Fisher-Price’s Chatter phone has a simple but problematic Bluetooth bug

As nostalgia goes, the Fisher-Price Chatter phone doesn’t disappoint. The classic retro kids toy was given a modern revamp for the holiday season with the new release for adults which, unlike the original toy designed for kids, can make and receive calls over Bluetooth using a nearby smartphone.

The Chatter — despite a working rotary dial and its trademark wobbly eyes that bob up and down when the wheels turn — is less a phone and more like a novelty Bluetooth speaker with a microphone, which activates when the handset is lifted.

The Chatter didn’t spend long on sale; the phone sold out quickly as the waitlists piled up. But security researchers in the U.K. immediately spotted a potential problem. With just the online instruction manual to go on, the researchers feared that a design flaw could allow someone to use the Chatter to eavesdrop.

Ken Munro, founder of the cybersecurity company Pen Test Partners, told TechCrunch that chief among the concerns are that the Chatter does not have a secure pairing process to stop unauthorized phones in Bluetooth range from connecting to it.

Munro outlined a series of tests that would confirm or allay his concerns. Since the Chatter is only available in the U.S. and was persistently sold out, TechCrunch set a page monitor to tell us when it was back in stock, bought one, and started testing.

First, we switched on the Chatter phone, which activates its Bluetooth connection, paired a phone over Bluetooth, then switched off Bluetooth to simulate someone walking the phone out of range. We then paired another phone with the Chatter without hindrance, allowing us to remotely control the Chatter’s audio.

Mattel, which makes the Chatter phone, said the phone “will time out if no connection is made or once the pairing occurs — it is only discoverable within a narrow window of time and requires physical access to the device.” We left the Chatter on and found the Bluetooth pairing process did not time out after more than an hour.

Then, Munro asked what would happen if we called the phone connected to the Chatter. Sure enough, the Chatter rang — loudly — as expected. Then we called the Chatter again, this time without properly replacing its receiver. With the handset off the hook, the Chatter automatically answered the call, immediately activating the handset’s microphone and allowing us to hear ambient background audio.

Several years ago, Pen Test Partners found a similar Bluetooth vulnerability in a child’s toy doll called My Friend Cayla, which the researchers found could be paired with another person’s phone if the parent’s phone goes out of range. The toy was eventually pulled from shelves after it was found the doll, when connected to its app, was recording what children were saying.

The Chatter doesn’t have an app, and Mattel said the Chatter phone was released as “a limited promotional item and a playful spin on a classic toy for adults.” But Munro said he’s concerned the Chatter’s lack of secure pairing could be exploited by a nearby neighbor or a determined attacker, or that the Chatter could be handed down to kids, who could then unknowingly trigger the bug.

“It doesn’t need kids to interact with it in order for it to become an audio bug. Just leaving the handset off is enough,” said Munro.

When reached about the findings, Mattel spokesperson Kelly Powers said the company is “committed to security and we will be investigating these claims.”

Read more:

  • A pair of new Bluetooth security flaws expose wireless access points to attack
  • A Bluetooth bug in a popular at-home COVID-19 test could falsify results
  • Google discloses security bug in its Bluetooth Titan Security Keys, offers free replacement

Original source:


Metalenz PolarEyes upgrades digital sensing with polarized light

Tech sees differently, and can fuse multiple types of data we can’t even perceive: lidar, IR, ultrasonic and so on. Metalenz, maker of highly compact “2D” cameras for advanced sensing, hopes to bring polarized light into the mix for security and safety with its PolarEyes tech. Polarization isn’t a quality of light that’s often paid […]

Read More

Warehouse robotics system Exotec raises $335 million

French startup Exotec has raised a $335 million Series D round in a new round of funding led by Goldman Sachs’ Growth Equity business. Following today’s investment, the company has reached a valuation of $2 billion. Exotec sells a complete end-to-end solution to turn a regular warehouse into a partially automated logistics platform. It’s a […]

Read More

This device attaches magnetically to a face mask to monitor the wearer’s vitals

Perhaps 2022 will be the year consumer health tracking moves beyond the wrist. We’ve seen Oura’s rise over the past few years and a CES that brought with it a couple of ring fitness trackers. Following Google’s addition to vital and sleep tracking on the Nest Home, Sengled is adding the feature to a smart […]

Read More