Hello Barbie, which sells for $74.99, uses Wi-Fi connectivity and speech recognition technology to give children an interactive toy that can “discuss anything,” according to Mattel. The problem is that ToyTalk, the company behind the modern technology in the doll, has vulnerable servers, which means children’s recorded conversations with Hello Barbie could potentially be accessed without permission.
Bluebox, the security firm that revealed the doll’s vulnerabilities, shares that the Hello Barbie app for iOS and Android has a number of flaws, including the use of an authentication credential that can be reused by attackers and useless code that “increases the overall attack surface.”
“The ToyTalk server domain was on a cloud infrastructure susceptible to the POODLE attack,” according to Bluebox.
All this means that hackers could potentially access, listen to and reconstruct recordings of children’s conversations with Hello Barbie.
“We have been working with Bluebox and appreciate their Responsible Disclosure of issues with respect to Hello Barbie,” ToyTalk CTO Matt Reddy told Gizmodo. “We are grateful that they informed us of relevant security vulnerabilities, which have been addressed.”
This revelation came on the heels of a warning from another researcher who said he found a flaw that could allow hackers to discover the home addresses of Hello Barbie owners, according to CNET.
The Hello Barbie news has likely gotten the attention of the FTC, according to a former director of the FTC’s Bureau of Consumer Protection.
Vtech, an electronics manufacturer based in Hong Kong, is working through a similar issue of its own as it responds to a security breach of its Learning Lodge app store database. That breach made accessible personal information such as email addresses, passwords, and mailing addresses.
