Security researchers from Checkmarx Ltd. revealed today they’ve uncovered disturbing vulnerabilities in tablets sold by education entertainment firm LeapFrog Enterprise Inc. that expose private data from its users: young children.

The vulnerabilities were found in the LeapPad Ultimate, a tablet pitched as being “kid-tough and kid-safe right out of the box.” It comes with content including “core skills in mathematics, reading and science as well as music, puzzles, logic and creativity to prepare kids for preschool and beyond.”

The vulnerabilities in the tablet start with the Pet Chat app that allows users — primarily children between three and six years old — to chat to other users of the device using their own pet avatars and some preset phrases and emoticons.

The device uses WiGLE to create ad-hoc Wi-Fi connections and in doing so exposes the data of the device to others. The researchers found it was possible to identify the possible location of LeapPads using Pet Chat by finding them on public Wi-Fi or tracking their device’s MAC address.

Furthermore, the Pet Chat protocol does not require any authentication between a parent’s device and a child’s device, meaning that any person within 100 feet of a Leapfrog device running Pet Chat can send a message to a child’s device. “It is easy to understand the potential implications of that type of activity,” the researchers note.

The lack of security and authentication, including a failure to encrypt data on the devices using HTTPS, opens the devices to “man in the middle” or eavesdropping attacks. Using Wii-Pumpkin, a rogue access-point framework that allows attackers to spoof an existing Wi-Fi network, the researchers could force LeapFrog devices to connect to a rogue network. In doing so, any data on the tablets was open to easy theft, including credit card details, parent information and information relating to the child as well.

The only positive in the story is that LeapPad, when contacted by Checkmarx prior to the publication of its findings, took several measures to secure the tablets. That said, the fact that it didn’t take basic security measures on a device for young kids in the first place is problematic.

“LeapPad devices that are older than three years may still have Pet Chat installed,” the researchers concluded. “Parents are advised to manually uninstall or refrain from using the application.”

Images: Checkmarx