SoylentNews is people
SoylentNews
Spotted at Hackernews is a link to this Context Information Security blog post on reverse engineering an IOT connected Furby toy:
Site may be down. Archive
With Christmas almost upon us and "pester season" in full swing, we thought it high time to have a prod at some of the connected toys that'll inevitably end up nestled beneath trees across the nation in just a few weeks time.
We've been working in collaboration with Which? to review the Furby Connect from Hasbro, which is currently priced at around £32.00, and comes with a smartphone app that offers to "connect you to a world of surprises."
The idea of Furbies being sold with companion apps is not a new one: the Furby Connect's predecessor, the Furby Boom, also featured an accompanying app, however communication between it and the Furby was accomplished by means of high-frequency audio. This time around, Hasbro have equipped the Furby Connect with a Bluetooth Low Energy (BLE) connection, allowing it to interface more reliably with its companion app - named "Furby Connect World"
The TL;DR is that security is not great:
This content is distributed in the form of proprietary DLC files, and seemed to contain new songs, dances, and actions for the Furby Connect to perform. If any new content is found, the associated DLC file is downloaded by the app, then pushed to the Furby Connect over its BLE connection
...
By sniffing the BLE connnection during one such DLC update, we immediately discovered that the security situation was bad. Right off the bat, none of the standard Bluetooth LE security features (e.g. authenticated pairing or link encryption) were in use by either the app or the Furby Connect. This meant that anyone within range of the communication could intercept unencrypted packets, inject their own content, or establish their own connection with the toy - all without any physical interaction required on the part of the user or the attacker.
The post then details hacking through the format of DLC files that are uploaded to the toy and generating custom audio and animations. The post contains a link to an example of the hacked toy in action, as well as response from Hasbro (the manufacturer).
(Score: 0) by Anonymous Coward on Sunday November 26 2017, @04:09AM (3 children)
It gets a tad tiring.
I wonder if this is universal, or if software/IoT/&c is just uncommonly awful.
(Score: 4, Insightful) by jmorris on Sunday November 26 2017, @05:44AM (2 children)
IoT and toys are made by people who don't understand tech, don't care and don't want to know. In this case they just wanna make a cheap disposable toy, not an Internet connected computing product. But of course that is exactly what they end up making because the suits upstairs want box on buzzword bingo. Throw them buggy reference implementations they can barely comprehend to morons that make Visual Basic code monkeys look skilled, let them wrestle with an embedded dev kit until something sorta works and you get what we see. The security isn't defective, it is non-existent because the morons haven't even considered the need for it and wouldn't know how to do it if their lives depended upon it. And nobody will care, because while a Furby CAN be hacked, 99.99% won't and that is all that matters. Nobody is going to be killed by their Furby, nobody will get sued, nobody will be fired.
Yet the accumulating weight of all this defective crap piles ever higher. Eventually somebody WILL get killed. Probably even before the steaming piles of kludged crap calling themselves self driving cars get hacked in mass and cause a disaster of biblical proportion one fine rush hour.
(Score: 1) by Ethanol-fueled on Sunday November 26 2017, @05:55AM
Which reminds me, I need to hack a Teddy Ruxpin tape to recite Mein Kamp or sing death-metal.
(Score: 2) by PartTimeZombie on Monday November 27 2017, @12:09AM
While your point is certainly true, I suspect that 99.99% of Furbys won't be hacked because they will be lying under some kid's bed with flat batteries after 20 minutes of "play".
They just look like a cheap disposable toy as you say, and so they will be disposed of by their owners.