  This paper investigates the security and privacy of Internet-connected
children's smart toys through case studies of three commercially-available
products. We conduct network and application vulnerability analyses of each toy
using static and dynamic analysis techniques, including application binary
decompilation and network monitoring. We discover several publicly undisclosed
vulnerabilities that violate the Children's Online Privacy Protection Rule
(COPPA) as well as the toys' individual privacy policies. These
vulnerabilities, especially security flaws in network communications with
first-party servers, are indicative of a disconnect between many IoT toy
developers and security and privacy best practices despite increased attention
to Internet-connected toy hacking risks.
