Security and Privacy Analyses of Internet of Things Children's Toys
This addresses critical safety and privacy risks for children using IoT toys, though it is incremental as it builds on existing IoT security research.
The paper analyzed security and privacy in three commercial Internet-connected children's toys, uncovering undisclosed vulnerabilities that violate COPPA and privacy policies, indicating a disconnect from best practices.
This paper investigates the security and privacy of Internet-connected children's smart toys through case studies of three commercially-available products. We conduct network and application vulnerability analyses of each toy using static and dynamic analysis techniques, including application binary decompilation and network monitoring. We discover several publicly undisclosed vulnerabilities that violate the Children's Online Privacy Protection Rule (COPPA) as well as the toys' individual privacy policies. These vulnerabilities, especially security flaws in network communications with first-party servers, are indicative of a disconnect between many IoT toy developers and security and privacy best practices despite increased attention to Internet-connected toy hacking risks.