Update: Hello Barbie Fails Another Security Test

Executive summary: Security researchers from Bluebox and an independent analyst found multiple vulnerabilities in Mattel/ToyTalk’s Hello Barbie ecosystem — a hardcoded P12 certificate password in the mobile apps, an unsecured initial setup hotspot allowing wireless spoofing and MITM attacks, and servers supporting weak SSLv3 ciphers susceptible to POODLE — which could enable credential theft or interception of recorded audio; ToyTalk has issued patches and used OTA updates to remediate the reported flaws.