Is Barbie Spying on Your Kids; Flaws May Let Hackers Interrogate Them

Even Barbie has her flaws. It has recently been discovered by security researchers that she is an eavesdropper. The Hello, Barbie doll has the ability to talk to your child. While it’s usually a good thing when the conversant is listening, in this case, Barbie might be feeding your child’s answers back to those on the naughty list, letting them know your address and other information they may find quite useful.

Most may think that it’s not that big of a deal. After all, it’s pretty hard to understand children sometimes and what could they possibly say that is important to a criminal? It turns out, a lot. Although Barbie is safe, the questions she asks the child provide anyone who will listen answers to such questions as “Tell me about your mother” or “Tell me about your bedroom.” This could be a problem.

The toy works like this: The child speaks to it and she answers with pre-recorded messages that are returned from a server in the cloud. This happens in seconds and children think she’s a great friend who listens. Researchers have discovered ways hackers could pinpoint your address and another found that if you take Barbie apart and hack her voice recordings, you can make them ask whatever questions they desire.

New toys are fun and interesting and can enhance your child’s learning experience. However, extra precautions are in order:

• When shopping for technical toys, it’s important to research how they function before giving them to kids. As technology advances many toys are connecting back to the Internet and sending information somewhere. Once any information leaves your, or your child’s possession, it’s hard to be sure what may happen with it. Earlier, hackers were able to steal account information of 6.4 million vTech customers, including children. Take some extra time to figure out what the toys do before making purchases. Sometimes it isn’t as harmless as you may think.

• If you do buy toys like Hello, Barbie or vTech’s Learning Lodge products, register them. This allows the company to inform you when patches and updates are available. Then figure out how to get them applied immediately. In some cases, it may happen automatically. In others, however, you may have to take some action yourself. Whatever the case, registering will provide a streamlined communication path between you and the manufacturer.

• After the child receives the gift, connect it and update it before letting the child play with it. As with home networking equipment, electronic toys may have been sitting on the shelf for a while and may need to have the latest software updates applied. Anyone who purchased this Barbie toy already will need to do this most certainly.

• Immediately change any passwords that come with toys by default to something else. Create strong ones with at least eight characters. Include upper and lower case letters, numbers, and special characters. Don’t use the child’s name or any information that may be easily guessed and don’t use any dictionary words. 

• Use separate online credentials for every account. Often, hackers will try stolen credentials over multiple websites. More often than we might think, they are successful. Change passwords often; at least quarterly.

ToyTalk and Mattel are working quickly to try to patch the flaws and so far, there is no indication that anything nefarious has been done related to the issues. Many of them have already been fixed. However, this is a reminder that the Internet can be a scary place and even toys can put your child at risk of identity theft.