Researchers at CheckMarx recently discovered some serious security flaws in the popular LeapPad Ultimate tablet.
The tablet was designed by LeapFrog to provide kids in the UK and Europe with a safe environment to access games, videos, and educational apps.
The researchers had this to say about their discovery:
“The first thing we found is that some of LeapFrog’s communications aren’t encrypted. It’s using the straightforward HTTP protocol, storing information in clear text, and allowing an attacker to become a man-in-the-middle.”
The researchers built a proof of concept app that allowed them to spoof the existing connection and force the device onto a rogue network. From there, they were able to inject malicious scripts into the rogue network and use them to access a variety of sensitive information from the system, such as the child’s name, gender, birth year and birth month.
The researchers also noted that this attack methodology could allow hackers to steal information about the parents of the kids using the device, including their email addresses, phone numbers, and access to payment card information.
Mari Sunderland, the VP of Digital Product Management at LeapFrog, issued a formal statement for the company, which read, in part, as follows:
“We thank CheckMarx for bringing these security issues to our attention, as the safety of the children who use our products is our top priority. When you know that the main users of your device will be children, the standards you need to put on your R&D need to be the highest: Military-grade. Vendors should be very responsible and understand that privacy issues for children are much worse. All this needs to be taken into account to make sure your solution is as safe as possible.”
It’s a wonderful sentiment, and one hopes that LeapFrog’s next solution will be more robust.
