Pierluigi Paganini
December 24, 2021
Fisher Price Chatter Bluetooth Telephone has the appearance of a classic kids toy, but it was designed for adults and allows to make and receive calls over Bluetooth using a nearby smartphone.
The device is a Bluetooth headset that accepts the connections from a smartphone and could be used to take calls or as a speakerphone, unfortunately, serious privacy issues could allow attackers to spy on the owners. The device has already sold out, but it is only available for US customers.
Researchers from security firm PenTest Partners that analyzed the device pointed out that the issues can allow using the device as an audio bug.
The experts discovered that the Fisher-Price Chatter Bluetooth Telephone uses Bluetooth Classic failing in implementing a secure pairing process.
“When powered on, it just connects to any Bluetooth device in range that requests to pair.” state the experts. “Some nearby (next door house, next apartment, street outside) can connect their own Bluetooth audio device (smartphone / laptop etc) and use it to bug their neighbours.”
In a scarier scenario, ill-intentioned could use the device to speak to and listen to anyone in the environment where the device is located, including children.
Experts also discovered that if the phone handset is left off, it will auto-answers any call to a connected smartphone.
PenTest Partners reported the issues to Mattel, which owns Fisher-Price, but the company replied that the device was an adult toy and not for use by children. However, the above attack scenarios and the potential impact are disconcerting.
“During initial exchanges, Mattel indicated that it was an adult toy and not for use by children. We find it hard to believe that children will not be given the phone to play with after the novelty wears off with the adult! Further, some of the audio bugging issues do not require interaction of a child or adult.” concludes the post.
“We don’t think this is acceptable. How have Fisher Price not learned from similar security issues exposed in children’s toys several years ago?”
Experts suggest to the company to improve the pairing process, on the other side, owners should ensure the device is powered off when not explicitly in use, supervise their child’s use of the device, avoid leaving the Chatter telephone powered on when owners leave their home with the smartphone that is connected to the Chatter telephone.
Follow me on Twitter: @securityaffairs and Facebook
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, Fisher Price Chatter Bluetooth Telephone)
[adrotate banner=”5″]
[adrotate banner=”13″]
