The toucan, Pen Test Partners explains, is quite simply a Bluetooth audio device. To play with it, one need only pair it to a Bluetooth audio device, whether it’s a laptop, phone, or tablet, and play audio directly through the bird. But as the security firm points out, “Of more concern is that one can use the microphone too.” That means that, just like the Cayla doll, someone who really wanted to could access the toy’s microphone and potentially spy on your kids and your household.
Pen Test Partners noted that they are “in the process of reporting this to the German telecommunications regulator in the hope of another ban being issued.” So far, Germany has already banned the iQue smart robot (which was hacked by folks at the Norwegian Consumer Council) and of course, My Friend Cayla.
While the Toucan works a bit differently from Cayla, with MP3 audio files contained in an opaque binary blog (OBB), it’s still relatively straightforward to extract the toy’s Android package and change the MP3 files to … well, anything you want. In the case of the security firm, they decided to change the audio file to a swear word, which is decidedly not kid-friendly.
Pen Test Partners has been asking parents for quite some time to avoid buying these seemingly smart toys for their children. “If you have one already, I suggest returning it to the retailer,” the firm wrote. That said, if you’re really keen on keeping the toy, be sure to switch it off when it’s not being used.
Security researchers are also imploring regulators to ban such toys and manufacturers to take more care in securing their products.
