In the future, smart devices such as children’s toys, smart fridges, and driverless cars could be used to spy on people, says the deputy CEO of the trade association for tech companies in the UK.
Antony Walker, deputy CEO of TechUK, spoke yesterday to the UK parliament’s Science and Technology Committee, warning MPs of how the the draft Investigatory Powers Bill could be abused to turn just about any connected device into a snooping tool.
If approved in its current form, the bill (aka the Snooper’s Charter) would make it the legal duty of Internet providers to assist the British intelligence agencies in hacking into various devices if requested to do so. Walker emphasised that the committee should carefully consider how the “equipment interference” warrants should be used for gadgets beyond the usual PCs and phones.
“A range of devices that have been in the news recently, in relation to a hack, are children’s toys, that children can interact with,” Walker said, quoted by the BBC. “These are devices that may sit in a child’s bedroom but are accessible. In theory, the manufacturer of those products could be the subject of a warrant to enable equipment interference with those devices.”
The question about the security of children’s smart toys expands far beyond the Investigatory Powers Bill, though. In early December, the connected Hello Barbie doll produced by Mattel was reviewed and deemed ridiculously insecure by Bluebox Labs.
According to its report, the toy’s weak authentication mechanism allowed attackers to monitor the doll’s communications with a remote server. Those communications contain an audio recording of everything that’s going on around the doll, as it’s supposed to listen to the kid and participate in the conversation.
In addition to this weakness, the doll was proved to be vulnerable to POODLE, an attack disclosed in 2014 that breaks HTTPS encryption.
Another massive blow to children’s privacy on the Internet was struck in November, when hackers breached the servers of Hong Kong toy company VTech, compromising 4.8 million records. Those included children’s names, genders, and birthdates, along with some sensitive information about their parents, like home addresses, passwords and security questions.
SOURCE: Andrii Degeler | Ars Technica