Fisher-Price Smart Toy

» see smarttoy.fisher-price.com as it lived, on the wayback machine

~ the obit ~

The Smart Toy Bear arrived in the fall of 2015 at $99.99, and Fisher-Price sold it as a friend rather than a gadget. There was a camera in the nose for reading printed activity cards, a microphone, a speaker and a wifi radio. The pitch was that it would learn your child over months: favorite color, favorite food, birthday, which games got played most. All of that lived on Fisher-Price servers so the bear could pick up where it left off, and a parent app steered the thing from another room.

In late 2015 a Rapid7 researcher named Mark Stanislav was given one of these bears at a party for his unborn daughter, and did what a security researcher does with a present. The web API behind the toy did not properly check who was asking. Guess an account email address and the server would hand back the child profiles attached to it, including name, birthdate, gender and which toys that child had played with. Stanislav reported it on 23 November 2015, CERT published advisory VU#719736, and Fisher-Price closed the hole on 19 January 2016, two weeks before the press picked it up.

Mattel said there was no reason to believe anyone unauthorized had reached the data, and nothing has surfaced since to contradict that. The bear survived the story and picked up a monkey and a bear cub as stablemates. Then it quietly stopped being made, and Mattel's own product page now carries the entire obituary in one word: Discontinued, 2019. The support note underneath is blunter. The product will still work, it says, but everything that depends on the internet will not.

~ the rap sheet ~

~ what the bear knew ~

The interesting thing about the Smart Toy was never the plush. It was the account structure. A parent registered by email address and attached one or more children to that account, and each child became a server-side record carrying a birthdate and a growing history of play. Fisher-Price wanted that history because it was the only way to make the bear seem to remember, and it wanted it centrally because a toy with a cheap processor cannot hold much.

Which means the failure mode was set at design time. Every good property of the toy required a live server holding a file on a named child, and the API in front of that server was the entire security boundary. Rapid7 did not have to break anything clever; they guessed email addresses until the server answered.

~ the year of the listening toy ~

2015 and 2016 were unkind to connected toys generally. VTech lost the records of over six million children in November 2015. Hello Barbie shipped that same season with a microphone and a cloud transcription pipeline, and researchers went after it immediately. My Friend Cayla was eventually declared an illegal listening device in Germany. CloudPets left a database of recorded voice messages exposed to the open internet. The Smart Toy sat in the middle of that run and got off comparatively lightly, because the flaw was caught by someone who reported it.

This was an American toy-aisle product that spoke only English and needed a US-facing account service, so it was never realistically going to appear under a tree in Turkey even before the $99 tag and the customs on top of it. I read about it the way most people outside the US did, as an API story that happened to be wearing fur. By the time it reached me the bear was already beside the point.

~ the plush that stayed ~

The toys themselves did not disappear. They are on eBay for twenty dollars, and the listings mostly say "tested, works" because the offline modes still run. You can press the paws and get canned responses. What you cannot get is the thing you paid the premium for, which was a toy that knew who your kid was. That part was rented, and the lease ended in 2019 without an announcement anyone recorded.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »