Don't Feed Them After Midnight: Reverse-Engineering the Furby Connect
contextis.com
contextis.com
It also seems like it would be rather trivial to mitigate this issue in an update, either by securing the BLE connection or by signing and verifying update payloads (or preferably both).
“Mooooom! Jane killed my furbie with an exploit!”
Both of these are problems for some parents.
Excellent write-up though.
It would only be done if the press started publishing clickbait involving "THIS TOY IS WATCHING YOUR CHILDREN!!" as most IoT security not done by the top companies is entirely reactive.
Just a guess though. Never worked for Hasbo.
Perhaps they could give away an optional tin-foil suit for furbies of owners who have security concerns!
Though for the furby it shouldn't be too bad. Just display the pin on one of its eyes.
> A tremendous amount of engineering would be required to reverse engineer the product as well as to create new firmware.
Which implies they failed to understand what they were being told. The engineering required to do this exploit has already been done, so it doesn't matter how hard it is. Once it's been done, it's been done.