7 ms·
Don't Feed Them After Midnight: Reverse-Engineering the Furby Connect
- dmitrygr 9y agoCompany response is so typical, it hurts to read.
- Nullabillity 9y agoWhy? As long as it doesn't have a microphone/camera then this sounds like a positive.
- bpicolo 9y agoAnd they don't collect any sort of personal data. Hasbro did a pretty solid job here minimizing risk surface area.
- dmitrygr 9y agoBluetooth LE range is easily magnified with a cantenna. The device will play audio sent to it over an unencrypted unauthenticated link to your kids. Also it will show videos sent over the same link (but they must be small because eyes are small) Both of these are problems for some parents.
- rfrey 9y agoCompany response is "Yeah, that's way too hard, nobody can do that".
- barry0079 9y ago"while the FURBY CONNECT toy is in a "woke" state" I couldn't help but chuckle at this.
- libeclipse 9y agowoke asf
- libeclipse 9y agoWhy don't they just enable basic Bluetooth security features instead of saying that it's too hard to exploit and leaving it at that? Excellent write-up though.
- rhexs 9y agoBecause they probably paid some contractor to design it and requesting this as an update would be expensive. Most likely some director doesn't think it's worth the money. Furthermore, the security team / one random guy who is now told to handle security duties after they got that e-mail most likely has an IT background and thinks reverse engineering embedded systems is impossibly difficult. It would only be done if the press started publishing clickbait involving "THIS TOY IS WATCHING YOUR CHILDREN!!" as most IoT security not done by the top companies is entirely reactive. Just a guess though. Never worked for Hasbo.
- bonzini 9y agoAre those features included in BLE? AFAIK it's a completely separate protocol than regular Bluetooth.
- tokenizerrr 9y agoBLE supports pairing and bonding. It is optional, by default every connection is unencrypted and unauthenticated.
- pbhjpbhj 9y agoPairing is a big paint point though AIUI, releasing this toy with the need to pair it first would probably have cost them significant numbers of returns. Not saying it's justified, but ... Perhaps they could give away an optional tin-foil suit for furbies of owners who have security concerns!
- tokenizerrr 9y agoOh yeah, totally. BLE support on both android and iOS is lacking. Older versions of android, and I believe all versions of iOS (please correct me if I'm wrong) do not offer a programmatic way of supplying the pin for pairing. This means that when you programmatically connect to a BLE device from an app, the user will get a pin prompt. This prompt covers most of the screen so it really is a pain. Though for the furby it shouldn't be too bad. Just display the pin on one of its eyes.
- cjsuk 9y agoAll it takes is a single goatse to appear on one child's furby's eyes or on a demo unit in a shop and the brand is ruined. I think they need to reconsider that response.
- _wmd 9y agoPerhaps you're unaware that an earlier edition of this product had a bug that made the device randomly speak with a terrifying satanic voice. My niece experienced it first hand
- cjsuk 9y agoI had no idea about that!
- NikolaeVarius 9y agoNot a bug. Working as intended.
- DKnoll 9y agoI had one when I was a kid. Hilariously it did the satanic voice after I threw it against a wall. Didn't do that again.
- simias 9y agoI agree, especially now that there's a rather comprehensive documentation available online clearly it doesn't require a "tremendous amount of engineering" to hack the device anymore. It also seems like it would be rather trivial to mitigate this issue in an update, either by securing the BLE connection or by signing and verifying update payloads (or preferably both).
- QAPereo 9y agoEven putting aside malicious use, which sounds hard, bricking the toy with a bad firmware patch sounds doable. “Mooooom! Jane killed my furbie with an exploit!”
- 9y ago
- deleted 9y ago[deleted]
- beilabs 9y agoThis could be the perfect thing to announce a failing code build.....begone old traffic light systems, Jenkins + Furby could be a thing of beauty.
- SweetBuddha 9y agoI believe they ought to reevaluate that reaction.
- AdamJacobMuller 9y agoSite is down for me. archive.org works: http://web.archive.org/web/20171124170013/https://www.contextis.com/blog/dont-feed-them-after-midnight-reverse-engineering-the-furby-connect http://web.archive.org/web/20171124170013/https://www.contex...
- jstanley 9y agoThe company response stated: > A tremendous amount of engineering would be required to reverse engineer the product as well as to create new firmware. Which implies they failed to understand what they were being told. The engineering required to do this exploit has already been done, so it doesn't matter how hard it is. Once it's been done, it's been done.
- strictnein 9y agoBut it's always after midnight
- coderdude 9y agoI never thought about that when I watched the movie. Technically the rule is that you were never allowed to feed the mogwai. He didn't specify a time range that was safe.