Internet-connected Children’s Toys: 5 Safety Tips

By Michael Hall, DriveSavers Chief Information Security Officer

Now that the holidays are over and every present has been opened and tested, you may want to take a closer look at any new devices in your household.

Run an online search for “internet-connected children’s toys” and you’ll find pages and pages of “smart” tech toys to purchase, from “learning tablets” designed for young children to funny little animals that transmit voicemail messages. There are even smart toys, such as Mattel’s Hello Barbie doll and Nuance’s My Friend Cayla doll, that record a child’s voice and translate it into data that can be used in later play via keyword search, all stored online.

How secure are all of these cloud-storage databases? What might these toys be exposing about you or your children?

Always Listening, Always Recording

Recently, researchers with a consumer watchdog company called Which? identified security issues with a handful of connected children’s toys, including Furby Connect, the i-Que robot, Cloudpets and Toy-fi Teddy. Which? found that these toys did not employ basic authentication security protocols when connecting to other devices, such as smartphones, via Bluetooth. This meant that any device within physical range of these children’s toys could easily link to them and take control. Once the link was established, children’s conversations could be overheard, recorded or participated in.

It is also important to recognize that smart toys such as Hello Barbie, My Friend Cayla and Cloudpets, regardless of initial security measures, record and store data online that may include children’s voices, personal account information and even GPS locations. This cloud-stored data is potentially susceptible to security breach.

Just this past year, toy manufacturer VTech agreed to pay $650,000 in a settlement with the FCC over a data breach in 2015 that exposed the personal data of 6.4 million children under the age of 13. This hack shines a spotlight on the importance of incorporating additional protections for personal data belonging to the most vulnerable technology users.

Video Games

The video games that children play with other children through connected gaming systems range from highly educational to unrestrained gore and everything in between. Even when a child is playing an innocent game of Minecraft with other players, there are concerns that need to be acknowledged.

The chat features in PlayStation Network and Xbox Live are full of stranger danger. When playing video games using one of these networks, your children can talk directly to other players or even enter virtual rooms for private conversations.

These games are virtual playgrounds for children to enjoy. Like real life playgrounds, however, it is important to be aware of what your children are doing there and who they are interacting with. More and more child predators are searching for and preparing potential victims online, a practice known as grooming.

What You Can Do

Technology is an everyday part of life today and is necessary for both school and career. Many of these connected devices and games are educational and benefit the children who use them. It’s essential for their safety, however, that parents take the time to learn about each toy or device and incorporate security precautions.

Here are five ways to keep your children safer when using their gadgets.

1. Understand Your Children’s Devices

Always take time to research a device before putting it in a child’s hands. You should know the answers to these questions:

• Does your child’s new toy or tablet have a camera or microphone?
• Can it transmit or receive pictures or audio?
• Does it have a phone book or contact list?
• Are recordings and other data stored in the cloud?
• Can it download apps? What do the apps have access to (photos, contacts, etc.)?
• Can features be purchased “in-app”?
• Can your child communicate with other people through their new device?
• Does the device post to the web?
• Does the device have a dashboard? If so, is the dashboard part of the installed software or is it online?
• What kind of information can be shared with other people online?

2. Keep Up with Device Updates

Updates often include new security protocols and patches for security loopholes. Stay on top of these.

3. Don’t be Complacent with Security

Many devices come with default login credentials and other security methods. It is not a good idea to rely on these default settings, especially when considering your child’s safety. Don’t just pull the smart toy out of the box and start using it. Here are some additional measures to take:

• Make sure your home Wifi is password protected so that outsiders cannot easily access it.
• Change all default logins: home Wifi router, Bluetooth access, device login and any other access points.
• Traffic to your child’s Wifi-connected devices can be restricted through your Wifi router. Consult the company responsible for your router for instructions and deny access to your child’s smart toy from any cell phones or other devices that are not known to you.
• If security measures cannot be configured for the toy, consider replacing it with a different device that may be more appropriate. If the toy has not already been purchased, do your research before buying it.

4. Parental Controls

Enable parental settings so your children can only add “friends” in their network when you enter a parent password. Don’t give your children that password.

5. Outline Appropriate Online Behavior

Sit your children down and give them a thorough education as to what is okay to share with people they meet online.

• Make sure they know never to share their real name, age, address, phone number or any information that could help a stranger identify their physical location.
• Tell them to never ever share pictures of themselves online.
• Make sure they know to tell you right away if anything seems weird about any of their interactions.

Prepare Your Children Well and Watch Them Grow

Connected toys and gadgets open your child’s world in ways we couldn’t dream of when we were their age. Just make sure you’re taking responsible measures to keep them safe at the same time.