Security and Privacy Analyses of Internet of Things Children's Toys
arXiv:1805.02751 · doi:10.1109/JIOT.2018.2866423
Abstract
This paper investigates the security and privacy of Internet-connected children's smart toys through case studies of three commercially-available products. We conduct network and application vulnerability analyses of each toy using static and dynamic analysis techniques, including application binary decompilation and network monitoring. We discover several publicly undisclosed vulnerabilities that violate the Children's Online Privacy Protection Rule (COPPA) as well as the toys' individual privacy policies. These vulnerabilities, especially security flaws in network communications with first-party servers, are indicative of a disconnect between many IoT toy developers and security and privacy best practices despite increased attention to Internet-connected toy hacking risks.
arXiv comment8 pages, 8 figures; publication version
Cited by in corpus (8)
- IoT Inspector: Crowdsourcing Labeled Network Traffic from Smart Home Devices at Scale
- SkillBot: Identifying Risky Content for Children in Alexa Skills
- Towards Usable Parental Control for Voice Assistants
- DiffAudit: Auditing Privacy Practices of Online Services for Children and Adolescents
- Augmented Reality's Potential for Identifying and Mitigating Home Privacy Leaks
- Evaluating the Contextual Integrity of Privacy Regulation: Parents' IoT Toy Privacy Norms Versus COPPA
- Privacy-Aware Internet of Things Notices in Shared Spaces: A Survey
- Automating Internet of Things Network Traffic Collection with Robotic Arm Interactions