Playing With Danger: A Taxonomy and Evaluation of Threats to Smart Toys

Abstract

Smart toys have captured an increasing share of the toy market, and are growing ubiquitous in households with children. Smart toys are a subset of Internet of Things (IoT) devices, containing sensors, actuators, and/or artificial intelligence capabilities. They frequently have internet connectivity, directly or indirectly through companion apps, and collect information about their users and environments. Recent studies have found security flaws in many smart toys that have led to serious privacy leaks, or allowed tracking a child's physical location. Some well-publicized discoveries of this nature have prompted actions from governments around the world to ban some of these toys. Compared to other IoT devices, smart toys pose unique risks because of their easily-vulnerable user base, and our work is intended to define these risks and assess a subset of toys against them. We provide a classification of threats specific to smart toys in order to unite and complement existing adhoc analyses, and help comprehensive evaluation of other smart toys. Our vulnerability taxonomy addresses the potential security and privacy flaws that can lead to leakage of private information or allow an adversary to control the toy to lure, harm, or distress a child. Using this taxonomy, we perform a thorough experimental analysis of eleven smart toys and their companion apps. Our systematic analysis has uncovered that several current toys still expose children to multiple threats for attackers with physical, nearby, or remote access to the toy.

IoT4Fun Rapid Prototyping Toolkit for Smart Toys

“…Data collection management is what distinguish smart toys from general-purpose toys [13]. The types of data that a smart toy can collect will depend on the interface features that it has (e.g., its physical affordances, embedded sensors, processing capacity, and communication channels).…”

“…Smart toys usually embed hardware components like sensors, actuators, and microprocessors that introduce limited computational capabilities, which can compromise full on-board processing. Thus, smart toys often connect with more powerful computing devices like smartphones, tablets, game consoles, or companion robot components to share those capabilities [13].…”

“…Besides, the RPT must support LPS and non-PID collection by combining both long and short-range wireless communication protocols (e.g., NFC/RFID, Bluetooth). Note that by limiting PD collection does not minimize the need for adequate privacy policies and data security approaches [13,14]. In that way, all communication between the interface components must comply with data security models and universal standards.…”

“…Finally, vulnerability analysis points out the main risks for data security and privacy of each project. Shasha et al [13] define a vulnerability taxonomy for smart toys that have connected mobile applications. They classify those threats into physical and remote access types.…”

“…physical integrity of the RPT modules after playtesting, and battery consumption of each design. We also carry a vulnerability analysis for data security and privacy threats [13], which include simulating attacks to access and configure the communication modules and mobile applications (when applicable). Then, we select security strategies to solve the identified vulnerabilities [14].…”