21–29 of 29 posts
All it takes is a single goatse to appear on one child's furby's eyes or on a demo unit in a shop and the brand is ruined. I think they need to reconsider that response.
“Mooooom! Jane killed my furbie with an exploit!”
> A tremendous amount of engineering would be required to reverse engineer the product as well as to create new firmware.
Which implies they failed to understand what they were being told. The engineering required to do this exploit has already been done, so it doesn't matter how hard it is. Once it's been done, it's been done.
All it takes is a single goatse to appear on one child's furby's eyes or on a demo unit in a shop and the brand is ruined. I think they need to reconsider that response.
Even putting aside malicious use, which sounds hard, bricking the toy with a bad firmware patch sounds doable. “Mooooom! Jane killed my furbie with an exploit!”
Why don't they just enable basic Bluetooth security features instead of saying that it's too hard to exploit and leaving it at that? Excellent write-up though.
Are those features included in BLE? AFAIK it's a completely separate protocol than regular Bluetooth.
Earlier quoted context omitted.
Are those features included in BLE? AFAIK it's a completely separate protocol than regular Bluetooth.
BLE supports pairing and bonding. It is optional, by default every connection is unencrypted and unauthenticated.
Perhaps they could give away an optional tin-foil suit for furbies of owners who have security concerns!
Earlier quoted context omitted.
BLE supports pairing and bonding. It is optional, by default every connection is unencrypted and unauthenticated.
Pairing is a big paint point though AIUI, releasing this toy with the need to pair it first would probably have cost them significant numbers of returns. Not saying it's justified, but ... Perhaps they could give away an optional tin-foil suit for furbies of owners who have security concerns!
Though for the furby it shouldn't be too bad. Just display the pin on one of its eyes.
But it's always after midnight