Are your kids LeapPad users?
Researchers at CheckMarx recently discovered some serious security flaws in the popular LeapPad Ultimate Tablet.
The tablet was designed by LeapFrog to provide kids in the UK and Europe with a safe environment to access games, videos, and educational apps.
CheckMarx had this to say about their discovery
"The first thing we found is that some of LeapFrog's communications aren't encrypted. It's using very simple HTTP protocol, storing information in clear text and allowing an attacker to become a man-in-the-middle."
CheckMarx built a proof of concept app that allowed them to spoof the existing connection and force the device onto a rogue network. From there, they were able to inject malicious scripts into the rogue network and use them to access a variety of sensitive information from the system, such as the child's name, gender, birth year and birth month.
The hackers can get parent's info
The researchers also noted that this attack methodology could allow hackers to steal information about the parents of the kids using the device, including their email addresses, phone numbers and access to payment card information.
Mari Sunderland, the VP of Digital Product Management at LeapFrog, issued a formal statement for the company, which read, in part, as follows:
"We thank CheckMarx for bringing these security issues to our attention, as the safety of the children who use our products is our top priority. When you know that the main users of your device will be children, the standards you need to put on your R&D need to be the highest: Military-grade. Vendors should be very responsible and understand that privacy issues for children are much worse. All this needs to be taken into account to make sure your solution is as safe as possible."
Our perspective
It's a wonderful sentiment, and one hopes that LeapFrog's next solution will be more robust.
As Sgt. Phil Esterhaus always advised: "Hey, let's be careful out there!"
Meanwhile, check out this report
This free executive report may give you insights into how to build your business with safe IT environments: 10 Hidden IT Risks That Might Threaten Your Business and 1 Easy Way to Find Them
The author
Thanks for reading this short post. For more tips on thriving with small business technology, check out the other blog posts at DWPia Blogs. I am also available on LinkedIn, Facebook, and Twitter.
I am Denis Wilson, President and Principal Consultant for DWP Information Architects. I help professionals grow their business by building a foundation of rock-solid information solutions for smaller healthcare, insurance, financial, legal, and nonprofits firms in Ventura County and San Fernando Valley. And have created cost-effective IT solutions, for over 20 years, specializing in cybersecurity and regulatory compliance. I am also a published author and speaker, working extensively with a variety of organizations, as well as providing small business technology education programs through business and professional associations. This just in: I will be speaking regularly at California Lutheran University's Center for Nonprofit Leadership starting in September.
Contact me if you would like me to speak at your association.