8 ms·

The NSA Furby Documents

248 points by gumby 3y ago

itishappy 3y ago
Now I'm curious if there's any evidence of Furbies actually being used for espionage.
- bragr 3y ago
  Furbies just have a simple microcontroller and the code has been released [1]. It's a clever bit of code to give the impression of intelligence, but it doesn't have anything like the abilities in urban legends. You could put other hardware in them of course, they'd be prime targets for that kind of thing. [1] https://archive.org/details/furby-source/mode/2up https://archive.org/details/furby-source/mode/2up
  - wolverine876 3y ago
    > It's a clever bit of code to give the impression of intelligence AI hasn't changed.
  - masswerk 3y ago
    OMG, it's 6502 code! (Or for some variant of the 6502.) Marginally interesting, the source uses standard MOS assembler syntax, but Intel-like xxH notation for hex values, rather than $xx. --- [Edit] According to Wikipedia, actually a Sunplus SPC81A microcontroller using the 6502 instruction set, but lacking the Y register: > The first Furby model was based around a 6502-style Sunplus SPC81A microcontroller, which had 80 KiB of ROM and 128 bytes of RAM. Its core differed from the original 6502 in the lack of the Y index register. The TSP50C04 chip from Texas Instruments, implementing the linear predictive coding codec, was used for voice synthesis. https://en.wikipedia.org/wiki/Furby https://en.wikipedia.org/wiki/Furby
- rarely 3y ago
  it's certainly possible with a modified furby. there could have been a voice recorder placed inside, but that threat seems possible with other toys as well, maybe there was some opportunity due to the popularity of furbys. in terms of the furby's unmodified hardware capabilities, the microphone was simply used for volume level reaction. reading through the furby's firmware, the mic was used as a peak volume input.
- xsmasher 3y ago
  Probably better to hide your microphone in something that is more commonplace and doesn't already have a security hysteria around it.
refulgentis 3y ago
Context: Furbys were the toy for a year or two, and were actively marketed as learning from speech, had an active mic, and did adjust their speech based on what they heard, "learning" to speak English from Furbish. [^1] It's not so different from the fundamental fear of Alexa/Assistant/microphones that's fairly well diffused now. Except the Furby actively claimed to learn how to speak based on your speech, and had a built-in feedback loop to make it appear as such. In retrospect it looks like it more was "shift mix towards English based on how much you've heard" than "add words you heard to your speech patterns" [^1]: https://www.listenandlearn.org/blog/no-you-cant-teach-your-furby-to-swear-how-furbies-learn-language/ https://www.listenandlearn.org/blog/no-you-cant-teach-your-f...
- kube-system 3y ago
  Many voice assistants do record your voice and send those recordings elsewhere: e.g. https://www.amazon.com/gp/help/customer/display.html%3FnodeId%3DGHXNJNLTRWCTBBGW https://www.amazon.com/gp/help/customer/display.html%3FnodeI...
  - refulgentis 3y ago
    Absolutely. Is there a portion of my comment that indicated otherwise? I can still edit it for clarity (I thought that wasn't allowed after a reply occurred)
    - kube-system 3y ago
      I'm not arguing with you, just adding to the conversation. While the Furby was feared to be recording, but actually wasn't, voice assistants can be a real concern in that they actually do.
    - pvg 3y ago
      One of these fears is rational and based on things people know are in fact taking place. The other one is isn't, so drawing the parallel seems iffy. Maybe it's a little closer to the fear your phone is listening to you and that's how you get eerily targeted ads when browsing the web.
doublerabbit 3y ago
[flagged]
- deleted 3y ago
  [deleted]
swozey 3y ago
Whats gov policy around Alexas and like half the IOT market? My botvac even has a microphone. I'm sure it's "don't ever speak about outside of this room" sort of thing. I guess phone calls would be over a secure line. Are there secure cell phone towers/whatever? I'm curious how gov phones are hardened.
- alistairSH 3y ago
  In any SCIF or SCIF-like office space, they're all prohibited. You leave your cell phone at the front door of the secured area. Internet access is via SIPRNet (for classified) or NIPRNet (non-classified, but secured). Phones are through dedicated secure switchboards. The above is common in the DC area (lots of DoD contractors).
  - RajT88 3y ago
    My company infosec training actually advises you don't have voice assistants or cellphones in your work area. They even make light of it in the video: "I know it sounds crazy, but it's not". Google and Amazon as the biggest voice assistant makers are, of course, our competitors. But they are competitors to I would say most software companies in some fashion.
    - SnazzyJeff 3y ago
      Knowing what exploits are like in the private/state sector that seems like a no-brainer if your threat model includes a well-funded attacker.
    - ljf 3y ago
      We have been told that so many times at work, but I know most snr people seem to leave them and their smart watches in listen mode as they occasionally go off in video calls.
      - gumby 3y ago
        Once in a zoom call my watch said “sorry, I didn’t understand that”… and simultaneously the watch the other person on the call was wearing said the same thing!
Pwntastic 3y ago
The FOIA documents are up on archive.org now: https://archive.org/details/nsa-furby-memo/ https://archive.org/details/nsa-furby-memo/ I'm amused at page 8 of the listserve doc, in which someone points out that the ongoing discussion may at some point be released to the public under FOIA and to consider how it might look after showing up on the front page of a news site
- j-wags 3y ago
  It's interesting to see how quickly the norms around cybersecurity changed. In 1999 the NSA was worried about avoiding ridicule for banning simple electronics in secure areas. In 2010 Stuxnet was introduced via simple electronics into a secure area and set back the Iranian nuclear program by several years. Some of the people receiving these furby emails were probably already conceiving of (or actively working on) Stuxnet-like capabilities. Maybe a future FOIA request will reveal several teams quietly emailing up the org chart to absolutely not relax the rule for furbies.
  - wolverine876 3y ago
    NSA is a military agency; their norm has always been to protect US assets and attack others.
    - halJordan 3y ago
      The NSA is not a military agency. It is within the dod, it provides combat support. But it is emphatically not a military agency.
      - deleted 3y ago
        [deleted]
      - crmd 3y ago
        Emphatically? The director of the NSA is required to be a four star general and concurrently serves as commander of US Cyber Command. Ostensibly non-military, perhaps.
aerostable_slug 3y ago
Years ago, I used to see low quality sun-faded warnings printed from color inkjets about Furby on entries to NNSA secure spaces. I hadn't thought about that little fellow in the longest time... I'm guessing there are still a few taped up in various Labs at less-used portals.
genman 3y ago
[flagged]
- deleted 3y ago
  [deleted]
itomato 3y ago
Tell us more about these IRC channels responsive to FOIA request
n4jm4 3y ago
Analysis is fun, but any device with a microphone or camera represents a security risk for sensitive environments... Fropies.
cush 3y ago
Pretty sure this was a Simpsons episode
- px43 3y ago
  The Simpsons episode was referencing the media frenzy when this happened in 1999.
1oooqooq 3y ago
these are the caliber of the American praetorian guard who owns our politicians.
- CamperBob2 3y ago
  Eh, I don't see anything inappropriate in these documents. If they seem overly paranoid, it's because some major security breaches have historically involved silly things like this. Where do you draw the line between a Furby and a Casio SK-1 and a Teddy Ruxpin and a Minidisc recorder and any number of other stateful gadgets of the day, especially when the Furby is brand new and nobody really knows what's inside it? The NSA is an intelligence agency. The NSA doesn't want people bringing things in that might have the ability to exfiltrate voices or other signals, and in any event the NSA doesn't want random employees talking about it to the press. Where's the element of surprise here? I don't understand why it was even newsworthy in the first place. As for the intelligence agencies "owning our politicians," LOL. If there were the slightest truth to that, Trump's headstone would read "1946-2016."
  - HaZeust 3y ago
    > "If there were the slightest truth to that, Trump's headstone would read "1946-2016." You think if IC had their way, Trump would be in theirs? How so, lol?
nickaflip 3y ago
I used to like reading 404, but they need to chill out on posting articles about porn.
neilv 3y ago
Note that this was several years after performance artists (not even state-level actors) had demonstrated compromising toys retail supply chain with hacked firmware. https://www.mentalfloss.com/article/547659/barbie-liberation-organization-gi-joe-hacked https://www.mentalfloss.com/article/547659/barbie-liberation... So, look of concern at whomever thought it was a good idea to bring an effectively blackbox electronic device with a microphone into a secure area where those were prohibited. Kudos to whomever raised the issue. Someone should've done a proof of concept mod (firmware or hardware) of a Trojan Furby to appear (to visual and X-ray inspection) to have the stock hardware, but do something nefarious. Or shown how, say, the stock Furby hardware and firmware turned sound into RF leakage.
- Shawnj2 3y ago
  Yeah I don’t see why really any non approved electronic device wouldn’t immediately be treated as a tape recorder in a classified environment.
IAmLiterallyAB 3y ago
Fun fact: the 2016 model Furby uses an obscure ISA you've never heard of (and if you have, let me know!) called µnSP. I managed to get Pong running on a Furby a few years ago and by far the hardest part was figuring out that completely undocumented instruction set. Wrote added support for it to Ghidra which was a cool learning experience
- huppeldepup 3y ago
  is this documented somewhere?
  - IAmLiterallyAB 3y ago
    Which part, unSP? There is a PDF floating around the Internet called "unSP Programmer's Guide". Annoyingly didn't find that PDF until after I had already REed everything
moi2388 3y ago
Seems sensible. Even if the furbie by design weren’t spying, they definitely could have been used as such. No non-agency bought assets or assets which are not screened completely should never be in their offices. Toy or not. For the same reason you’d expect them to ban USB sticks within the premises
hulitu 3y ago
> Apparently, these stuffed critters learn from nearby speech patterns. That would definitely be a security concern." Haha. So Alexa, Siri and Google are not "security comcerns". Only the "stuffed critters". /s

248 points by gumby 3y ago

itishappy 3y ago

Now I'm curious if there's any evidence of Furbies actually being used for espionage.

bragr 3y ago
Furbies just have a simple microcontroller and the code has been released [1]. It's a clever bit of code to give the impression of intelligence, but it doesn't have anything like the abilities in urban legends. You could put other hardware in them of course, they'd be prime targets for that kind of thing. [1] https://archive.org/details/furby-source/mode/2up https://archive.org/details/furby-source/mode/2up
- wolverine876 3y ago
  > It's a clever bit of code to give the impression of intelligence AI hasn't changed.
- masswerk 3y ago
  OMG, it's 6502 code! (Or for some variant of the 6502.) Marginally interesting, the source uses standard MOS assembler syntax, but Intel-like xxH notation for hex values, rather than $xx. --- [Edit] According to Wikipedia, actually a Sunplus SPC81A microcontroller using the 6502 instruction set, but lacking the Y register: > The first Furby model was based around a 6502-style Sunplus SPC81A microcontroller, which had 80 KiB of ROM and 128 bytes of RAM. Its core differed from the original 6502 in the lack of the Y index register. The TSP50C04 chip from Texas Instruments, implementing the linear predictive coding codec, was used for voice synthesis. https://en.wikipedia.org/wiki/Furby https://en.wikipedia.org/wiki/Furby
rarely 3y ago
it's certainly possible with a modified furby. there could have been a voice recorder placed inside, but that threat seems possible with other toys as well, maybe there was some opportunity due to the popularity of furbys. in terms of the furby's unmodified hardware capabilities, the microphone was simply used for volume level reaction. reading through the furby's firmware, the mic was used as a peak volume input.
xsmasher 3y ago
Probably better to hide your microphone in something that is more commonplace and doesn't already have a security hysteria around it.

refulgentis 3y ago

Context: Furbys were the toy for a year or two, and were actively marketed as learning from speech, had an active mic, and did adjust their speech based on what they heard, "learning" to speak English from Furbish. [^1] It's not so different from the fundamental fear of Alexa/Assistant/microphones that's fairly well diffused now. Except the Furby actively claimed to learn how to speak based on your speech, and had a built-in feedback loop to make it appear as such. In retrospect it looks like it more was "shift mix towards English based on how much you've heard" than "add words you heard to your speech patterns" [^1]: https://www.listenandlearn.org/blog/no-you-cant-teach-your-furby-to-swear-how-furbies-learn-language/ https://www.listenandlearn.org/blog/no-you-cant-teach-your-f...

kube-system 3y ago
Many voice assistants do record your voice and send those recordings elsewhere: e.g. https://www.amazon.com/gp/help/customer/display.html%3FnodeId%3DGHXNJNLTRWCTBBGW https://www.amazon.com/gp/help/customer/display.html%3FnodeI...
- refulgentis 3y ago
  Absolutely. Is there a portion of my comment that indicated otherwise? I can still edit it for clarity (I thought that wasn't allowed after a reply occurred)
  - kube-system 3y ago
    I'm not arguing with you, just adding to the conversation. While the Furby was feared to be recording, but actually wasn't, voice assistants can be a real concern in that they actually do.
  - pvg 3y ago
    One of these fears is rational and based on things people know are in fact taking place. The other one is isn't, so drawing the parallel seems iffy. Maybe it's a little closer to the fear your phone is listening to you and that's how you get eerily targeted ads when browsing the web.

doublerabbit 3y ago

[flagged]

deleted 3y ago
[deleted]

swozey 3y ago

Whats gov policy around Alexas and like half the IOT market? My botvac even has a microphone. I'm sure it's "don't ever speak about outside of this room" sort of thing. I guess phone calls would be over a secure line. Are there secure cell phone towers/whatever? I'm curious how gov phones are hardened.

alistairSH 3y ago
In any SCIF or SCIF-like office space, they're all prohibited. You leave your cell phone at the front door of the secured area. Internet access is via SIPRNet (for classified) or NIPRNet (non-classified, but secured). Phones are through dedicated secure switchboards. The above is common in the DC area (lots of DoD contractors).
- RajT88 3y ago
  My company infosec training actually advises you don't have voice assistants or cellphones in your work area. They even make light of it in the video: "I know it sounds crazy, but it's not". Google and Amazon as the biggest voice assistant makers are, of course, our competitors. But they are competitors to I would say most software companies in some fashion.
  - SnazzyJeff 3y ago
    Knowing what exploits are like in the private/state sector that seems like a no-brainer if your threat model includes a well-funded attacker.
  - ljf 3y ago
    We have been told that so many times at work, but I know most snr people seem to leave them and their smart watches in listen mode as they occasionally go off in video calls.
    - gumby 3y ago
      Once in a zoom call my watch said “sorry, I didn’t understand that”… and simultaneously the watch the other person on the call was wearing said the same thing!

Pwntastic 3y ago

The FOIA documents are up on archive.org now: https://archive.org/details/nsa-furby-memo/ https://archive.org/details/nsa-furby-memo/ I'm amused at page 8 of the listserve doc, in which someone points out that the ongoing discussion may at some point be released to the public under FOIA and to consider how it might look after showing up on the front page of a news site

j-wags 3y ago
It's interesting to see how quickly the norms around cybersecurity changed. In 1999 the NSA was worried about avoiding ridicule for banning simple electronics in secure areas. In 2010 Stuxnet was introduced via simple electronics into a secure area and set back the Iranian nuclear program by several years. Some of the people receiving these furby emails were probably already conceiving of (or actively working on) Stuxnet-like capabilities. Maybe a future FOIA request will reveal several teams quietly emailing up the org chart to absolutely not relax the rule for furbies.
- wolverine876 3y ago
  NSA is a military agency; their norm has always been to protect US assets and attack others.
  - halJordan 3y ago
    The NSA is not a military agency. It is within the dod, it provides combat support. But it is emphatically not a military agency.
    - deleted 3y ago
      [deleted]
    - crmd 3y ago
      Emphatically? The director of the NSA is required to be a four star general and concurrently serves as commander of US Cyber Command. Ostensibly non-military, perhaps.

aerostable_slug 3y ago

Years ago, I used to see low quality sun-faded warnings printed from color inkjets about Furby on entries to NNSA secure spaces. I hadn't thought about that little fellow in the longest time... I'm guessing there are still a few taped up in various Labs at less-used portals.

genman 3y ago

[flagged]

deleted 3y ago
[deleted]

itomato 3y ago

Tell us more about these IRC channels responsive to FOIA request

n4jm4 3y ago

Analysis is fun, but any device with a microphone or camera represents a security risk for sensitive environments... Fropies.

cush 3y ago

Pretty sure this was a Simpsons episode

px43 3y ago
The Simpsons episode was referencing the media frenzy when this happened in 1999.

1oooqooq 3y ago

these are the caliber of the American praetorian guard who owns our politicians.

CamperBob2 3y ago
Eh, I don't see anything inappropriate in these documents. If they seem overly paranoid, it's because some major security breaches have historically involved silly things like this. Where do you draw the line between a Furby and a Casio SK-1 and a Teddy Ruxpin and a Minidisc recorder and any number of other stateful gadgets of the day, especially when the Furby is brand new and nobody really knows what's inside it? The NSA is an intelligence agency. The NSA doesn't want people bringing things in that might have the ability to exfiltrate voices or other signals, and in any event the NSA doesn't want random employees talking about it to the press. Where's the element of surprise here? I don't understand why it was even newsworthy in the first place. As for the intelligence agencies "owning our politicians," LOL. If there were the slightest truth to that, Trump's headstone would read "1946-2016."
- HaZeust 3y ago
  > "If there were the slightest truth to that, Trump's headstone would read "1946-2016." You think if IC had their way, Trump would be in theirs? How so, lol?

nickaflip 3y ago

I used to like reading 404, but they need to chill out on posting articles about porn.

neilv 3y ago

Note that this was several years after performance artists (not even state-level actors) had demonstrated compromising toys retail supply chain with hacked firmware. https://www.mentalfloss.com/article/547659/barbie-liberation-organization-gi-joe-hacked https://www.mentalfloss.com/article/547659/barbie-liberation... So, look of concern at whomever thought it was a good idea to bring an effectively blackbox electronic device with a microphone into a secure area where those were prohibited. Kudos to whomever raised the issue. Someone should've done a proof of concept mod (firmware or hardware) of a Trojan Furby to appear (to visual and X-ray inspection) to have the stock hardware, but do something nefarious. Or shown how, say, the stock Furby hardware and firmware turned sound into RF leakage.

Shawnj2 3y ago
Yeah I don’t see why really any non approved electronic device wouldn’t immediately be treated as a tape recorder in a classified environment.

IAmLiterallyAB 3y ago

Fun fact: the 2016 model Furby uses an obscure ISA you've never heard of (and if you have, let me know!) called µnSP. I managed to get Pong running on a Furby a few years ago and by far the hardest part was figuring out that completely undocumented instruction set. Wrote added support for it to Ghidra which was a cool learning experience

huppeldepup 3y ago
is this documented somewhere?
- IAmLiterallyAB 3y ago
  Which part, unSP? There is a PDF floating around the Internet called "unSP Programmer's Guide". Annoyingly didn't find that PDF until after I had already REed everything

moi2388 3y ago

Seems sensible. Even if the furbie by design weren’t spying, they definitely could have been used as such. No non-agency bought assets or assets which are not screened completely should never be in their offices. Toy or not. For the same reason you’d expect them to ban USB sticks within the premises

hulitu 3y ago

> Apparently, these stuffed critters learn from nearby speech patterns. That would definitely be a security concern." Haha. So Alexa, Siri and Google are not "security comcerns". Only the "stuffed critters". /s