Security researchers can be a grim crowd. Everything, when looked at closely enough, is insecure at some level, and this leads to a lot of pessimism in the industry. So it’s a bit of a shock to see a security report that’s filled with neither doom nor gloom.
We’d previously covered Somerset Recon’s initial teardown of “Hello Barbie” and were waiting with bated breath for the firmware dump and some real reverse engineering. Well, it happened and basically everything looks alright (PDF report). The Somerset folks desoldered the chip, dumped the flash ROM, and when the IDA-dust settled, Mattel used firmware that’s similar to what everyone else uses to run Amazon cloud service agents, but aimed at the “toytalk.com” network instead. In short, it uses a tested and basically sound firmware.
The web services that the creepy talking doll connected to were another story, and were full of holes that were being actively patched throughout Somerset’s investigation, but we were only really interested in the firmware anyway, and that looked OK. Not everything is horror stories in IoT security. Some stories do have a happy ending. Barbie can sleep well tonight.
well as long as you were only interested in the firmware then that’s fine.
but the internet part is a nightmare?
so it is an IoT nightmare then
its just not an ‘T’ nightmare.
The Internet part _is/was_ a bit of a nightmare, but that’s patchable just about as fast as the bugs are discovered by the folks who run the servers. A bazillion dolls (or other “Things”) that are difficult to patch once they’re in the wild would have been much worse.
So yeah, qualified win! Even their web-side woes were nothing compared with the V-Tech hack: http://motherboard.vice.com/read/one-of-the-largest-hacks-yet-exposes-data-on-hundreds-of-thousands-of-kids
I got a completely different takeaway from the PDF on the firmware. IMO they found quite a number of security issues as a result of relatively little investigation.
I was initially under the impression that the audio files for the Barbie to talk were all locally stored in ROM, so hijacking it for ads would have been impossible. That might not be the case, though.
Having access to the NDA’d datasheets for the wifi module and SDK I basically expected most of what they found. Hint JTAG doesn’t work because it’s disabled via the security setting in the SoC and it’s in OTP memory so enabling again might be a bit of a problem.
A networked talking doll is a nightmare all on its own regardless of the degree of security.
Thank you for pointing that out – it’s amazing that (almost) everybody else around here seems to be ok with it…
Get a scary letter from their lawyers did you?
It’s not a nightmare if you think it’s OK to give Mattel access to everything your kid says.
I can pretty much guarantee there is a MITM attack vector even if it’s a sketchy memory corruption like use-after-free or race-condition.. There is nothing to gain from attacking this toy though..
“here’s your problem, pally; you had its mode switch set to EVIL. there, I switched it back for you.”
I’ve never looked beyond the Milky Way, but trust me there aren’t advanced organisms anywhere else in the universe..
I wouldn’t consider an attack vector to an inside network “nothing.”
If they’re doing MITM they are already on your subnet or have root on the “cloud” server(s) or it’s DNS.. The app and the toy don’t do direct communications..
If you have access to the cloud you don’t need code execution vulnerabilities.. If you get code execution on the doll you can only use it to attack other stuff or as a zombie it has no valuable data. The App is the only thing that can be more than a zombie..
MITM can occur *anywhere* between the server and the doll.
And yes, using the doll as a vector to hack *other* devices on it’s *local* net is the exact attack vector that is the problem.
Lol this argument is hilarious.. It’s a toy the average kid in the demographic it’s intended will keep two-years tops average and have a decent probability of being put in an enclosure that causes RF distortion. On top of the statistics of world-market which all together make it an idiotic investment for any botnet owner.
It can be used by sexual predators to hack IP cams behind a NAT.. I guess. In the case they have root on the cloud, or a hop and just wait for barbie connections in which case they gain nothing but small compute-power and IP by rooting the toy..
You don’t know the economics and psychology of criminals. It’d cost them a lot to implement support for their botnets for these narrow-capability toys that likely won’t last a year in a child’s hands.. There is no data there that has a market..
This is actually still a very real danger. Kids pick up a lot; often more than the parents know…sometimes directly from the parents with the assumption that the kids won’t understand. A little girl tells her doll that she saw daddy kissing a woman other than mommy…daddy happens to be a big shot at the DOD or Intel or something. The blackhat that grabs the data auctions it off to the highest bidder, and now China or NK is blackmailing daddy. It would seem that the *current* firmware doesn’t record unless the button is activated. If we assume that this remains true, and that the button never sticks, so the doll always works exactly as designed, the intended function of the hardware is still to collect data and store it in a closed-source cloud. Just the fact that there is no way to wipe the cloud record for a particular doll is very scary; would you use a browser that uploaded your browsing history to never be deleted, not even manually? Just the possibility is enough to keep me away from the google version of chromium (that, and the terrible performance).
While there are plenty of people for whom breaking in and grabbing the video teddy would be simple, there are also plenty who would never even consider such an act, but who wouldn’t mind cracking a cloud. What really matters is how the data is stored (and we know it is; they actually advertise that fact). We know the security can’t be very good, because they released the toy before fixing known security holes. We know it can’t be very good because no one who considered security a priority would ever make the doll in the first place. We know it can’t be very good because Matel has to be able to answer to secret government requests for monitoring of people who haven’t been charged with any crime. And we know it can’t be proven to be good because it is closed source. If you could bet $5,000 that a site would not be successfully hacked in the next 20 years, and you could select any site that you wanted, you would be a fool to take the bet and you would be a sucker to take the bet with a closed-source site owned by a toy company. That is basically what we are talking about…a bet that you can only hope to not lose, with potential blackmail costing far more than $5,000.
Nah.
Let’s be fair … Daddy might be a philanderer, but Mommy’s probably got classified emails on her home server. ;-)
There is an even worse possibility to consider. This didn’t grew on my pile of manure, I think it was John Oliver who brought it up, even though I cannot find any reference for it at the moment:
What if a kid is being abused and confides in their doll? As the manufacturer of such a thing: How do you pull that one out of your database of requests? Should you even be able to? If you are and you can, what are you supposed to do with that knowledge? Inform the authorities? Be silent about it, let the abuse continue and possibly get sued by the kid in 20 years, accusing you “you knew and didn’t do anything about it”? Report it and risk the kid having been misunderstood or pulling a prank on you and ruining their parents’ lives?
There are so many implications, it makes you wonder how a manufacturer would ever willingly put himself in the position that these questions would even have to be answered. It would be interesting how Apple’s Siri, Google’s voice recognition or Microsoft’s Cortana handle these cases, but arguably their users are a wee bit older than Mattel’s.
Go read “The Diamond Age: Or, A Young Lady’s Illustrated Primer”. Stephenson tackled this years ago.
As for Siri, Google’s voice recognition, and Cortana – they’re interfaces to search engines with some basic preset natural language processing; they really aren’t AIs. What does google do if you type in “I am being beaten by my partner?” Answer: returns you search results just like any other case. The only circumstance I’m aware of that google behaves differently is when your search seems suicide related.
More than security researchers, Somerset seems a research consulting firm selling their time.
“Here’s your problem: Somebody set this thing to ‘evil’ “
“I love you, Homer!”