Beware the spy hiding in the toybox that can hack your data

AMAZON and ebay are removing a cuddly toy equipped with a microphone and speaker from their online stores after researchers found that it is riddled with security flaws.

The decision comes after software company Mozilla contacted Amazon with findings that showed vulnerabilities in Cloudpets.

One vulnerability allowed potential criminals to install custom software on the toy without any security checks. The software could let a potential hacker take control of the toy, along with any data that passed through it.

The smart device, made by Spiral Toys, is a talking toy that is connected to the internet and allows children to record and play back their voice. The recordings are then uploaded online using a connected app.

However, last year hackers were able to access Cloudpets’ database on unprotected servers which contained email addresses, passwords and voice recordings from children. The hackers then held the personal details for ransom.

After the breach, which affected more than 800,000 people, Mozilla worked with cybersecurity research firm Cure53 to see what vulnerabilities remained in the toys. Mozilla found that Cloudpets’ Bluetooth vulnerabilities, first demonstrated more than a year ago, remain in place.

“The company clearly does not care about their users’ security and privacy being violated and makes no effort to respond to well-meaning attack reports, further facilitating and inviting malicious actions against their users,” the report claimed.

The Cloudpets mobile app refers users to a website called “mycloudpets. com/tour,” a domain that is currently for sale, which researchers say could be redirected by potential hackers for the purpose of online scams.

Alex Neill, Which? managing director of home products and services, said: “When you give a toy to a child you expect it to be safe and secure as a minimum. If that can’t be guaranteed, then the products should not be sold.”

ebay told The Daily Telegraph: “This type of item is banned from ebay’s UK platform and any listings will continue to be removed.”

Amazon began removing Cloudpets on Tuesday morning and was contacted for comment.