Children’s tablet has malware and exposes children’s data, researcher finds

This May year, Alexis Hancock’s daughter got a children’s tablet for her birthday. Being a security researcher, Hancock was immediately concerned.

“I kind of looked at it sideways because I’ve never heard of Dragon Touch,” Hancock told TechCrunch, referring to the tablet maker.

As it turns out, Hancock, who works at the Electronic Frontier Foundation, had good reason to be concerned. Hancock said she found the tablet had several security and privacy issues that could have compromised her daughter’s and other children’s data.

The Dragon Touch KidzPad Y88X contains traces of well-known malware, runs a version of Android released five years ago, comes pre-installed with other software considered malware, and a “potentially unwanted program” due to “its history and extensive system-level permissions to download any app they want’ and includes an old version of an app store designed specifically for children, according to Hancock’s reportwhich was released on Thursday and was seen by TechCrunch ahead of its publication.

Hancock said she contacted Dragon Touch to report these issues, but the company never responded. Dragon Touch did not respond to TechCrunch’s questions either.

The first disturbing thing Hancock said she found on the tablet was traces of the presence of Corejava, which in January the cybersecurity firm Malwarebytes analyzed and concluded that it was malicious. Also this year, the Electronic Frontier Foundation and independent security researchers discovered the same type of malware embedded in the software of cheap Android TVs. The good news, Hancock said, is that at least the malware appeared to be inactive and programmed to send data to idle servers.

According to Hancock’s technical reportthe tablet also came pre-loaded with Adups – the same software found on these Android TVs – which is used to perform “over-the-air” firmware updates. Malwarebytes has classified Adups as malware and a “potentially unwanted program” for its ability to automatically download and install new malware from the Internet.

Finally, the tablet came with a pre-installed and outdated version of the KIDOZ app, which acts as an app store that allows parents to set parental controls and kids to download games and apps. The app store “collects and sends data to ‘kidoz.net’ about the usage and physical characteristics of the device. This includes information such as device model, brand, country, time zone, screen size, view events, click events, event log time and a unique KID identifier,” according to Hancock’s report.

KIDOZ founder Eldad Ben Tora told TechCrunch that the app is certified to comply with COPPA, the US federal law that provides certain online privacy protections for children, and that the app “went through a rigorous review process by an approved the FTC’s COPPA safe harbor program called PRIVO, which included a thorough review of our data collection, storage and use practices.”

“This process ensures that our services are fully compliant with COPPA requirements, prioritizing children’s privacy,” Ben Tora told TechCrunch.

The Dragon Touch tablet reviewed by Hancock was for sale on Amazon until this week, when the listing was dropped and replaced by a listing for the same tablet, which claims the tablet runs Android 12, which was released in 2021. Images at The listing, however, says the tablet runs Android 10, which was released in 2019.

It’s unclear how popular these tablets are, but Amazon listings showed more than 1,000 reviews.

Amazon spokesman Adam Montgomery told TechCrunch in an email that the company is “looking into these allegations and will take appropriate action if necessary.”

The Dragon Touch tablet was also available at Walmart until this week. After TechCrunch contacted the company, Walmart removed the listing from its website.

“We have removed this third-party item from our site while Trust and Safety conducts a review,” Walmart spokesman John Forrest Ales said in an email. “Like other major online retailers, we operate an online marketplace that allows external third-party sellers to offer merchandise to customers through our e-commerce platform. We expect this data to be secure, reliable and compliant with our standards and all legal requirements. Items determined not to meet these standards or requirements will be immediately removed from the site and will remain blocked.”

Dragon Touch is they are listed on the official Android website as a “certified” device that has been “tested for safety and performance”.

Google spokesman Ed Fernandez told TechCrunch via email that the company was “thoroughly evaluating the allegations in this report to determine whether the manufacturer’s device meets the security standards required to Play Protect certification.”

Internet-connected products for children have long been the target of hackers. In 2015, a hacker broke into VTech’s servers, a consumer electronics company that made gadgets for children. The hack resulted in the theft of nearly five million parents’ personal information, including names, email addresses, passwords and home addresses, as well as more than 200,000 children’s personal details, including names, genders and birthdays. The hacker also acquired thousands of photos of parents and children and one year’s worth of chat logs.

After completing her investigation, Hancock said she had to keep the tablet because her daughter became attached to it during a trip with her cousins. But Hancock did not return the tablet to her daughter until after making changes to protect her daughter’s privacy.

“I have spoken to her about why I had her tablet and why I had it away from her for so long. I told her it was sick, it had a virus and I needed to get it better and I needed to take it to the doctor,” Hancock said.

In practice, Hancock said he “bared as much as he could.”

First, Hancock said she installed a VPN profile on the tablet on a private server running Pi-hole, an ad blocking software. She then limited the number of apps her daughter could use. redirected DNS — the internet system that maps IP addresses to domain names, for “any problematic domain” and even installed Tor, a browser designed to protect its user’s anonymity.

Hancock, however, said parents don’t have to do all that to protect their kids’ privacy, especially since not everyone has the technical help or time to research their kids’ tablet cybersecurity and privacy issues.

“Parents really can’t do much,” she said. “And frankly, it shouldn’t be left up to them.”