Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Don't Feed Them After Midnight: Reverse-Engineering the Furby Connect

contextis.com

Post reply on HN
Print view View original

11–20 of 29 posts

Re: Don't Feed Them After Midnight: Reverse-Engineering the Furby Connect

#12

Post by cjsuk »

_wmd wrote: post #9
cjsuk wrote: post #7

All it takes is a single goatse to appear on one child's furby's eyes or on a demo unit in a shop and the brand is ruined. I think they need to reconsider that response.

Perhaps you're unaware that an earlier edition of this product had a bug that made the device randomly speak with a terrifying satanic voice. My niece experienced it first hand

I had no idea about that!

Re: Don't Feed Them After Midnight: Reverse-Engineering the Furby Connect

#13

Post by simias »

cjsuk wrote: post #7

All it takes is a single goatse to appear on one child's furby's eyes or on a demo unit in a shop and the brand is ruined. I think they need to reconsider that response.

I agree, especially now that there's a rather comprehensive documentation available online clearly it doesn't require a "tremendous amount of engineering" to hack the device anymore.

It also seems like it would be rather trivial to mitigate this issue in an update, either by securing the BLE connection or by signing and verifying update payloads (or preferably both).

Re: Don't Feed Them After Midnight: Reverse-Engineering the Furby Connect

#14

Post by dmitrygr »

bpicolo wrote: post #8
Nullabillity wrote: post #4

Earlier quoted context omitted.

Why? As long as it doesn't have a microphone/camera then this sounds like a positive.

And they don't collect any sort of personal data. Hasbro did a pretty solid job here minimizing risk surface area.

Bluetooth LE range is easily magnified with a cantenna. The device will play audio sent to it over an unencrypted unauthenticated link to your kids. Also it will show videos sent over the same link (but they must be small because eyes are small)

Both of these are problems for some parents.

Re: Don't Feed Them After Midnight: Reverse-Engineering the Furby Connect

#15

Post by NikolaeVarius »

_wmd wrote: post #9
cjsuk wrote: post #7

All it takes is a single goatse to appear on one child's furby's eyes or on a demo unit in a shop and the brand is ruined. I think they need to reconsider that response.

Perhaps you're unaware that an earlier edition of this product had a bug that made the device randomly speak with a terrifying satanic voice. My niece experienced it first hand

Not a bug. Working as intended.

Re: Don't Feed Them After Midnight: Reverse-Engineering the Furby Connect

#17

Post by DKnoll »

_wmd wrote: post #9
cjsuk wrote: post #7

All it takes is a single goatse to appear on one child's furby's eyes or on a demo unit in a shop and the brand is ruined. I think they need to reconsider that response.

Perhaps you're unaware that an earlier edition of this product had a bug that made the device randomly speak with a terrifying satanic voice. My niece experienced it first hand

I had one when I was a kid. Hilariously it did the satanic voice after I threw it against a wall. Didn't do that again.

Re: Don't Feed Them After Midnight: Reverse-Engineering the Furby Connect

#19

Post by bonzini »

libeclipse wrote: post #6

Why don't they just enable basic Bluetooth security features instead of saying that it's too hard to exploit and leaving it at that? Excellent write-up though.

Are those features included in BLE? AFAIK it's a completely separate protocol than regular Bluetooth.
Post reply on HN