SoylentNews

tonyPick writes:

Spotted at Hackernews is a link to this Context Information Security blog post on reverse engineering an IOT connected Furby toy:
Site may be down. Archive

With Christmas almost upon us and "pester season" in full swing, we thought it high time to have a prod at some of the connected toys that'll inevitably end up nestled beneath trees across the nation in just a few weeks time.

We've been working in collaboration with Which? to review the Furby Connect from Hasbro, which is currently priced at around £32.00, and comes with a smartphone app that offers to "connect you to a world of surprises."

The idea of Furbies being sold with companion apps is not a new one: the Furby Connect's predecessor, the Furby Boom, also featured an accompanying app, however communication between it and the Furby was accomplished by means of high-frequency audio. This time around, Hasbro have equipped the Furby Connect with a Bluetooth Low Energy (BLE) connection, allowing it to interface more reliably with its companion app - named "Furby Connect World"

The TL;DR is that security is not great:

This content is distributed in the form of proprietary DLC files, and seemed to contain new songs, dances, and actions for the Furby Connect to perform. If any new content is found, the associated DLC file is downloaded by the app, then pushed to the Furby Connect over its BLE connection
...
By sniffing the BLE connnection during one such DLC update, we immediately discovered that the security situation was bad. Right off the bat, none of the standard Bluetooth LE security features (e.g. authenticated pairing or link encryption) were in use by either the app or the Furby Connect. This meant that anyone within range of the communication could intercept unencrypted packets, inject their own content, or establish their own connection with the toy - all without any physical interaction required on the part of the user or the attacker.

The post then details hacking through the format of DLC files that are uploaded to the toy and generating custom audio and animations. The post contains a link to an example of the hacked toy in action, as well as response from Hasbro (the manufacturer).

Original HackerNews Thread.

Original Submission