{"id":47443,"date":"2016-02-08T09:10:26","date_gmt":"2016-02-08T17:10:26","guid":{"rendered":"https:\/\/blogs.mcafee.com\/?p=47443"},"modified":"2025-08-15T07:42:57","modified_gmt":"2025-08-15T14:42:57","slug":"fisher-price-toy-vulnerability","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/internet-security\/fisher-price-toy-vulnerability\/","title":{"rendered":"Another Day, Another Smart Toy Hack: This Time, It\u2019s Fisher-Price"},"content":{"rendered":"

Toys offer a unique insight into a time, place and culture that has come and gone. While the Romans had small wooden horses and the Victorians had porcelain dolls, today\u2019s children are exposed to a danger unique to their generation: Internet-connected toys that enable cybercrime<\/a>.<\/p>\n

Exhibit A: the Fisher-Price Smart Toy Bear<\/a>. On the surface, this teddy bear is remarkable for its ability to remember a child\u2019s name, birthday, gender and more. So, why would it need to remember these things? According to the company, the bear incorporates this information into learning activities parents download from the Internet. While customizing a learning tool is a great idea, it also means the bear is building a profile of its owner and the owner\u2019s child. This can be problematic.<\/p>\n

Frequent readers can probably guess what happens next: cybercriminals, looking for an easy score, targeted the toy\u2019s website in an effort to steal personal information and sell it on the black market.<\/p>\n

Thankfully, their plan fell through. A group of security researchers discovered several security flaws<\/a> in how the smart bear communicated with Fisher-Price\u2019s platform. According to this group, the toys weren\u2019t \u201cappropriately verifying the \u2018sender\u2019 of messages.\u201d This, theoretically, would allow cybercriminals to retrieve customer profiles and children\u2019s details, monitor how often a child interacts with the toy and how often a parent uses the toy\u2019s associated mobile app.<\/p>\n

It turns out that cybercriminals can do quite a bit with this information. This sort of data could be useful in launching spear phishing<\/a> attacks, where a victim is tricked into providing sensitive information to hackers posing as a trusted entity. Other uses for this sort of data range from cracking passwords (never use a relative\u2019s name for a password), to harassing a child or parent through a connected application, to identity theft.<\/p>\n

Luckily, the ideal scenario played out: cybersecurity professionals discovered a product\u2019s vulnerabilities, notified the affected company, detailed how the vulnerabilities worked, and the issue was fixed. Both Fisher-Price and the security researchers should be applauded for such a quick, smooth cybersecurity operation.<\/p>\n

Unfortunately, we\u2019re likely going to see more of these sorts of security vulnerabilities in the future. In early December for instance, VTech, a manufacturer specializing in Internet-connected toys, suffered a massive breach. You can expect more of these sorts of stories as the Internet of Things continues to mature.<\/p>\n

Tips to Keep in Mind<\/h2>\n

So, what can you do right now to protect yourself, and your loved ones? Here are a few tips to keep in mind:<\/p>\n