CBC\_SHA with TLS 1.0). Bhargavan et al. [@weak2016blockciphers] found that ciphers using 64-bit blocks (e.g., 3DES) are vulnerable to secret key disclosure.

The official website toytalk.com can be used by parents to review the child’s recordings. The server certificate uses an RSA 2048-bit key and is signed by Amazon using SHA256 and an RSA 2048-bit key. The server does not support weak cipher suites and uses cryptographic libraries patched against known cryptographic attacks. However, there is no restriction on the number of login attempts, and the login can be bruteforced. We exploited this *[Online-password-bruteforce]{}* vulnerability during the course of testing to bruteforce our own account. This flaw was originally reported in January 2016[@Somerset2016barbie] and our experiments show that it is still not fixed.

To investigate communication between the toy and the app, we use the following specific setup for [Hello Barbie]{}. We use two WiFi adapters on our test machine, one in AP mode as an impostor Hello Barbie, and the second to connect to the real Hello Barbie, exploiting its unprotected hotspot. We route all traffic from the impostor to the real toy. In the app, both toys, real and impostor, are listed, and we connect to the impostor. The smartphone hosting the app, meanwhile, is configured to forward all traffic through a Burp Suite proxy. This configuration requires the app to be patched to accept certificates signed by Burp Suite CA, and the app client certificate bundle added to Burp Suite as the client certificate. This allows the app to authenticate itself to the toy, enabling us to intercept communication between them. The toy authenticates to the app using a certificate issued to 192.168.10.1, signed by “ToyTalk CA”, and valid to 2030. Once the TLS handshake is complete, the app sends the parent account ID and WiFi configuration, including WiFi SSID and password, to the toy.

The toy can be configured using any companion app, and no parent authentication is required to pair with the toy. Because the toy uses the parent’s account ID as the sole way to relate the child’s profile, including voice recordings, to the parent, an adversary need only reconfigure the toy to use the adversary’s account
CBC\_SHA with TLS 1.0). Bhargavan et al.   [ @weak2016blockciphers ] found that ciphers using 64 - bit block (for example, 3DES) are vulnerable to secret key disclosure. 

 The official web site toytalk.com can be used by parent to review the child ’s recordings. The server security use an RSA 2048 - bit samara and is signed by Amazon using SHA256 and an RSA 2048 - morsel key. The server does not defend decrepit cipher suites and use cryptographic libraries patch against known cryptographic attacks. However, there exist no restriction on the number of login attempts, and the login can be bruteforced. We exploited this * [ Online - password - bruteforce ] { } * vulnerability during the path of testing to bruteforce our own account. This flaw was originally reported in January 2016[@Somerset2016barbie ] and our experiment show that it is still not fixed. 

 To investigate communication between the toy and the app, we use the following specific setup for [ Hello Barbie ] { }. We use two WiFi adapters on our test machine, one in AP mode as an impostor Hello Barbie, and the second to connect to the real Hello Barbie, exploiting its unprotected hotspot. We route all dealings from the imposter to the real toy. In the app, both toys, veridical and impostor, are listed, and we connect to the imposter. The smartphone hosting the app, meanwhile, is configure to forward all traffic through a Burp Suite proxy. This configuration requires the app to be patch to accept certificates signed by Burp Suite CA, and the app client certificate bundle added to Burp Suite as the client certificate. This allows the app to authenticate itself to the toy, enable us to intercept communication between them. The plaything authenticates to the app using a certificate issued to 192.168.10.1, signed by “ ToyTalk CA ”, and valid to 2030. Once the TLS handshake is accomplished, the app sends the parent account ID and WiFi configuration, include WiFi SSID and password, to the toy. 

 The toy can be configured using any companion app, and no parent authentication is want to pair with the miniature. Because the toy uses the parent ’s history ID as the sole manner to relate the child ’s visibility, including voice recording, to the parent, an adversary need only reconfigure the toy to practice the adversary ’s account
CBC\_DHA with TLS 1.0). Bhargavan tt al. [@weak2016blockcipkwrs] fonnd thaf cipherr using 64-bit blocks (e.g., 3DES) arx vuoneravle to secret key discuosure.

The officiao weusite toytalk.com can be mfed gn parznvs to review thg child’s recmrdings. The sesvdr certificate uses an RSA 2048-bit key anq is sibnfd by Amazon ufing FHA256 znd an RSA 2048-bit key. The server does not sukport weak cipher xuites and uses cryptograpjic pibraries patched wgainst knoqn cwtptographic xttacks. However, there js no restriction on the number of lpgin attemkcw, ajg the login can fe bruteforccc. We efploitec this *[Online-psssxord-vruteforce]{}* vulnerabilmty during the coursg of testitg to bruteforce oue iwn awcoutt. Tfus wlas xas origijalmy reportes in Januart 2016[@Somerset2016barbie] anc jlt experimenta show trat it is still not fixed.

To investigate cojmunication between the toy and the app, we ude the fojlowing specific setup for [Hello Barbie]{}. We use twm WiFm xdaktcvs ov okr test machine, one in AP mode as an impostor Geklp Barbie, and tme second to connevt tp the real Heluo Baryje, exploiting its unorotectgd hotwpot. We rjute all traffic from the imposror to the rval roy. In the app, botk toys, real cnd imkostor, are listed, and we connzct to the impostlr. The smzftphone hosting ghe a[p, meanwhile, is configured to forwacd alk traffkc tnrough a Burp Sulte pvmxy. This configurahion tequiras the app to be patched to accept certifmrates signed ny Bugp Suite EA, and the app cliegt certificate bundle addea to Burp Auite av the cliene certificate. Jhis allows tie app to autyentucate igrelf to the tou, enabliny us ro intercept commukicatkkn between them. Tht roy authenticayes to tje a[[ using a cestifkcagr issjed to 192.168.10.1, sigked by “YoyTalk CA”, and valid to 2030. Once the TLS handxhwke is cimplete, ehe app sends the parent accounu ID aid WiFm confogutation, including WiFi SSID and lassword, ho bhe toy.

The tor cak be configureb using any companion app, and no parent euthentication is requieed to pair with thg tpy. Because vhe tor uses tha parent’s account ID as the sole way uo relate the child’s prkfile, hnclufing voice recordings, to the parent, an adversary need only reconfigure thw toy vo use the adberssry’s dceouut
CBC\_SHA with TLS 1.0). Bhargavan et al. that using 64-bit (e.g., 3DES) are The website toytalk.com can used by parents review the child’s recordings. The server uses an RSA 2048-bit key and is signed by Amazon using SHA256 and RSA 2048-bit key. The server does not support weak cipher suites and uses libraries against cryptographic However, there is no restriction on the number of login attempts, and the login can be We exploited this *[Online-password-bruteforce]{}* vulnerability during the course testing to bruteforce our account. This flaw was originally in 2016[@Somerset2016barbie] and experiments that is still not To investigate communication between the toy and the app, we use the following specific setup for [Hello We use adapters on test one AP mode as Hello Barbie, and the second to real Hello Barbie, exploiting its unprotected hotspot. We all traffic the impostor to the real toy. the app, both toys, real and impostor, are and we connect to the impostor. The smartphone hosting the app, meanwhile, is configured to traffic through a Burp proxy. This configuration the to patched accept certificates by Burp Suite CA, and the app client certificate bundle added Burp Suite as the client certificate. This allows the app itself the toy, enabling to intercept communication between The authenticates to the app certificate to “ToyTalk and to 2030. Once the handshake is complete, the app the parent account ID SSID and password, to the toy. The toy be configured using any companion app, and parent authentication is required to pair with the toy. Because the toy the parent’s as the sole way to relate the child’s including voice recordings, to parent, an adversary need only reconfigure the toy to the account
CBC\_SHA with TLS 1.0). Bhargavan et aL. [@weak2016blockCipheRs] fOunD tHat cIpheRs using 64-bit blocKS (e.g., 3DeS) are vulnerable to secreT key dIsCLosuRE.

THe offIcial weBSiTE ToyTaLk.Com CaN Be Used bY paRents to Review the cHilD’s Recordings. ThE SeRver certifIcaTe uses an RSA 2048-bIt kEy and iS sIgnED by AmAzoN usinG SHA256 anD An RSA 2048-bIt key. The sErVEr does NOt suppoRT WeAk ciPher suites and uses CRyPTographic libraRies paTcHEd AGAinSt kNown cryptoGrAphic ATtacks. HOWeVER, TheRE is no restrictIon on the numBEr oF login AtTemPTs, and tHe logIn CAn bE bruteforceD. We eXploited tHis *[OnlINe-passwORd-bruteForce]{}* vUlnEraBiliTY dUrIng ThE CouRSe Of tEStiNg to brutEfOrCe our Own aCCOUNt. ThIs fLaw wAs oriGinally reportEd iN JanUAry 2016[@somerSet2016baRbie] AnD our eXperimEnts sHoW that it is still nOt fiXed.

To inveStiGaTe cOmMunicATion beTweEn tHe toy anD the app, WE usE tHE FOlLowing specific setuP fOR [heLlo BarbiE]{}. We use TWo wifI adapterS oN ouR tesT MAchinE, one IN Ap mode as aN imposTOr heLlo BarbIe, And the SeConD to ConneCT to tHe real hello BarBie, exPLoiting its unprOTected hotspot. wE rOUTe ALl trAffIc from the imPostOR to tHe reAL tOy. IN The apP, both ToYS, rEAl and impostor, are lisTeD, and we ConneCt to the impostOr. The smartPHONe hostinG the APp, MEanwhile, is confIgureD to forward ALl traffiC throUgh a Burp suite proxY. tHis confiGurAtiOn rEquIREs The app to be patCHEd to AcCept cerTifIcates sIgnEd bY BuRp SUiTe CA, and thE app clieNt CeRtIfIcaTe bunDLe added tO BUrp suIte As the CLient cErtifIcatE. THiS AllOws the aPP tO AUtheNtIcAte iTseLf To the Toy, eNAblIng us to Intercept ComMUnicAtIoN betweeN them. The toy auThEnticates tO tHe aPp usinG A CertificAte issued to 192.168.10.1, signed by “ToyTALk CA”, and ValId to 2030. ONce tHe TLS handShaKe is coMplETe, the aPp sendS the pArEnt ACCount id AnD Wifi ConfiguratION, inCludiNg wiFi sSID and Password, to the toy.

ThE Toy Can be configurEd uSing ANY cOmpANiON apP, aND no PARent authenticatIon is requiReD To Pair with thE Toy. beCause thE toy useS the pARent’s acCount ID as The sole waY tO relATE thE child’s proFile, inclUding voicE RecorDInGs, to tHe pArent, aN aDveRsary Need onLY reConfiGure thE tOy to usE the aDvErsary’s aCcount
CBC\_SHA with TLS 1.0). Bh argavan et  al.[@w eak 20 16bl ockc iphers] foundt hatciphers using 64-bit b locks  ( e .g., 3D ES) a re vuln e ra b l e t ose cre tk ey  disc los ure.

T he officia l w eb site toytalk . co m can be u sed  by parentstoreview  t hec hild’ s r ecord ings.T he ser ver certi fi c ate us e s an RS A 20 48-b it key and is sig n ed by Amazon usin g SHA2 56 an d anRSA  2048-bitke y. Th e  server do e s not support weakcipher suit e s a nd use scry p tograp hic l ib r ari es patchedagai nst known  crypt o graphic attacks . Howe ver , t here is  n o r es t ric t io n o n  th e number  o flogin  att e m p t s, a ndthelogin  can be brute for ced. Weexplo itedthis  * [Onli ne-pas sword -b ruteforce]{}* v ulne rabilitydur in g t he  cour s e of t est ing  to bru teforce our  o w n ac count. This flaw w as o ri ginallyreport e din January20 16[ @Som e r set20 16ba r bi e] and o ur exp e ri me nts sho wthat i tissti ll no t  fix ed.

T o invest igate communicationb etween the to y  a n d  t h e ap p,we use thefoll o wing  spe c if ics etupfor [ He l lo Barbie]{}. We use t wo  WiFiadapt ers on our te st machine , o ne in AP  mod e  a s  an impostor H elloBarbie, an d  the sec ond t o connec t to ther e al Hello  Ba rbi e,exp l o it ing its unpro t e cted  h otspot.  We  routeall  tr aff icfr om the im postor t oth ere altoy.I n the ap p,  bo th  to ys, r e al and  impo stor ,ar e  li sted, a n dw e  con ne ct  tothe  i mpost or.T hesmartph one hosti ngt he a pp ,meanwhi le, is config ur ed to forw ar d a ll tra f f ic throu gh a Burp Suite proxy.T his con fig urati on r equires t heapp to  be patche d to a ccept  c ert i f icate s si gne dby Burp Su i t e C A, an dtheapp cli ent certificate bu n dle  added to Bur p S uite a sthe cl i ent  c e rti f i cate. This allo ws the app  t o  a uthenticat e  it se lf to t he toy,  enab l ing usto interc ept commu ni cati o n  be tween them . The to y authent i cates to  theapp  using  a  ce rtifi cate i s sue d to192.16 8. 10.1,signe dby “ToyT alk CA”, and valid to 2 030. O nce t heTLS hands hak e  is  complete , th e app send s t heparen t a c count  IDa nd  Wi F i con figu r ation, in c lu din g Wi Fi SSID and p a ssw ord,tot he toy .

T he toy can be con f igured using a ny c o m pan ion app,  a nd no parent a uth en t i cation i srequired to  pair wi th the t oy. Be causethe toy u se s  the p aren t’s  accountIDas the sol ewa y  to re late  t he chi ld’s p r ofil e ,  including voice  reco r d ings, tothe p ar ent, an adve rsary need  only recon figure  the  toyto useth e adve rsa ry ’s account 
CBC\_SHA with_TLS 1.0)._Bhargavan et al. [@weak2016blockciphers] found_that ciphers_using_64-bit blocks_(e.g.,_3DES) are vulnerable_to secret key_disclosure.

The official website toytalk.com_can be used_by_parents to review the child’s recordings. The server certificate uses an RSA 2048-bit key_and_is signed_by_Amazon_using SHA256 and an RSA_2048-bit key. The server does_not support_weak cipher suites and uses cryptographic libraries patched_against_known cryptographic attacks._However, there is no restriction on the number of_login attempts, and the login can_be bruteforced. We_exploited_this_*[Online-password-bruteforce]{}* vulnerability during the_course of testing to bruteforce our_own account. This flaw was originally_reported in January 2016[@Somerset2016barbie] and our experiments_show that it is still not_fixed.

To investigate communication between the_toy and_the app, we use the_following specific setup_for [Hello_Barbie]{}. We use_two WiFi adapters on our test_machine, one in_AP mode as an impostor Hello_Barbie,_and the second_to_connect_to the_real Hello Barbie,_exploiting_its unprotected_hotspot._We route all traffic from the_impostor_to the real toy. In the app,_both toys, real and_impostor,_are listed, and we_connect to the impostor. The_smartphone hosting the app, meanwhile, is_configured to_forward all_traffic through a Burp Suite proxy. This configuration requires the app_to be patched to accept certificates_signed by Burp Suite_CA, and_the_app client certificate_bundle_added to_Burp Suite as the client certificate. This_allows the_app to authenticate itself to the_toy, enabling us to_intercept_communication between them. The toy authenticates_to the app using a certificate_issued to 192.168.10.1, signed by_“ToyTalk_CA”,_and valid to 2030. Once_the TLS handshake is complete, the_app sends the_parent account ID and WiFi configuration, including_WiFi_SSID and password, to the toy.

The_toy_can be configured using any companion_app,_and_no parent authentication is required_to pair with the toy. Because_the toy uses the parent’s account ID as the_sole way to_relate the child’s profile, including_voice_recordings,_to the parent, an adversary need only reconfigure the toy_to use_the adversary’s account