Hacking Furbo: A Hardware Research Project
A six-part hardware research series on the Furbo 360 and Furbo Mini pet cameras by Julian B., published on Software Secured. It spans hardware acquisition, mobile and P2P exploitation, chip-off firmware extraction, dynamic analysis, BLE attacks, and coordinated disclosure — nearly two dozen vulnerabilities in total.
- Part 1: Acquiring the Hardware ↗
Choosing Furbo as a long-term hardware research target. Tomofun's Furbo devices let owners monitor pets, and the higher-end Furbo 360 can toss treats, send voice messages, and more — a rich attack surface.
- Part 2: Mobile and P2P Exploits ↗
Focusing on the mobile app and its P2P communications — identifying the mobile side of the P2P channel and hooking it with Frida to understand how it works.
- Part 3: Chip Off and Persistence ↗
Attempting a chip-off procedure to dump and re-apply custom firmware — using the XGecu T48 programmer for extraction, the struggle to find the right adapter, and a failed attempt to avoid chip-off with a probe reader.
- Part 4: Debugging, DeviceIDs, and Dev Tools ↗
Dynamic analysis of the devices — how the device logs information, how that clarified the binaries, and developer features found in the file system — leading to two more vulnerabilities: a Denial of Service and an application-logic bypass for unlimited trial licenses.
- Part 5: Exploiting BLE ↗
Examining Furbo's BLE communication and finding flaws that expose Wi-Fi credentials, enable device resets, and reveal hidden GATT characteristics — with demonstrations of hijacking video streams and re-registering devices.
- Part 6: The Finale ↗
The final chapter: insecure Wi-Fi credentials, risky S3 log uploads, long-lived device tokens, and global MQTT activity exposure, plus the June 23, 2025 disclosure to Tomofun.