Hackers could spy on children using security flaw in tablet

A tablet aimed at children aged between three and nine years old has a severe security flaw which allows hackers to spy on the children. Known as the InnoTab Max or the Storio Max and available for £115 ($120), the ‘safe’ tablet allows parents to approve a website before their children can visit it. But, […]

A tablet aimed at children aged between three and nine years old has a severe security flaw which allows hackers to spy on the children.

Known as the InnoTab Max or the Storio Max and available for £115 ($120), the ‘safe’ tablet allows parents to approve a website before their children can visit it.

But, it has been revealed, customers with affected devices are at risk of criminals taking control of the popular gadget and snooping on the vulnerable youngsters.

Accomplished hackers can monitor children, listen to them, talk to them, have full access and control of the device and even watch them through the webcam.

A watchdog exposed the flaw and the Chinese firm has now released a fix to the problem and a link to the software update is available at the top of its website.

Before it was placed in the prominent position on the site, VTech relied on pop-up alerts on the tablet to prompt the installation of the update.

The tablet is designed to give parents greater peace of mind and assurance than most internet-compatible tablets such as the iPad and Kindle which have more liberal internet access.

VTech’s tablets give parents and carers the opportunity to restrict access to websites at their own discretion.

Earlier this year, researchers at London-based SureCloud discovered a flaw that they made it vulnerable to attack if one or more of the pre-vetted sites were compromised.

‘‘To find the vulnerability in the first place wasn’t easy,’’ Luke Potter, the firm’s cyber-security practice director told BBC News.

‘‘But to actually exploit it once you know it’s there is reasonably simple.’’

The flaw means that malicious code can be remotely triggered to run on the devices from afar.

Mr Potter said this could involve making use of ‘off-the-shelf’ malware available from criminal markets or running customised code.

‘‘Remote access can be gained without the child even knowing,’’ he explained.

‘‘So effectively being able to monitor the child, listen to them, talk to them, have full access and control of the device.

‘‘For example, we demonstrated viewing things through the webcam.’’

VTech told MailOnline: ‘‘We thank SureCloud for bringing this vulnerability on the Storio Max, which is called InnoTab Max in the UK, to our attention.

‘‘We took immediate action in early summer to resolve the issue and pushed out a firmware upgrade to all affected InnoTab/Storio Max devices in Europe.

‘‘Since then, pop up messages will appear on the device from time to time to prompt the device owners to perform the upgrade until it is done.

‘‘Furthermore, most recently, for those users in Europe who have still not performed the upgrade, an email is being sent urging them to do so.

‘‘This was a controlled and targeted “ethical hack” by SureCloud, which is a sophisticated cyber firm that was in possession of a detailed knowledge of hacking techniques and InnoTab/Storio Max’s firmware.

‘‘We are not aware of any actual attempt to exploit the vulnerability and we consider the prospects of this happening to be remote.

‘‘However, the safety of children is our top priority and we are constantly looking to improve the security of our devices.’’