Security researchers can be a grim crowd. Everything, when looked at closely enough, is insecure at some level, and this leads to a lot of pessimism in the industry. So it’s a bit of a shock to see a security report that’s filled with neither doom nor gloom.
We’d previously covered Somerset Recon’s initial teardown of “Hello Barbie” and were waiting with bated breath for the firmware dump and some real reverse engineering. Well, it happened and basically everything looks alright (PDF report). The Somerset folks desoldered the chip, dumped the flash ROM, and when the IDA-dust settled, Mattel used firmware that’s similar to what everyone else uses to run Amazon cloud service agents, but aimed at the “toytalk.com” network instead. In short, it uses a tested and basically sound firmware.
The web services that the creepy talking doll connected to were another story, and were full of holes that were being actively patched throughout Somerset’s investigation, but we were only really interested in the firmware anyway, and that looked OK. Not everything is horror stories in IoT security. Some stories do have a happy ending. Barbie can sleep well tonight.
In February, Google and Mattel introduced their Hello Barbie Internet-connected toy. This Barbie has an internal microphone, a WiFi connection to Google’s voice recognition services, and a speaker to carry on a “conversation” with the targeted child.
Like the folks at Somerset Recon, we’d say that this is an Internet of Things (IoT) device that’s just begging for a teardown, and we’re totally looking forward to their next installment when they pore through the firmware.
On the hardware front, Barbie looks exactly like what you’d expect on the inside. A Marvell 88MW300 WiFi SoC talks to a 24-bit (!) audio codec chip, and runs code from a 16Mbit flash ROM. There’s some battery management, and what totally looks like a JTAG port. There’s not much else, because all the brains are “in the cloud” as you kids say these days.
From day to day we alternate between the promise of IoT and being anti-IoT curmudgeons, so it should come as no surprise that we’re of two minds about Hello Barbie. First, there’s the creepy-factor of having your child’s every word overheard by a faceless corporation with “evil” in their mission statement (see what we did there?). Next, we’re not sure that it’s OK to record everything your child says to a toy and listen to it later, even if you are the parent. Hackaday’s [Sarah Petkus] summarized this neatly in this article.
But mostly, we’re curious about how well the thing actually works and what it will do with naughty words. And who will take on the task of reviving the Barbie Liberation Organization? Now we totally want to go out and buy one of these things.
[Ken] was strolling through a department store one day looking for a gift for his daughter when he stumbled across a Mattel’s Hot Wheels Radar Gun for $30. He purchased it, took it home, and tested it out. Surprisingly, the device had the ability to not only scan toy cars, but also regular size vehicles, spinning bicycle wheels, and joggers as well. As his mind began to churn coming up with new ideas, he purchased another toy and repackaged it creating a more professional grade DIY radar speed detector.
The process was pretty simple. First, he disassembled the device getting to the Doppler radar system inside, which was similar to the professional radar guns that police officers used. This toy was able to transmit a continuous wave at 10.525GHz, measuring the returning frequency of returning waves that bounced off of moving objects. However, the detection range of this toy was severely limited. [Ken] then upgraded the antenna housing unit with a 3″ diameter acrylic document tube, making the quality look a lot better. After that, the system was attached to a tripod allowing for the device to be easily transported and setup near a busy traffic road, quietly watching the speed of cars driving by.
Continue reading “Hot Wheels Toy Turned Radar Gun”
Master EEG hackers [MOG] and [Tim] over at the Makers Local 256 have been working on creating a Bluetooth EEG listener made from a Mattel Mindflex. This build is based on an earlier build of a group called [Frontier Nerds] (thanks for the heads up [Nathan]!), but this version ditches the Arduino in favor of a basic serial to bluetooth adapter for the sake of power efficiency (as well as not having to keep an Arduino strapped to you head). We have covered a few Mindflex hacks before, but this seems to be the most useful in a practical sense. They have included the code for a Bluetooth serial data logger, and the earlier build shows a good example of captured data visualization.
Maybe we’re just imagining things, but it seems to us like brainwave control is the latest trend in toys. Similar to Uncle Milton’s Force Trainer, Mattel has recently released the MindFlex, a game that involves moving a plastic ball up and down through an obstacle course that you control using your brainwaves. Naturally when [Alpha] saw this, he decided to take it apart and document what he found. After disassembling both the headset and the base, he found that most of the chips were covered in black resin making them unidentifiable. However, he was able to find identify one chip, the NeuroSky TGAT1-L64 D498Q-010 0924. Judging by the name alone, we would guess that this is the chip that makes the brainwave control possible. While there’s no mention as to whether you’ll be able to interface with this like you can with the Force Trainer, we’re sure that it’s only a matter of time before someone figures out how to use this to control more than just a floating plastic ball.
Vacuum formers are still fairly rare in our community, so it was a surprise to see that in the 1960s Mattel marketed one as a toy. It used a hot plate to mold plastic sheets into various shapes. The design was updated by Toymax in the early ’90s to use a light bulb heating element to make car bodies, like some sort of manly Easy-Bake Oven. The home-built machines we’ve seen are a much larger scale. In 2005, we posted [Ralis Kahn]’s version that employed an electric grill as the heating element. [drcrash] has since built on those plans, hoping to develop an even cheaper device.