Christmas is right around the corner and
parents are looking for the perfect gift
for their children there's an endless
supply to choose from but high-tech toys
are all the rage they talk that's right
I'm talking to you Sid Phillips they
listen hello
Dreamhouse let's bake some
cookies yum let's bake some cookies they
are your companions get up and go go is
a sweet puppy that just loves to go for
walks and play with you like a real
puppy and some even have magical powers
mix your potion make your pet what's
inside but this holiday season you'll
want to take a second look with a doll
that might be storing kids secrets I'm
in charge now you might think I'm just a
sweet toy a wand that lives up to its
Sinister
name and a child-friendly tablet that's
made valuable information vulnerable it
appears not all these toys are safe for
play which toys should be on your do not
buy list this
Christmas this tablet can do it all and
as hackers have discovered even some
things it's not designed to do but when
an app on the tablet provides an in for
a massive hack the reputation the
company is built on might never recover
VTEC it's a company that's been
synonymous with childhood play for the
past 45 years sure the Hong Kong based
brand also makes cordless phones and
baby monitors but Tech Centric toys is
and always has been vtec's claim to fame
whether it's a lightup drum set a
color-changing flashlight or a
kid-friendly laptop the technology VTEC
adds to children's toys is a Twist that
makes playtime all the more magical for
many the company's interactive and
confidence-building gadgets are the
perfect way to introduce children to the
ever evolving world of technology but is
VTEC really setting children up for
their future or robbing them of one in
2013
VTEC introduced a new toy to their line
This is the InnoTab 3S from VTEC the
InnoTab 3S was an iPad alternative built
around a child's developmental needs
this is an age appropriate way for kids
3: to9 to have their own tablet just
like Mom and Dad and with safe web
browsing educational apps and a
competitive price of $99.99 the tablet
was just as likely to appeal to parents
as children the biggest difference
between the 3s and previous models was
the introduction of an app called Kid
Connect that allowed kids to communicate
through the tablet to parents and
friends nothing takes the place of the
time you and your child spend together
but there is a way to stay connected
with each other sharing feelings
intimacies and lter even when you are
away to use this feature parents had to
register their account by providing some
personal information on themselves and
their child with that parents could stay
updated on their children through text
and voice messages I love you Mom I love
you too but was Kid Connect really as
safe as people believed it lets kids
feel like grown-ups as they safely
browse the internet and text with
friends and family early reviews of the
inot Tab 3s were relatively positive
with a consensus that the tablet was no
doubt an upgrade from the previous model
in terms of controls and capabilities
there were some issues with performance
speed and functionality but children
seemed to enjoy the tablet and reviewers
were impressed by the apps especially
Kid Connect and there was another
demographic that was hyping up the
InnoTab hackers hackers were dedicated
to finding exploits in Vex tablets what
exactly is an exploit well in computer
security lingo an exploit is a virtual
attack that finds a weakness in a system
that allows the hacker to tamper with
the software and to some extent bend it
to their will and what exactly was the
will of these hackers well mainly to
play video games on the children's
tablet one hacker turned the inot tab
into a device that could run Linux apps
from there they were able to install
vintage games like doom and River raid
onto the device considering the tablet
was not exactly a Powerhouse these hacks
were more a test of skill than a
GameChanger alternative for those who
couldn't afford highend gaming tablets
still a community of Gamers was forged
around the inot tab forums like spiffy
hacks were full of threads where users
discussed various ways to hack the
tablet but one hacker was about to take
things to the next level slipstream was
surfing the web when he came across a
thread of people discussing ways to hack
the InnoTab one piece of information a
user mentioned stuck out to the security
researcher VTEC used one web surface to
manage all products with this knowledge
slipstream found one of the company's
websites that had a login section he
used SQL injection an old school hacking
technique and he was in with the same
level of ease slipstream obtained root a
word for Access with full authorization
or control of a server AKA total virtual
Freedom the hacker could now do whatever
he wanted with this new found power
slipstream snooped through the VTEC
servers until he hit a motherload of
information this is when the hacker said
he realized how serious the nature of
what he'd been able to uncover so easily
was he decided to go to a journalist
with the information rather than VTEC a
company he believed would never listen
and possibly even attempt to cover the
breach up the hacker reached out to
Lorenzo frenesi Bay a journalist who
writes for vice Tech division
motherboard slipstream told Lorenzo VTEC
was guilty of one major online crime a
security to prove this he shared with
the journalist a portion of data that
had been all too easy to steal all the
evidence suggested I wasn't the only
person outside of VC who could have got
the data he told Lorenzo but what
exactly had slipstream found on VTEC
servers that had the hacker running to
the media well remember that private
information VTEC users gave kidc connect
turned out it wasn't so private after
all the addresses passwords personal
chats audio recordings photos and other
identifying information of not only
millions of parents but hundreds of
thousands of kids was sitting in VC
database waiting for anyone with basic
hacking knowledge to gain access luckily
it seems slipstream had no Grand schemes
for the data he told motherboard that
publishing or selling the information
was never his intention profiting from
database dumps is not something I do
especially not if children are involved
I just want issues made aware of and
fixed he said but until the security was
fixed the way VTEC had attempted to hide
user information was worrying using
substandard cryptography to hide the
data was like using duct tape to seal a
vault more of an invitation to look ins
side than adequate protection according
to slipstream someone with darker
motives could just as easily have
accessed the same data he had the
information VCH was storing also seemed
to violate COA the children's online
privacy protection rule according to COA
any company collecting information on
children is responsible for making
parents aware of what information is
being collected and verifiable parental
consent with limited exceptions is also
needed before collecting personal
information online from children and
according to section 32.8 VTEC was
responsible for protecting the
confidentiality security and integrity
of personal information collected from
children by implementing and maintaining
reasonable security procedures in all
these areas it seemed VTEC had failed
their customers but this was far from
the first time a toy had done more harm
to little ones than good meet Vivid toy
group's doll of the future what's your
name my name's Kayla and yours is Abby
she understands you introduced in
November 2014 as a step towards new New
Frontiers in playtime my friend Kayla
was able to answer almost any question
making her the smartest friend children
would ever have what's this the Eiffel
Tower in France the singing talking and
always listening doll could tell stories
take part in games and share photos
she's not just a doll her makers at
Genesis toys insisted she's a real
friend but with this many capabilities
was Kayla a doll out of a Daydream or a
nightmare according to the discoveries
of security researcher Ken Monroe Kayla
was not as innocent as she appeared the
doll used her necklace listing device to
answer questions using Bluetooth
essentially this gave Kayla access to
any information available on the
internet but parents fear not security
features prevented Kayla from saying
anything inappropriate except of course
if she were hacked a Cyber attack Ken
Monroe claimed the doll was vulnerable
to according to Red sieges Tim Medan the
only thing that stood between a hacker
and the doll was that only one device
could be connected at a time this meant
the moment someone disconnected their
Bluetooth from Kayla an opportunistic
bad guy could strike and although Tim
found Kayla did a good job of censoring
bad words through the dolls speakers a
hacker could play any sound and use the
doll as a microphone anyone within range
can use this toy to listen to and
communicate with the kiddo hackers in
range could also use the doll to record
audio when Caleb recorded Tim noted that
her necklace lit up but who was going to
look at that he asked but hackers
weren't the only ones capable of e
dropping so were her manufacturers any
private conversations held between
between doll and child could be sent to
the toy makers there's all kinds of
intimate details of their personal life
their parents' personal lives we know
how kids at younger ages don't
necessarily have the same social filter
Claire gartland the director of the
Washington nonprofit consumer privacy
project told NPR breaking the sacred
Covenant between toy and child Kayla
could send recordings of private
conversations to Genesis as well as the
voice recognition company Nuance which
also had a database used by law
enforcement and Military and
intelligence agencies that matched voice
similar to VTEC parents were not being
sufficiently notified or consenting to
what Kayla was doing meaning the doll
also flew in the face of COA one country
decided to take matters into their own
hands in Germany where owning or selling
a baned surveillance device can lead to
jail time of up to 2 years a warning was
issued by the company's Federal Network
agency telling parents to destroy the
dolls it's likely Kayla's makers never
planned for the toy to cause this Mayhem
but some toy makers seem to set up with
the intention to disturb parents and
children in early November 2014 the
shelves of a Dayton Ohio Dollar Store
were filled with the typical discounted
knick-knacks but in the toy section
amidst the Barbies Tiaras and baby dolls
there was something new a pink princess
wand decorated with flower petals the
packaging promises fairies and quote
wonderful music the only hint of the
Toy's true nature was in the ominous
name evil stick not noticing the name
Nicole Allen picked up the toy for her
2-year-old daughter but when she peeled
back the foil on the wand the mother was
in for a shocking surprise the
children's toy contained a graphic image
of a woman self Haring as for that
wonderful music the package advertised
it appeared the W's manufacturers left
both wonderful and music up to
interpretation Nicole didn't see any
humor in the toy I'm outraged over it I
want to know how how they think that
that is suitable for a child but store
owner Amar Mustafa claimed the toy was
just living up to its name the name on
it it says evil stick Amar believed it
was up to the parents to inspect the toy
before giving it to their child and
although packaging said the toy was for
ages three and up Amar believed it was
best to wait a couple of years before
getting a child an evil stick of their
own for a five 6 7 10 years old I mean
they see that on TV every day but
customers were not pleased at the idea
of a child being exposed to The Graphic
content you don't want to think about
little girls picking that up and
thinking this is normal you know or
funny or interesting or any of those
things after hearing news coverage of
the evil stick local Dayton resident
Matt Clark decided to buy one for
himself it took a while for him to find
the version that had parents so
concerned in fact most of the images and
evil sticks weren't particularly
menacing there was one zombie type
character but most of them were straight
cutout pictures from manga or anime
pretty cartoony and not scary at all he
told Mental Floss eventually he found
the evil stick with the now Infamous
image he posted a short YouTube video
showing off his new priz
possession by the next morning Matt's
10-second upload titled behold the evil
stick had 100,000 views the comment
section became a forum for viewers and
Clark to voice their theories about the
toy Origins after all who could be
responsible for such a strange toy Clark
and viewers traced the image in the wand
back to horror photographer butcher
ludvig's 2002 macabra Muses series the
image depicted a vampire ready to Feast
on her own vital fluids for sustenance
the artist had not given permission for
toy manufacturers to use the image and
had definitely not given permission to
them to add red demonic eyes to the
photograph although the image's origins
had been a dead end a barcode on the
Toy's packaging traced to a factory in
China Clark contacted the factory and
bingo they said they had made the toy
his next step was to talk to someone who
played a part in creating the toy Clark
posted that he was on the verge of
finding the truth but then he went
silent the YouTuber had virtually
disappeared among his viewers a
conspiracy grew that Clark had fallen
victim to the evil stick's curse what
really happened was far less mystifying
Clark simply didn't have an update the
factory had stopped responding leaving
the mystery around the toy unanswered he
admitted to Mental Floss that the wild
speculation surrounding his departure
may have also fueled his decision to
remain silent I found that hilarious and
it kind of made me not want to do
anything more Clark told the publication
he said he has since sold the evil stick
to a buyer in Canada obviously she's
been cursed too he said but the fears
the VTEC breach would soon unlock went
beyond any conspiracies after
motherboard received the data from
slipstream they Enlisted the expertise
of Troy hunt to review the data
slipstream had sent them being the
founder of have I been pwned a website
that allows users to enter their email
addresses or phone number to see if
their information was part of a data
breach Troy hunt was just the security
expert the publication needed with the
data provided Troy was able to link over
4 million emails with their passwords
security questions were also available
meaning passwords could be reset for
emails or even an online banking account
but it was the way the data could be
connected to children that really worry
Troy as the security expert explained on
his blog But it includes their parents
as well along with their home address
and you can link the two and
emphatically say here's 9-year-old Mary
I know where she lives and I have other
personally identifiable information
about her parents including their
password and security question I start
to run out of superlatives to even
describe how bad that is have I been
pwned dub the VTech hack as the fourth
largest consumer data breach to date
when motherboard and Troy contacted
customers to make them aware of the
breach there were questions over why the
company needed to store the information
in the first place why do you need to
know all this information just so I can
download a couple of free books for my
kid on this silly pad thing why did they
have all this information if you can
trust a company like that then who can
you trust with your information it's
kind of scary a father told the
publication another parent was also
shocked that her data was breached on a
supposedly child-friendly website
motherboard alerted VTEC to the breach
on November 24th 2015 a situation the
company admitted they had been unaware
of until receiving the message 10 days
after the hack happened the company
released the statement on November 27th
they acknowledged the information that
had been exposed but emphasized that
credit card information and personal
identification numbers had not been part
of the breach upon discovering the
breach we immediately made modifications
to the security settings on the site to
defend against any further attacks in
the future the company promised to
strengthen their learning Lodge database
security as a way to ensure against any
such incidents in the future Troy hunt
was not impressed with VC's pledge to
increase security taking security
seriously is something you need to do
before a data breach not something you
say afterwards to Plate people he wrote
on his blog following the publication of
the motherboard article VC updated their
customers on the Cyber attack the breach
hadn't been as bad as motherboard
reported it had been worse over 4
million parent accounts had been
breached and despite earlier reporting
that fewer kids profiles had been
involved VTEC revealed over 6 million
had been compromised this The Washington
Post reported made the breach one of the
largest targeting children ever cenet
senior editor Dan aurman told CBS News
this was what happened when toy
companies ventured into sophisticated
technology they're not digital native
companies so they may not have the
security expertise needed to secure
their databases and this was a fairly
simple hack Dan told the publication and
although slipstream claimed to have
Noble intentions for his hacking of the
company telling motherboard it made him
sick that he was able to get all this
stuff and that VC should have the book
thrown at them Security Experts weren't
convinced that data that could be worth
millions would go unused I wouldn't try
trust him Troy hunt told CNBC I don't
believe the word of anyone who
compromises a network said cyber
security officer Justin Harvey whatever
his motivations had been slipstream was
about to face repercussions in December
2015 the hacker was arrested in birkar
England his electronics were seized and
he was arrested for computer hacking
offenses that violated sections 1 and
two of the UK's computer misuse act 1990
which included unauthorized access to
computer material and unauthorized
access with intent to commit or
facilitate Commission of further
offenses by 2019 the then 24-year-old's
identity was revealed as zon's Clark the
security researcher pleaded guilty to
hacking two major networks Microsoft and
Nintendo in the end Clark was sentenced
to 15 months but due to his autism that
could put him at risk of prison violence
the sentence was suspended for 18 months
meaning he wouldn't go to prison unless
he reoffended but what about the offense
he was initially arrested over hacking
VTEC although slipstream took
responsibility for the breach the
company didn't end up Prosecuting him
after all VC had already dealt with
their own legal consequences the Federal
Trade Commission found the company had
broken us laws governing the way data
about children is gathered and failed to
take reasonable steps to secure that
data the company was finded
$650,000 for their failure to protect
the privacy of the children using its
gadgets after their public shaming it
seemed that VTEC was a changed company
they pledged their commitment to Copa
laws and increase security to prove this
to their customers they also promised to
go through regular independent data and
privacy audits for the next 20 years all
of this made it sound like the company
was determined to do better but were
VC's promises real or just for
appearances according to VTEC parents
should take responsibility for future
breaches a VCH spokesperson claimed that
although the company was working to
improve their security no company that
operated online could provide a 100%
guarantee that it wouldn't be hacked
Troy hunt was disappointed by the
company's decision people don't even
read these things he wrote in a blog
post if VTEC felt it was too much effort
to protect their users data Troy advised
the company to at least put that on the
box and allow consumers to consciously
take their chances rather than
implicitly opting into the zero
accountability Clause what was most
dangerous about the information VTEC was
storing still might not be immediately
apparent to most names genders birthdays
sure it's personal information but it's
not necessarily a secret in fact we
often share these pieces of information
willingly in Daily conversations signup
sheets and online profiles but when
these identifiers were connected and
added to the further information from
the breach full profiles of parents and
more importantly children could be
created this information could then be
posted or sold in underground markets
with information on children being the
most valuable Tom Kellerman the Trend
Micro Inc Chief cyber security officer
explain to Reuters why children are more
appealing targets kids have a longer
life in front of them and they have
completely clean credit which makes them
more valuable he said and when a child's
identity is stolen so is their future in
fact research from a 20 11 study at
Carnegie melon University found the
stolen Social Security numbers of
children have a 10% likelihood of being
attached to fraudulent activity this
number might not seem huge but it's 51
times higher than adults failed
background checks credit debt and even
arrests can follow a child into
adulthood in some cases stolen
information can also result in a virtual
kidnapping the director of research at
pin drop security David dwey explained
the concept to CTV News in that kind of
situation a person would call A parent
and use the information they had about
their child to convince them that they
had kidnapped the child and demand a
ransom and when voice recordings are
also stolen these calls can be all the
more convincing children don't have a
choice over how secure their data is
companies like VTEC do and tech-based
play is only becoming more popular toys
that require user data are predicted by
Juniper research to grow 58% annually as
children's toy companies continue to
venture into advanced technology
inexperience is the shareed trait that
might put the security of children
Children at Risk but in a world where
smart toys use their capabilities to spy
and a princess wand can leave people
traumatized how can parents possibly
keep their children safe research should
be a parents first step for smart toys
this unfortunately involves actually
reading those pesky user manuals and
terms and conditions to understand the
information the device collects checking
that the toy is coopa approved is also a
good rule of thumb sites like
safekids.org help parents keep their
fingers on the pulse by compiling
monthly lists of child related recalls
but knockoff and counterfeit toys pose
their own risks these toys often Dodge
the testing reputable Brands go through
to meet safety standards causing a dip
in quality that isn't only aesthetic but
possibly toxic if you're unsure if what
a site is selling is a counterfeit toy
look at the customer feedback and photos
for red flags misspellings are another
tip off that a toy isn't from the
reputable brand it's attempting to
emulate our lives are intertwined with
our data and as technology expands this
connection will intensify even for
children this is an age appropriate way
for kids 300 to 9 to have their own
tablet just like Mom and Dad now the
question becomes will companies be held
accountable for the mistakes they make
while technologizing play or will it
become a parents responsibility to vet
their child's toys