![Page 1: Smart Toys: Are They Too Smart? - Where The World Talks … · Smart Toys: Are They Too Smart? Security Researcher. Synack Inc. ... Smart Toy = + Physical Toy ... Connected World](https://reader031.vdocuments.net/reader031/viewer/2022022007/5acb7b3a7f8b9ab10a8b4dff/html5/thumbnails/1.jpg)
#RSAC
Oren Yomtov
Smart Toys: Are They Too Smart?
Security ResearcherSynack Inc.@orenyomtov
![Page 2: Smart Toys: Are They Too Smart? - Where The World Talks … · Smart Toys: Are They Too Smart? Security Researcher. Synack Inc. ... Smart Toy = + Physical Toy ... Connected World](https://reader031.vdocuments.net/reader031/viewer/2022022007/5acb7b3a7f8b9ab10a8b4dff/html5/thumbnails/2.jpg)
#RSAC
Smart Toys
Toymail
![Page 3: Smart Toys: Are They Too Smart? - Where The World Talks … · Smart Toys: Are They Too Smart? Security Researcher. Synack Inc. ... Smart Toy = + Physical Toy ... Connected World](https://reader031.vdocuments.net/reader031/viewer/2022022007/5acb7b3a7f8b9ab10a8b4dff/html5/thumbnails/3.jpg)
#RSAC
3
![Page 4: Smart Toys: Are They Too Smart? - Where The World Talks … · Smart Toys: Are They Too Smart? Security Researcher. Synack Inc. ... Smart Toy = + Physical Toy ... Connected World](https://reader031.vdocuments.net/reader031/viewer/2022022007/5acb7b3a7f8b9ab10a8b4dff/html5/thumbnails/4.jpg)
#RSAC
Background
Started breaking things in 2007
Israeli Intelligence Corps
Security Researcher at Synack
![Page 5: Smart Toys: Are They Too Smart? - Where The World Talks … · Smart Toys: Are They Too Smart? Security Researcher. Synack Inc. ... Smart Toy = + Physical Toy ... Connected World](https://reader031.vdocuments.net/reader031/viewer/2022022007/5acb7b3a7f8b9ab10a8b4dff/html5/thumbnails/5.jpg)
#RSAC
Smart Toy =
+Physical Toy Any Screen Game Software
+
![Page 6: Smart Toys: Are They Too Smart? - Where The World Talks … · Smart Toys: Are They Too Smart? Security Researcher. Synack Inc. ... Smart Toy = + Physical Toy ... Connected World](https://reader031.vdocuments.net/reader031/viewer/2022022007/5acb7b3a7f8b9ab10a8b4dff/html5/thumbnails/6.jpg)
#RSAC
Users Manufacturers
![Page 7: Smart Toys: Are They Too Smart? - Where The World Talks … · Smart Toys: Are They Too Smart? Security Researcher. Synack Inc. ... Smart Toy = + Physical Toy ... Connected World](https://reader031.vdocuments.net/reader031/viewer/2022022007/5acb7b3a7f8b9ab10a8b4dff/html5/thumbnails/7.jpg)
#RSAC
Users
![Page 8: Smart Toys: Are They Too Smart? - Where The World Talks … · Smart Toys: Are They Too Smart? Security Researcher. Synack Inc. ... Smart Toy = + Physical Toy ... Connected World](https://reader031.vdocuments.net/reader031/viewer/2022022007/5acb7b3a7f8b9ab10a8b4dff/html5/thumbnails/8.jpg)
#RSAC
8
![Page 9: Smart Toys: Are They Too Smart? - Where The World Talks … · Smart Toys: Are They Too Smart? Security Researcher. Synack Inc. ... Smart Toy = + Physical Toy ... Connected World](https://reader031.vdocuments.net/reader031/viewer/2022022007/5acb7b3a7f8b9ab10a8b4dff/html5/thumbnails/9.jpg)
#RSAC
9
![Page 10: Smart Toys: Are They Too Smart? - Where The World Talks … · Smart Toys: Are They Too Smart? Security Researcher. Synack Inc. ... Smart Toy = + Physical Toy ... Connected World](https://reader031.vdocuments.net/reader031/viewer/2022022007/5acb7b3a7f8b9ab10a8b4dff/html5/thumbnails/10.jpg)
#RSAC
10
![Page 11: Smart Toys: Are They Too Smart? - Where The World Talks … · Smart Toys: Are They Too Smart? Security Researcher. Synack Inc. ... Smart Toy = + Physical Toy ... Connected World](https://reader031.vdocuments.net/reader031/viewer/2022022007/5acb7b3a7f8b9ab10a8b4dff/html5/thumbnails/11.jpg)
#RSAC
11
![Page 12: Smart Toys: Are They Too Smart? - Where The World Talks … · Smart Toys: Are They Too Smart? Security Researcher. Synack Inc. ... Smart Toy = + Physical Toy ... Connected World](https://reader031.vdocuments.net/reader031/viewer/2022022007/5acb7b3a7f8b9ab10a8b4dff/html5/thumbnails/12.jpg)
#RSAC
12
![Page 13: Smart Toys: Are They Too Smart? - Where The World Talks … · Smart Toys: Are They Too Smart? Security Researcher. Synack Inc. ... Smart Toy = + Physical Toy ... Connected World](https://reader031.vdocuments.net/reader031/viewer/2022022007/5acb7b3a7f8b9ab10a8b4dff/html5/thumbnails/13.jpg)
#RSAC
Manufacturers
![Page 14: Smart Toys: Are They Too Smart? - Where The World Talks … · Smart Toys: Are They Too Smart? Security Researcher. Synack Inc. ... Smart Toy = + Physical Toy ... Connected World](https://reader031.vdocuments.net/reader031/viewer/2022022007/5acb7b3a7f8b9ab10a8b4dff/html5/thumbnails/14.jpg)
#RSAC
14
![Page 15: Smart Toys: Are They Too Smart? - Where The World Talks … · Smart Toys: Are They Too Smart? Security Researcher. Synack Inc. ... Smart Toy = + Physical Toy ... Connected World](https://reader031.vdocuments.net/reader031/viewer/2022022007/5acb7b3a7f8b9ab10a8b4dff/html5/thumbnails/15.jpg)
#RSAC
15
![Page 16: Smart Toys: Are They Too Smart? - Where The World Talks … · Smart Toys: Are They Too Smart? Security Researcher. Synack Inc. ... Smart Toy = + Physical Toy ... Connected World](https://reader031.vdocuments.net/reader031/viewer/2022022007/5acb7b3a7f8b9ab10a8b4dff/html5/thumbnails/16.jpg)
#RSAC
16
![Page 17: Smart Toys: Are They Too Smart? - Where The World Talks … · Smart Toys: Are They Too Smart? Security Researcher. Synack Inc. ... Smart Toy = + Physical Toy ... Connected World](https://reader031.vdocuments.net/reader031/viewer/2022022007/5acb7b3a7f8b9ab10a8b4dff/html5/thumbnails/17.jpg)
#RSAC
Attack Vectors
![Page 18: Smart Toys: Are They Too Smart? - Where The World Talks … · Smart Toys: Are They Too Smart? Security Researcher. Synack Inc. ... Smart Toy = + Physical Toy ... Connected World](https://reader031.vdocuments.net/reader031/viewer/2022022007/5acb7b3a7f8b9ab10a8b4dff/html5/thumbnails/18.jpg)
#RSAC
HTTP
HTTPApp
ToyServer
![Page 19: Smart Toys: Are They Too Smart? - Where The World Talks … · Smart Toys: Are They Too Smart? Security Researcher. Synack Inc. ... Smart Toy = + Physical Toy ... Connected World](https://reader031.vdocuments.net/reader031/viewer/2022022007/5acb7b3a7f8b9ab10a8b4dff/html5/thumbnails/19.jpg)
#RSAC
HTTP
HTTPS
Certificate validation
Certificate pinning
![Page 20: Smart Toys: Are They Too Smart? - Where The World Talks … · Smart Toys: Are They Too Smart? Security Researcher. Synack Inc. ... Smart Toy = + Physical Toy ... Connected World](https://reader031.vdocuments.net/reader031/viewer/2022022007/5acb7b3a7f8b9ab10a8b4dff/html5/thumbnails/20.jpg)
#RSAC
Web API
Toy Server
![Page 21: Smart Toys: Are They Too Smart? - Where The World Talks … · Smart Toys: Are They Too Smart? Security Researcher. Synack Inc. ... Smart Toy = + Physical Toy ... Connected World](https://reader031.vdocuments.net/reader031/viewer/2022022007/5acb7b3a7f8b9ab10a8b4dff/html5/thumbnails/21.jpg)
#RSAC
Web API
SQL injection
Broken authentication
Path traversal
For more information, visit OWASP Top 10
![Page 22: Smart Toys: Are They Too Smart? - Where The World Talks … · Smart Toys: Are They Too Smart? Security Researcher. Synack Inc. ... Smart Toy = + Physical Toy ... Connected World](https://reader031.vdocuments.net/reader031/viewer/2022022007/5acb7b3a7f8b9ab10a8b4dff/html5/thumbnails/22.jpg)
#RSAC
Firmware / Software Update
ServerFirmware Update
App
Toy
![Page 23: Smart Toys: Are They Too Smart? - Where The World Talks … · Smart Toys: Are They Too Smart? Security Researcher. Synack Inc. ... Smart Toy = + Physical Toy ... Connected World](https://reader031.vdocuments.net/reader031/viewer/2022022007/5acb7b3a7f8b9ab10a8b4dff/html5/thumbnails/23.jpg)
#RSAC
Firmware / Software Update
Firmware signing
Transport security (HTTPS)
Encryption
![Page 24: Smart Toys: Are They Too Smart? - Where The World Talks … · Smart Toys: Are They Too Smart? Security Researcher. Synack Inc. ... Smart Toy = + Physical Toy ... Connected World](https://reader031.vdocuments.net/reader031/viewer/2022022007/5acb7b3a7f8b9ab10a8b4dff/html5/thumbnails/24.jpg)
#RSAC
Bluetooth
BluetoothApp Toy
![Page 25: Smart Toys: Are They Too Smart? - Where The World Talks … · Smart Toys: Are They Too Smart? Security Researcher. Synack Inc. ... Smart Toy = + Physical Toy ... Connected World](https://reader031.vdocuments.net/reader031/viewer/2022022007/5acb7b3a7f8b9ab10a8b4dff/html5/thumbnails/25.jpg)
#RSAC
Hardware
Toy
![Page 26: Smart Toys: Are They Too Smart? - Where The World Talks … · Smart Toys: Are They Too Smart? Security Researcher. Synack Inc. ... Smart Toy = + Physical Toy ... Connected World](https://reader031.vdocuments.net/reader031/viewer/2022022007/5acb7b3a7f8b9ab10a8b4dff/html5/thumbnails/26.jpg)
#RSAC
26
![Page 27: Smart Toys: Are They Too Smart? - Where The World Talks … · Smart Toys: Are They Too Smart? Security Researcher. Synack Inc. ... Smart Toy = + Physical Toy ... Connected World](https://reader031.vdocuments.net/reader031/viewer/2022022007/5acb7b3a7f8b9ab10a8b4dff/html5/thumbnails/27.jpg)
#RSAC
Hardcoded Secrets
App
Toy
![Page 28: Smart Toys: Are They Too Smart? - Where The World Talks … · Smart Toys: Are They Too Smart? Security Researcher. Synack Inc. ... Smart Toy = + Physical Toy ... Connected World](https://reader031.vdocuments.net/reader031/viewer/2022022007/5acb7b3a7f8b9ab10a8b4dff/html5/thumbnails/28.jpg)
#RSAC
Hardcoded Secrets
API Keys (e.g. AWS)
URLs not meant to be exposed to end-users
Credentials
Encryption keys
![Page 29: Smart Toys: Are They Too Smart? - Where The World Talks … · Smart Toys: Are They Too Smart? Security Researcher. Synack Inc. ... Smart Toy = + Physical Toy ... Connected World](https://reader031.vdocuments.net/reader031/viewer/2022022007/5acb7b3a7f8b9ab10a8b4dff/html5/thumbnails/29.jpg)
#RSAC
29
![Page 30: Smart Toys: Are They Too Smart? - Where The World Talks … · Smart Toys: Are They Too Smart? Security Researcher. Synack Inc. ... Smart Toy = + Physical Toy ... Connected World](https://reader031.vdocuments.net/reader031/viewer/2022022007/5acb7b3a7f8b9ab10a8b4dff/html5/thumbnails/30.jpg)
#RSAC
Oren Yomtov
Smart Toys: Are They Too Smart?
Security ResearcherSynack Inc.@orenyomtov
![Page 31: Smart Toys: Are They Too Smart? - Where The World Talks … · Smart Toys: Are They Too Smart? Security Researcher. Synack Inc. ... Smart Toy = + Physical Toy ... Connected World](https://reader031.vdocuments.net/reader031/viewer/2022022007/5acb7b3a7f8b9ab10a8b4dff/html5/thumbnails/31.jpg)
#RSAC
Michele D. Guel
Your Part in Securing Our Connected World –Are You Ready?
Distinguished Engineer, InfosecCisco Systems@MicheleDGuel
![Page 32: Smart Toys: Are They Too Smart? - Where The World Talks … · Smart Toys: Are They Too Smart? Security Researcher. Synack Inc. ... Smart Toy = + Physical Toy ... Connected World](https://reader031.vdocuments.net/reader031/viewer/2022022007/5acb7b3a7f8b9ab10a8b4dff/html5/thumbnails/32.jpg)
#RSAC
A Typical Connected Day in 2017
![Page 33: Smart Toys: Are They Too Smart? - Where The World Talks … · Smart Toys: Are They Too Smart? Security Researcher. Synack Inc. ... Smart Toy = + Physical Toy ... Connected World](https://reader031.vdocuments.net/reader031/viewer/2022022007/5acb7b3a7f8b9ab10a8b4dff/html5/thumbnails/33.jpg)
#RSAC
What if every aspect of your life was digitally captured?
![Page 34: Smart Toys: Are They Too Smart? - Where The World Talks … · Smart Toys: Are They Too Smart? Security Researcher. Synack Inc. ... Smart Toy = + Physical Toy ... Connected World](https://reader031.vdocuments.net/reader031/viewer/2022022007/5acb7b3a7f8b9ab10a8b4dff/html5/thumbnails/34.jpg)
#RSAC
Opportunities & Challenges
![Page 35: Smart Toys: Are They Too Smart? - Where The World Talks … · Smart Toys: Are They Too Smart? Security Researcher. Synack Inc. ... Smart Toy = + Physical Toy ... Connected World](https://reader031.vdocuments.net/reader031/viewer/2022022007/5acb7b3a7f8b9ab10a8b4dff/html5/thumbnails/35.jpg)
#RSAC
What are the Opportunities?
Data driven decisions
Increased automation
Higher productivity
Efficient use of resources
Exponential connectedness
Limitless possibilities
![Page 36: Smart Toys: Are They Too Smart? - Where The World Talks … · Smart Toys: Are They Too Smart? Security Researcher. Synack Inc. ... Smart Toy = + Physical Toy ... Connected World](https://reader031.vdocuments.net/reader031/viewer/2022022007/5acb7b3a7f8b9ab10a8b4dff/html5/thumbnails/36.jpg)
#RSAC
What are Challenges?
Loss of privacy
Loss of humanity
New, unforeseen attack vectors
Increase risk of targeted attacks
Increase need for new laws and regulations
Exponential expansion of threat landscape
![Page 37: Smart Toys: Are They Too Smart? - Where The World Talks … · Smart Toys: Are They Too Smart? Security Researcher. Synack Inc. ... Smart Toy = + Physical Toy ... Connected World](https://reader031.vdocuments.net/reader031/viewer/2022022007/5acb7b3a7f8b9ab10a8b4dff/html5/thumbnails/37.jpg)
#RSAC
IOT is Moving at Warp Speed
“As is often the case, consumer demand for new and exciting technologies
have far surpassed the implementation of security measures.”
![Page 38: Smart Toys: Are They Too Smart? - Where The World Talks … · Smart Toys: Are They Too Smart? Security Researcher. Synack Inc. ... Smart Toy = + Physical Toy ... Connected World](https://reader031.vdocuments.net/reader031/viewer/2022022007/5acb7b3a7f8b9ab10a8b4dff/html5/thumbnails/38.jpg)
#RSAC
How Connected Do You Want to Be?
![Page 39: Smart Toys: Are They Too Smart? - Where The World Talks … · Smart Toys: Are They Too Smart? Security Researcher. Synack Inc. ... Smart Toy = + Physical Toy ... Connected World](https://reader031.vdocuments.net/reader031/viewer/2022022007/5acb7b3a7f8b9ab10a8b4dff/html5/thumbnails/39.jpg)
#RSAC
Our Part
![Page 40: Smart Toys: Are They Too Smart? - Where The World Talks … · Smart Toys: Are They Too Smart? Security Researcher. Synack Inc. ... Smart Toy = + Physical Toy ... Connected World](https://reader031.vdocuments.net/reader031/viewer/2022022007/5acb7b3a7f8b9ab10a8b4dff/html5/thumbnails/40.jpg)
#RSAC
As Individuals We Can…
Hold vendors accountable
Don’t use applications with weak security
Understand privacy laws
Get educated on new technologies
Encourage your kids to pursue STEM
![Page 41: Smart Toys: Are They Too Smart? - Where The World Talks … · Smart Toys: Are They Too Smart? Security Researcher. Synack Inc. ... Smart Toy = + Physical Toy ... Connected World](https://reader031.vdocuments.net/reader031/viewer/2022022007/5acb7b3a7f8b9ab10a8b4dff/html5/thumbnails/41.jpg)
#RSAC
As Employees We Can…
Hold vendors accountable
Develop & adopt standards for application integrity and trustworthiness
Develop and adopt standards for IP enabled devices
Develop and adopt seamless and scalable identity for people, process and things
![Page 42: Smart Toys: Are They Too Smart? - Where The World Talks … · Smart Toys: Are They Too Smart? Security Researcher. Synack Inc. ... Smart Toy = + Physical Toy ... Connected World](https://reader031.vdocuments.net/reader031/viewer/2022022007/5acb7b3a7f8b9ab10a8b4dff/html5/thumbnails/42.jpg)
#RSAC
Apply What You Have Learned Today
Within 30 days:Identify where sensor/smart technology is in use
Become more proactive about privacy of data
Within 60 days:Form a strategy around securing sensor/smart technology
Understand changing privacy laws that pertain to your organization and your personal data
![Page 43: Smart Toys: Are They Too Smart? - Where The World Talks … · Smart Toys: Are They Too Smart? Security Researcher. Synack Inc. ... Smart Toy = + Physical Toy ... Connected World](https://reader031.vdocuments.net/reader031/viewer/2022022007/5acb7b3a7f8b9ab10a8b4dff/html5/thumbnails/43.jpg)
#RSAC
Apply What You Have Learned Today
Within 180 days:Implement policy regarding use of sensor/smart technology
Ensure IoT projects are reviewed by security architecture team
![Page 44: Smart Toys: Are They Too Smart? - Where The World Talks … · Smart Toys: Are They Too Smart? Security Researcher. Synack Inc. ... Smart Toy = + Physical Toy ... Connected World](https://reader031.vdocuments.net/reader031/viewer/2022022007/5acb7b3a7f8b9ab10a8b4dff/html5/thumbnails/44.jpg)
#RSAC
Thank You