Welcome!

@ThingsExpo Authors: Yeshim Deniz, Pat Romanski, Liz McMillan, Elizabeth White, Zakia Bouachraoui

Related Topics: @ThingsExpo, Cloud Security

@ThingsExpo: Article

IoT and Hello Barbie | @ThingsExpo #IoT #M2M #API #InternetOfThings

Hello Barbie™! is an IoT-enabled Barbie Doll with blonde hair, blue eyes and a built-in surveillance system

Five Things You Should Know About Hello Barbie!

Hello Barbie™! is an IoT-enabled (Internet of Things) Barbie Doll with blonde hair, blue eyes and a built-in surveillance system. She’s not the first of her kind (and she won’t be the last), but here’s what you should know about bringing it, or any connected device, into your home.

Everything that connects to the public Internet is vulnerable. Encryption does not solve the problem. While it is true that you need about 6.4 billion years to crack a 2048-bit PGP encrypted file, I can probably socially engineer you out of your encryption key by attaching a little piece of malware to an email that offers you two discounted Super Bowl tickets and a deal on a hotel.

In practice, no one, not even the very best whitehat hackers, can predict how clever or innovative blackhat hackers will become, or what kind of unexpected new hacks will evolve. Interestingly, there are two immutable facts of digital life: (1) Everything that can be connected will be connected. (2) Everything that can be hacked will be hacked. This is where Hello Barbie! gets in trouble. But it shouldn’t. Hello Barbie! is not a Barbie Doll; it’s a connected device. Here’s what you need to know:

1 – Barbie Is Not Smart, but She Is Connected
In order to have a conversation with you, Hello Barbie! has to connect to ToyTalk, Inc.’s servers. This requires, in most cases, a WiFi connection and access to the public Internet. How secure is this connection? A better question is, how secure is your home WiFi network (or the public one you’re using to connect the doll)? If you don’t know the answer, Hello Barbie! is not your problem. Your computers, game consoles, the thermostat on your wall or your connected doorbell poses a greater danger to your cyber-safety.

2 – She’s Not “Always On”
Contrary to sensationalist reports, Hello Barbie! cannot listen to you unless you press the “talk” button. Then, and only then, your voice is recorded, encrypted and transmitted via the public Internet to a remote server (the “cloud”) where the audio file of your voice is stored. The file is stored, and anonymized versions are shared with third-party vendors because the machine-learning tools that Mattel and ToyTalk, Inc. are using “learn” from each interaction with real people. The machine-learning algorithms must be “trained” in order to improve. I wrote an article that may help you better understand this process entitled “Can Machines Really Learn?

3 – Barbie Really Can’t Talk; She Responds
After your voice file is received by ToyTalk, Inc.’s servers, it is analyzed (as quickly as possible) by a natural language processing (NLP) algorithm that attempts to understand what you have said. Then, the algorithm makes its best guess at the most appropriate response from a relatively small list (about 8,000 possible responses – get the full list here), and when you release the button, Hello Barbie! will “talk” to you by playing back the pre-recorded response the algorithm has chosen. You can think of Hello Barbie! as a crippled Siri, OK Google, Cortana or Alexa with very strict response guidelines.

4 – She’s Got a Good Memory for Networking
Hello Barbie! connects to any WiFi network. To accomplish this, you press and hold the power button and the talk button for three seconds until the doll’s necklace flashes white. Then, you launch the Hello Barbie! companion app and enter your network credentials. Like your smartphone, Hello Barbie! can store (remember) WiFi networks it has successfully connected to in the past and automatically connect to them. This is a very convenient feature. For the uninitiated, even this simple connection process is painful. Importantly, Hello Barbie! cannot be used by anyone (owner or hacker) when it is not connected.

5 – She’s a Great Target for Hackers
Maybe. Here’s what a hacker would need to do. First, infiltrate the WiFi network where the Hello Barbie! is being used. Then, figure out a way to store malware in the device. Some good ideas for doing harm include defeating the talk button and getting control of the transducer. This way a hacker could listen to every conversation. Alternatively, a hacker could just copy the audio files from each interaction, or worse, a hacker could use counterfeit servers to replace ToyTalk, Inc.’s servers and trick the user into interacting with the hacker. But here’s the important thing: if a hacker wanted to do harm to someone using digital tools, there are much, much easier ways. Hacking Hello Barbie! is not the path of least resistance, and the value (since no financial or account information is stored in the device) is minimal.

You could argue that recording a child’s conversation with an imaginary friend (albeit an anthropomorphized one) might yield incriminating or useful information about things going on in the household, or something even more nefarious. But it’s 50 times easier to activate the microphone and webcam on an average WiFi-connected laptop (without the user’s knowledge) than it would be to hack this doll. And the results of a dropcam or webcam hack would yield much more usable data.

The Bottom Line
Hello Barbie! is no more dangerous than any smart device you bring into your home. That said, manufacturers need to heed this tale. Mattel has taken some serious flak over its perceived (and in some cases real) lack of security protocols. While any motivated hacker could (and would) have a field day with Hello Barbie!, most motivated hackers can have a field day with a connected toaster oven. That’s what hackers do.

My best advice is to use Hello Barbie! as directed AND do what parents have been doing from the beginning of time: watch your kids. Would you let your 14-year-old daughter entertain a 16-year-old boy in her room with the door closed? Then why would you let any child be connected to the public Internet without adult supervision? Remember, Hello Barbie! is not a Barbie Doll; it’s a connected device. Treat it like one, and everything else will take care of itself.

The post 5 Things You Should Know About Hello Barbie! originally appeared here on Shelly Palmer

More Stories By Shelly Palmer

Shelly Palmer is the host of Fox Television’s "Shelly Palmer Digital Living" television show about living and working in a digital world. He is Fox 5′s (WNYW-TV New York) Tech Expert and the host of United Stations Radio Network’s, MediaBytes, a daily syndicated radio report that features insightful commentary and a unique insiders take on the biggest stories in technology, media, and entertainment.

IoT & Smart Cities Stories
@DevOpsSummit at Cloud Expo, taking place November 12-13 in New York City, NY, is co-located with 22nd international CloudEXPO | first international DXWorldEXPO and will feature technical sessions from a rock star conference faculty and the leading industry players in the world. The widespread success of cloud computing is driving the DevOps revolution in enterprise IT. Now as never before, development teams must communicate and collaborate in a dynamic, 24/7/365 environment. There is no time t...
CloudEXPO New York 2018, colocated with DXWorldEXPO New York 2018 will be held November 11-13, 2018, in New York City and will bring together Cloud Computing, FinTech and Blockchain, Digital Transformation, Big Data, Internet of Things, DevOps, AI, Machine Learning and WebRTC to one location.
The best way to leverage your Cloud Expo presence as a sponsor and exhibitor is to plan your news announcements around our events. The press covering Cloud Expo and @ThingsExpo will have access to these releases and will amplify your news announcements. More than two dozen Cloud companies either set deals at our shows or have announced their mergers and acquisitions at Cloud Expo. Product announcements during our show provide your company with the most reach through our targeted audiences.
Machine Learning helps make complex systems more efficient. By applying advanced Machine Learning techniques such as Cognitive Fingerprinting, wind project operators can utilize these tools to learn from collected data, detect regular patterns, and optimize their own operations. In his session at 18th Cloud Expo, Stuart Gillen, Director of Business Development at SparkCognition, discussed how research has demonstrated the value of Machine Learning in delivering next generation analytics to impr...
The challenges of aggregating data from consumer-oriented devices, such as wearable technologies and smart thermostats, are fairly well-understood. However, there are a new set of challenges for IoT devices that generate megabytes or gigabytes of data per second. Certainly, the infrastructure will have to change, as those volumes of data will likely overwhelm the available bandwidth for aggregating the data into a central repository. Ochandarena discusses a whole new way to think about your next...
The hierarchical architecture that distributes "compute" within the network specially at the edge can enable new services by harnessing emerging technologies. But Edge-Compute comes at increased cost that needs to be managed and potentially augmented by creative architecture solutions as there will always a catching-up with the capacity demands. Processing power in smartphones has enhanced YoY and there is increasingly spare compute capacity that can be potentially pooled. Uber has successfully ...
Chris Matthieu is the President & CEO of Computes, inc. He brings 30 years of experience in development and launches of disruptive technologies to create new market opportunities as well as enhance enterprise product portfolios with emerging technologies. His most recent venture was Octoblu, a cross-protocol Internet of Things (IoT) mesh network platform, acquired by Citrix. Prior to co-founding Octoblu, Chris was founder of Nodester, an open-source Node.JS PaaS which was acquired by AppFog and ...
The deluge of IoT sensor data collected from connected devices and the powerful AI required to make that data actionable are giving rise to a hybrid ecosystem in which cloud, on-prem and edge processes become interweaved. Attendees will learn how emerging composable infrastructure solutions deliver the adaptive architecture needed to manage this new data reality. Machine learning algorithms can better anticipate data storms and automate resources to support surges, including fully scalable GPU-c...
Predicting the future has never been more challenging - not because of the lack of data but because of the flood of ungoverned and risk laden information. Microsoft states that 2.5 exabytes of data are created every day. Expectations and reliance on data are being pushed to the limits, as demands around hybrid options continue to grow.
JETRO showcased Japan Digital Transformation Pavilion at SYS-CON's 21st International Cloud Expo® at the Santa Clara Convention Center in Santa Clara, CA. The Japan External Trade Organization (JETRO) is a non-profit organization that provides business support services to companies expanding to Japan. With the support of JETRO's dedicated staff, clients can incorporate their business; receive visa, immigration, and HR support; find dedicated office space; identify local government subsidies; get...