This article is more than 1 year old
Toucan play that game: Talking toy bird hacked
Parroting Cayla... if she were a bit more sweary
The same researchers whose hack on the My Friend Cayla doll prompted regulatory action have followed up with a hack on a talking toy robot bird.
Researchers from UK security consultancy Pen Test Partners found that it was child’s play to turn the Teksta Toucan talking toy into a potty-mouth. In homage to The Fast Show the Toucan was induced to swear like Unlucky Alf’s parrot, as the video (below) illustrates.
“We knew that the Toucan had much in common with My Friend Cayla and iQue, so had a go at the same attacks, explained Pen Test Partner’s Ken Munro.
El Reg understands that Toucan is manufactured by the same vendor that makes iQue and Cayla, Genesis Industries Ltd of Hong Kong, and we have asked it for comment.
Two hack methods were quickly uncovered. Firstly, the Toucan is a Bluetooth audio device. It has a microphone and speaker, so it’s possible to simply pair it to a Bluetooth audio device (laptop, phone etc) and play some audio through the Toucan.
The Toucan works in a slightly different method to Cayla. The audio files are .mp3 contained in an OBB. The second (slightly trickier) hack involves extracting the Android package in the same way as PTP did with the Cayla hack and simply change the mp3 to a sweary one of your choice.
The iQue smart robot and Cayla were banned by the German telecommunications regulator a few months back. French regulators acted against Cayla earlier this week.
“Of more concern is that one can use the microphone too. Yes, just like Cayla, a third party can snoop on your kids and your house,” Munro said. “We are in the process of reporting this to the German telecommunications regulator in the hope of another ban being issued.”
Munro advised parents not to buy the toys and said, if they had one already, they should take it back to the shop.
In a barbed remark to manufacturers, Munro concludes that if vendors took the trouble to take even the most basic security steps towards securing smart toys then this sort of attack wouldn’t be possible. ®
Biting the hand that feeds IT
