Toymail Talkie Network Services

Written 2018-03-31

Tags:Toymail WiFi ElectricImp 

Toymail makes some pretty neat little IoT toys that let kids and parents send short voice clips to each other, or to other friends. @that_guy_ego recently brought on to SecKC to play with. I downloaded the Android APK and started disassembling it. Of note, the toys heavily leverage a technlogy from ElectricImp, which makes small IoT modules with WiFi. These are known as Imps. The Imp chip forms the majority of complexity inside the Toymail toys. Toymail runs an app on the Imp that implements the toy's behaviours and features.

Toymail

Commissioning

During mobile app setup, the user is prompted for a wifi network and password. This is sent using ElectricImp's BlinkUp protocol. BlinkUp works like a simple modem, but instead of encoding data in sound, the setup information is encoded with light using the mobile device screen. Of note, the data flow is only to the toy, there's no response back. In addition to the WiFi network credentials, a unique token is generated and sent to the device. Once the toy connects to the network, it uploads the token, informing ElectricImp that it has a network connection, and ElectricImp informs the mobile app that the toy is now online.

The details of the BlinkUp protocol may be a future post

Firmware Updates

Firmware updates are served from upgrades.electricimp.com, and appear to be encrypted. We haven't yet verified this, but I'm not surprised.

Imp->ElectricImp Communications

Each model of Imp uses a different DNS name to call home. For example:

The clients, Imps, may have very different TLS stacks limited in different ways. This allows ElectricImp to upgrade TLS independently, without breaking clients that may not support the latest TLS.

Interestingly, all of the above URLs require TLS client authentication. From Petasense, who also uses Imp modules, we see that they're used to identify each client to the server.

App->Toymail Communications

Interestingly, the Android app does not use TLS pinning, and instead relies upon the mobile platform to handle security.

The following shell script will dump the possible API endpoints once the app is disassembled:

grep -r https . | cut -d "\"" -f 2 | sort -u 

into:

Future Work