2.11.2018 #Toyfail

#ToyFailA security review of IoT toys

2.11.2018 #Toyfail

Agenda

Background Testing Findings Results

(The Norwegian Consumer Consul)

2.11.2018 #Toyfail

Our Customer

2.11.2018 #Toyfail

Why?

2.11.2018 #Toyfail

Regulations

2.11.2018 #Toyfail

Update

2.11.2018 #Toyfail

Security updates

2.11.2018 #Toyfail

Security updates

2.11.2018 #Toyfail

The project

Narrow Scope

Limited budget

Small project

2.11.2018 #Toyfail

Meet the dolls

2.11.2018 #Toyfail

Cayla

2.11.2018 #Toyfail

i-que

2.11.2018 #Toyfail

Smart toys

2.11.2018 #Toyfail

2.11.2018 #Toyfail

2.11.2018 #Toyfail

App <-> Internet

2.11.2018 #Toyfail

Debugging proxy

Easy

Manipulate requests

HTTPS Decryption

2.11.2018 #Toyfail

SSL Decryption

Original Connection

(Fake Certificate) (Original Certificate)

Men-in-the-middle

2.11.2018 #Toyfail

2.11.2018 #Toyfail

Decrypt HTTPS Traffic

2.11.2018 #Toyfail

Installing on IPhone..

2.11.2018 #Toyfail

Running Fiddler in Azure

2.11.2018 #Toyfail

Running Fiddler

2.11.2018 #Toyfail

Inspecting the data

2.11.2018 #Toyfail

JSON

2.11.2018 #Toyfail

A closer look

2.11.2018 #Toyfail

SSL Pinning

2.11.2018 #Toyfail

2.11.2018 #Toyfail

Application (HTTP)

Transport (TCP)

Network (IP)

Link (Ethernet)

Wireshark

2.11.2018 #Toyfail

Wireshark

2.11.2018 #Toyfail

• Filter data

Wireshark

2.11.2018 #Toyfail

• Filter data

• Multple recordings

• Strict testing protocol

Wireshark

• t=5s: start app

• t=15s: press play button

• t=20s: ask the doll a question

• t=60s: ask about the weather

2.11.2018 #Toyfail

Wireshark

• Demo…

2.11.2018 #Toyfail

Wireshark

• 23kB of data sent to Nuance

• Toll quality voice at 12kbps

2.11.2018 #Toyfail

Wireshark

• 23kB of data sent to Nuance

• Toll quality voice at 12kbps

• 15 seconds of voice recording

2.11.2018 #Toyfail

Wireshark

2.11.2018 #Toyfail

Toy <-> App

2.11.2018 #Toyfail

Frequency Jumping

2.11.2018 #Toyfail

Bluetooth communication

HackRF

Übertooth

Bluetooth LE Sniffer

2.11.2018 #Toyfail

Bluetooth Low Energy

Bluetooth LE Sniffer

2.11.2018 #Toyfail

Bluetooth Classic

Übertooth

http://ubertooth.sourceforge.net/

2.11.2018 #Toyfail

Software Defined Radio

HackRF

2.11.2018 #Toyfail

No need for fancy tools..

2.11.2018 #Toyfail

Hardware

2.11.2018 #Toyfail

Hardware

“...useful whenever product implementers

want to make the user experience easier

and have accepted the increased risk of

security attacks.”

2.11.2018 #Toyfail

2.11.2018 #Toyfail

2.11.2018 #Toyfail

2.11.2018 #Toyfail

2.11.2018 #Toyfail

Application

2.11.2018 #Toyfail

Decompile

2.11.2018 #Toyfail

Decompile

2.11.2018 #Toyfail

Decompile

2.11.2018 #Toyfail

Decompile

2.11.2018 #Toyfail

Decompile

2.11.2018 #Toyfail

Decompile

2.11.2018 #Toyfail

Decompile

2.11.2018 #Toyfail

Decompile

2.11.2018 #Toyfail

Decompile

2.11.2018 #Toyfail

Decompile

2.11.2018 #Toyfail

Decompile

2.11.2018 #Toyfail

Decompile

2.11.2018 #Toyfail

Decompile

2.11.2018 #Toyfail

Decompile

2.11.2018 #Toyfail

Decompile

2.11.2018 #Toyfail

Hidden marketing

2.11.2018 #Toyfail

Results/Findings

2.11.2018 #Toyfail

Results

#Toyfail

2.11.2018 #Toyfail

Results

Media Impact

#Toyfail

499

341

77

68

65

58

50

48

44

33

444

US

Germany

Netherlands

France

Italy

UK

Sweeden

Norway

Austria

Spain

OthersBased on monitoring

between December

5. and December 31.

The toys were withdrawn from several markets

#Toyfail

• Big toy chains in the United States,

Belgium and the Netherlands has

stopped the sale of the toys.

• In Norway, Sweden and Denmark BR-

Toys and Toys R Us offered money

back without a receipt.

In Germany the doll got banned

#Toyfail

At the Berlin Spy Museum…

2.11.2018 #Toyfail

Lesson to be learned

2.11.2018 #Toyfail

2.11.2018 #Toyfail