack the tablet. But one hacker was about to take things to the next level. Slipstream was surfing the web when he came across a thread of people discussing ways to hack the Innotab. One piece of information a user mentioned stuck out to the security researcher. VTech used one web service to manage all products.
With this knowledge, Slipstream found one of the company's websites that had a login section. He used SQL injection, an old school hacking technique, and he was in. With the same level of ease, Slipstream obtained “root,” a word for access with full authorization or control of a server.
AKA total virtual freedom. The hacker could now do whatever he wanted. With this newfound power, Slipstream snooped through the VTech servers until he hit a motherlode of information. This is when the hacker said he “realized how serious” the nature of what he'd been able to uncover so easily was. He decided to go to a journalist with the information rather than VTech, a company he believed would never listen and possibly even attempt to cover the breach up. The hacker reached out to Lorenzo Franceschi-Bicchierai, a journalist who writes for Vice's tech division Motherboard.
Slipstream told Lorenzo VTech was guilty of one major online crime— ”sh—ty security.” To prove this, he shared with the journalist a portion of data that had been all too easy to steal. he told Lorenzo.
But what exactly had Slipstream found on VTech servers that had the hacker running to the media? Well, remember that private information VTech users gave Kid Connect? Turned out it wasn't so private after all. The addresses, passwords, personal chats, audio recordings, photos, and other identifying information of not only millions of parents, but hundreds of thousands of kids was sitting in VTech’s database, waiting for anyone with basic hacking knowledge to gain access. Luckily, it seemed Slipstream had no grand schemes for the data. He told Motherboard that publishing or selling the information “was never his intention.” But until the security was fixed, the way VTech had attempted to hide user information was worrying. Using substandard cryptography to hide the data was like using duct tape to seal a vault, more of an invitation to look inside than adequate protection.
According to Slipstream, someone with darker motives could just as easily have access. The same data, he had. The information VTech was storing also seemed to violate COPPA, the Children's Online Privacy Protection Rule.
According to COPPA, any company collecting information on children is responsible for making parents aware of what information is being collected. And verifiable parental consent, with limited exceptions, is also needed before collecting personal information online from children. And according to Section 312.8, VTech was responsible for protecting the confidentiality, security and integrity of personal information collected from children by implementing and maintaining reasonable security procedures. In all these areas, it seemed VTech had failed their customers, but this was far from the first time a toy had done more harm to little ones than good.
Meet Vivid Toy Group's doll of the future. (Girl) What’s your name? (Cayla) My name’s Cayla and yours is Abby. (Girl 2) She understands you? Introduced in November 2014, as a step towards new frontiers in playtime. My Friend Cayla was able to answer almost any question, making her “the smartest friend children would ever have.” (Girl) What's this? (Cayla) The Eiffel Tower in France. The singing, talking and always listening.
Doll could tell stories, take part in games and share photos. “She's not just a doll,” Her makers at Genesis Toys insisted, “she's a real friend!” But with this many capabilities, was Cayla a doll out of a daydream or a nightmare? According to the discoveries of security researcher Ken Munro, Cayla was not as innocent as she appeared. The doll used her necklace “listening device” to answer questions using Bluetooth. Essentially this gave Cayla access to any information available on the Internet, but parents fear not, security features prevented Cayla from saying anything inappropriate. Except, of course, if she were hacked.
A cyber attack Ken Munro claimed the doll was vulnerable to. According to Red Siege’s Tim Medin, the only thing that stood between a hacker and the doll was “that only one device [could] be connected at a time.” This meant the moment someone disconnected their Bluetooth from Cayla, an “opportunistic bad guy” could strike. And although Tim found Cayla did a “good job of censoring bad words,” through the doll speakers, a hacker could “play ANY sound” and use the doll as a microphone. “Anyone within range can use this toy to listen to and communicate with the kiddo.”
Hackers in range could also use the doll to record audio. When Cayla recorded, Tim noted that “her necklace lit up, but who was going to look at that?” he asked. But hackers weren't the only ones capable of eavesdrop.
So were her manufacturers. Any private conversations held between Doll and child could “be sent to the toy makers.” Claire Gartland, the director of the Washington nonprofit Consumer Privacy Project, told NPR, breaking the Sacred Covenant between Toy and Child, Cayla could send recordings of private conversations to Genesis, as well as the voice recognition company Nuance, which “also [had] a database used by law enforcement and military and intelligence agencies that [matched] voice prints.” Similar to VTech, “parents were not being sufficiently notified” or consenting to what Cayla was doing, meaning the doll also flew in the face of COPPA. One country decided to take matters into their own hands. In Germany, where owning or selling a banned surveillance device can lead to jail time of up to two years, a warning was issued by the company's federal network agency telling parents to destroy the dolls.
It's likely Cayla's makers never planned for the toy to cause this mayhem. But some toymakers seem to set out with the intention to disturb parents and children. In early November 2014, The shelves of a Dayton, Ohio dollar store were filled with the typical discounted knickknacks. But in the toy section, amidst the Barbies, Tiaras and Barbie dolls, there was something new. A pink princess wand decorated with flower petals . . .
The packaging promises fairies and, “wonderful music.” The only hint of the toy’s true nature was in the ominous name Evilstick. Not noticing the name Nicole Allen picked up the toy for her two-year-old daughter. But when she peel back the foil on the wand, the mother was in for a shocking surprise. The children's toy contained a graphic image of a woman self-harming.
As for that “wonderful music” the package advertised. It appeared the wants manufacturer left both “wonderful” and “music” up to interpretation. *evil laughter* Nicole didn't see any humor in the toy.
I'm outraged over it. I want to know how they think that that is suitable for a child. But store owner Amar Moustafa claimed the toy was just living up to its name. The name on it, it says: Evilstick. Amar believed it was up to the parents to inspect the toy before giving it to their child.
And although packaging said the toy was for ages three and up, Amar believed it was best to wait a couple of years before getting a child an Evilstick of their own. For a five, six, seven, ten years old. I mean, they see that on TV every day. But customers were not pleased at the idea of a child being exposed to the graphic content. They don't want to think about little girls picking that up and thinking this is normal, you know, or funny or interesting.
Or any of those things. After hearing news coverage of the Evilstick, local Dayton resident Matt Clark decided to buy one for himself. It took a while for him to find the version that had parents so concerned.
In fact, most of the images in Evilsticks weren't particularly menacing. he told Mental Floss. Eventually, he found the evil stick with the now infamous image. He posted a short YouTube video showing off his new prized possession. *evil laughing* By the next morning, Matt’s 10-second upload titled: “BEHOLD THE EVILSTICK”, had 100,000 views.
The comment section became a forum for viewers and Clark to voice their “theories about the toys origins.” After all, who could be responsible for such a strange toy? Clark and viewers traced the image in the wand back to horror photographer Butcher Ludwig’s 2002 “Macabre Muses” series. The image “depicted a vampire ready to feast on her own [vital fluids] for sustenance.” The artist had not given permission for toy manufacturers to use the image and had definitely not given permission to them to add red “demonic eyes” to the photograph. Although the images origins had been a dead end, a barcode on the toys packaging traced to a factory in China.
Clark contacted the factory and bingo. They said they had made the toy. His next step was to talk to someone who played a part in creating the toy. Clark posted that he was on the verge of finding the truth . . . But then, he went silent. The YouTuber had virtually disappeared.
Among his viewers, a conspiracy grew that Clark had fallen victim to the Evilstick’s curse. What really happened was far less mystifying. Clark simply didn’t have an update. The factory had stopped responding, leaving the mystery around the toy unanswered. He admitted to Mental Floss that the wild speculation surrounding his departure may have also fueled his decision to remain silent.
Clark told the publication. He said he has since sold the Evilstick to “a buyer in Canada.” “Obviously, she’s been cursed too,” he said. But the fears the VTech breach would soon unlock went beyond any conspiracies. After Motherboard received the data from Slipstream, they enlisted the expertize of Troy Hunt to review the data Slipstream had sent them.
Being the founder of Have I Been Pwned, a website that allows users to enter their email addresses or phone number to see if their information was part of a data breach, Troy Hunt was just a security expert the publication needed. With the data provided, Troy was able to link over 4 million emails with their passwords. Security questions were also available, meaning passwords could be reset for emails “or even an online banking account.” But it was the way the data could be connected to children that really worried Troy, as the security expert, explained on his blog. Have I Been Pwned dubbed the VTech hack as the “fourth largest consumer data breach to date.” When Motherboard and Troy contacted the customers to make them aware of the breach, there were questions over why the company needed to store the information in the first place.
a father told the publication. Another parent was also “shocked” that her data was breached on a supposedly “child friendly website.” Motherboard alerted VTech to the breach on November 24th, 2015, a situation the company admitted they had been unaware of until receiving the message ten days after the hack happened. The company released a statement on November 27. They acknowledged the information that had been exposed, but emphasized that credit card information and personal identification numbers had not been part of the breach.
In the future, the company promised to “strengthen [their] Learning Lodge database security” as a way “to ensure against any such incidents in the future.” Troy Hunt was not impressed with VTech pledge to increase security. he wrote on his blog.
Following the publication of the Motherboard article. VTech updated their customers on the cyber attack. The breach hadn't been as bad as Motherboard reported . . . It had been worse. Over 4 million parent accounts had been breached. And despite earlier reporting that you were kids, profiles had been involved.
VTech revealed over 6 million had been compromised. This, The Washington Post reported, made the breach “one of the largest targeting children” ever. CNET senior editor, Dan Ackerman, told CBS News this was what happened when toy companies ventured into “sophisticated technology.” “They’re not digital native companies so they may not have the security expertise needed to secure their databases. And this was a fairly simple hack,” Dan told the publication.
And although Slipstream claimed to have noble intentions for his hacking of the company, telling Motherboard it “[made him] sick that he was able to get all this stuff,” and that “VTech should have the book thrown at them.” Security experts weren't convinced that data that could be worth millions would go unused. “I wouldn't trust him,” Troy Hunt told CNBC. “I don't believe the word of anyone who compromises a network,” said cybersecurity officer Justin Harvey. Whatever his motivations had been. Slipstream was about to face repercussions.
In December 2015, the hacker was arrested in Berkshire, England. His electronics were seized and he was arrested for “computer hacking offenses” that violated sections 1 and 2 of the UK's Computer Misuse Act 1990, which included: By 2019, the then 24 year old's identity was revealed as Zammins Clark. The security researcher pleaded guilty to hacking two major networks, Microsoft and Nintendo.
In the end, Clark was sentenced to 15 months. But due to his autism, that could put him at risk of prison violence. The sentence was suspended for 18 months, meaning he wouldn't go to prison unless he re-offended. But what about the offense? He was initially arrested over? Hacking VTech.
Although Slipstream took responsibility for the breach, the company didn't end up prosecuting him. After all, VTech had already dealt with their own legal consequences. The Federal Trade Commission found the company “had broken U.S. laws governing the way data about children is gathered” and “failed to take reasonable steps to secure that data.” The company was fined $650,000 for their failure “to protect the privacy of the children using its gadgets.”
After their public shaming, it seemed that VTech was a changed company. They pledged their commitment to COPPA laws and increased security. To prove this to their customers. They also promised to go through “regular independent data and privacy audits for the next 20 years.” All of this made it sound like the company was determined to do better.
But were the text promises real or just for appearances? According to VTech, parents should take “responsibility for future breaches.” A VTech spokesperson claimed that although the company was working to improve their security, “no company that [operated] online [could] provide a 100% guarantee that it [wouldn't] be hacked.” Troy Hunt was disappointed by the company's decision. “People don't even read these things,” he wrote in the blog post. VTech felt it was too much effort to protect their users data. Troy advised the company to at least “put that on the box and allow consumers to consciously take their chances rather than implicitly opting into the ‘zero accountability’ clause.”
What was most dangerous about the information VTech was storing still might not be immediately apparent to most. Names . . . genders . . . birthdays Sure, it's personal information, but it's not necessarily a secret. In fact, we often share these pieces of information willingly in daily conversations, sign up sheets and online profiles. But when these identifiers were connected and added to the further information from the breach.
Full profiles of parents and more importantly, children could be created. This information could then be posted or sold in underground markets, with information on children being the most valuable. Tom Kellerman, the Trend Micro Inc’s chief cybersecurity officer, explained to Reuters why children are more appealing targets.
And when a child's identity is stolen, so is their future. In fact, research from a 2011 study at Carnegie Mellon University found the stolen Social Security numbers of children have a 10 percent likelihood of being attached to fraudulent activity. This number might not seem huge, but it's 51 times higher than adults. Failed background checks, credit debt, and even arrest can follow a child into adulthood.
In some cases, stolen information can also result in a virtual kidnaping. The director of research at Pindrop Security, David Dewey, explained the concept to CTV News. And when voice recordings are also stolen, these calls can be all the more convincing. Children don't have a choice over how secure their data is.
Companies like VTech do and tech based play is only becoming more popular. Toys that require user data are predicted by Juniper Research to grow “58 percent annually” As children's toy companies continue to venture into advanced technology, inexperience is the shared trait that might put the security of children at risk. But in a world where smart toys use their capabilities to spy and a princess wand can leave people traumatized, how can parents possibly keep their children safe? Research should be a parents first step. For smart toys, this unfortunately involves actually reading those pesky user manuals and terms and conditions to understand the information the device collects. Checking that the toy is COPPA approved is also a good rule of thumb. Sites like www.safekids.org
help parents keep their fingers on the pulse by compiling monthly list of child related recalls. But knockoff and counterfeit toys pose their own risk. These toys often dodge the testing reputable brands go through to meet safety standards, causing a dip in quality that isn't only aesthetic but possibly toxic. If you're unsure if what a site is selling is a counterfeit toy, look at the customer feedback and photos for red flags. Misspellings are another tip off that a toy isn't from the reputable brand it's attempting to emulate. Our lives are intertwined with our data . . .
And as technology expands, this connection will intensify, even for children. This is an age-appropriate way for kids three to nine to have their own tablet just like mom and dad. Now the question becomes, will companies be held accountable for the mistakes they make while technologizing play? Or will it become a parent’s responsibility to vet their child’s toys?
2022-12-28 06:29
