Poster Abstract: Who's Watching Your Child? Exploring Home Security Risks with Smart Toy Bears

The Internet of Things (IoT) can affect the physical safety of a child in addition to their digital safety. Digital safety concerns include what is being recorded and who is monitoring them. IoT devices, like the Fisher Price Smart Toys are designed to play with children of ages 3-8 and entertain them with various activities. This has expanded digital exposure into children's spaces. These toys contain a variety of communication technologies that users are ill-prepared to understand, a myriad of sensors collecting private data, including video, and often rely on inadequate security tools and methodology. This intersection of poor security, invasive sensor data, and proximity to children may put children at risks both online and in-person. In examining the Fisher Price Bear, our researchers were able to both verify that security tools have been implemented to fix network security failures previously found in the toy, but also discovered a security flaw which allows root access to the smart toy, allowing full access to the nose camera and other sensors. Preliminary results are presented in how the operating system can be modified in order to install software so that a modified bear can be controlled remotely. Mitigation education is presented as a critical instrument for self-protection of parents and children in a smart toy environment.