Today I am reviewing something different. I’m reviewing a robotic ball called the Sphero 2.0 which was supplied to me by Best Buy. Here’s what you get in the box:
In the box are neatly packed ramps for performing jumps, a user manual and inductive charging base which isn’t shown here. Just put Sphero 2.0 into the rounded charging base, watch it quickly spin itself around to properly align itself and light up to signify charging is underway. It’s kind of cool to watch actually.
When Sphero 2.0 is blue, it is fully charged. Just pop it out of the charger and then double tap on its surface with your fingers to wake it. You then download the Sphero app onto your iOS or Android device and use Bluetooth to pair your phone to Sphero 2.0. That’s when the fun begins. The app talks you through the controls for the device via a virtual joy-pad which controls direction and speed, and it has a separate speed setting to limit or increase the overall device speed. Now how easy is it to control? On my wooden floors. I really had to slow it down to have any level of control. I also crashed into lots of things. But it seems to be able take a fair amount of abuse. Once you get the hang of it, you can graduate to completing missions to give Sphero 2.0 new abilities. The missions will challenge your fine motor skills as well as your problem solving abilities. That’s going to be cool and challenging for kids and quite a few adults too. If you want to try something different, there are a number of custom-made games on the App Store of your choice to give you new challenges. I have to admit, it was really engaging.
Gripes? Only one. During my testing I found that the battery inside the Sphero 2.0 only lasts about an hour. That does cut into the fun. But it was better than the remote control cars that I played with as a kid in the 1970’s. There. I’ve just dated myself.
Best Buy has the Sphero 2.0 available for $150 which some will think is a bit steep. But it will provide hours of gameplay which makes it totally worth it in my opinion. Check it out if you want a challenge of a different sort.
Star Wars BB-8 Toy Can Be Pwned By The Dark Side
Posted in Commentary with tags Hacked, Sphero on January 8, 2016 by itnerdOne of the hottest toys out there at the moment is the BB-8 Droid from the new Star Wars movie that’s made by Sphero. But you may want to know that there’s a potential security issue that could become a really big problem for users if exploited correctly. Pen Test Partners has posted a blog post that shows that the toy is open to the influence of the Dark Side Of The Force:
I spent a few minutes poking around the Android app that controls the BB-8. It talks to the droid over Bluetooth. There’s no PIN security in the pairing process, but I haven’t got round to investigating whether there’s anything that can be done there.
Various sources have indicated that around 15% or more of all Android apps in the Play store have issues with unprotected communication over the internet. That certainly correlates with our findings when testing Android apps.
So I spent some time rummaging around and MITM’d the wireless connection.
And here’s what I found. If you force a firmware update, it goes over HTTP. No SSL. Fail!
MITM is an acronym for Man In The Middle Attack. In other words, a
sith lordhacker could leverage a connection between the toy and an Android phone to do other evil things. At least in theory. But the question is if you have to worry or not. Here’s the answer:What could you do with this?
Frankly, not a lot right now. That’s why I’m talking about it in public before an update has been published. There doesn’t appear to be any personal data on the mobile app or the droid. There are no particularly useful sensors on it either, so it’s not like it could be used for spying on the user.
There would have to be a near perfect storm in order to exploit this usefully: If there was a current vulnerability in the Android (or iOS) Bluetooth stack (we’re not aware of one) and the victim has a BB-8 and they do a firmware update whilst an attacker is in the locale then something could be compromised.
So, here’s the bottom line:
WE LOVE BB-8. Great toy Sphero!
But, Sphero could do a little better and implement SSL for their firmware updates. That this simple bug was missed suggests that security assurance could be more thorough. Maybe they accepted the risk, given it isn’t a show-stopping vulnerability.
Though, they did a great job of acknowledging the bug and have a plan to get it fixed. A cool vendor.
When the update comes out, owners should apply it ASAP. That way you can keep BB-8 from potentially turning to The Dark Side Of The Force.
1 Comment »