Hacking LED Halloween masks is frighteningly easy

Hacking makes the holidays so much more enjoyable, and nothing says trick or treat quite like pwning LED Halloween masks belonging to every neighborhood kid during candy-collection hours. After purchasing a Bluetooth Low Energy (BLE) enabled mask with a programmable app for his family's "anything that glows" themed Halloween …

[IGotOut]

TBH

I'd be surprised if there WAS security built in.

[elsergiovolador]

Costume

Take a photo of yourself today.

Save clothes you have on right now.

Next year at hello whine, wear those same clothes and take a photo.

Rinse and repeat until you no longer can dress yourself and have no helpers.

If someone asks you say it's me suspended in time.

[the hawk]

Leaving a trail of dead or zombified masks behind you as you walk the streets seems appropriately creepy, if there are enough of them to see the plague unfold.

[Valeyard]

if only each mask could in turn pair with and share the image with other masks it was near that'd be a great zombie theme

[JPCavendish]

To complete the zombie aspect; program each mask with a zombie image, AND to infect other masks it comes across and replace them with a zombie image. etc etc. Then send them out into the world to complete the spread of the zombie apocalypse...

[Pascal Monett]

"BLE enabled mask with a programmable app"

Um, this is supposed to be a surprise ?

You really think that a company selling Halloween masks is going to bother itself with security ?

What's the worst than can happen ? Tell me, please.

[BebopWeBop]

Re: "BLE enabled mask with a programmable app"

Well,I have seen suggestions of a large number of comedy penises roaming the street, with others saying 'hit me you arese'

[A. Coatsworth]

Re: "BLE enabled mask with a programmable app"

>>What's the worst than can happen ? Tell me, please.

Given that each mask on the streets probably means one "Shining Mask" app installed, from a company with such ironclad approach to security, I can see the worst that could happen being really ugly

[Paul Hovnanian]

Re: "BLE enabled mask with a programmable app"

Hundreds of little Jeffrey Epsteins wandering my neighborhood.

[Anonymous Coward]

Re: "BLE enabled mask with a programmable app"

Worse, hundreds of little Trumps

[Pulled Tea]

Meanwhile, your humble vulture has already shared the code with all of her friendly neighborhood teen hackers and can only hope that one of them tries it out while trick-or-treating.

You know this is how you get goatse, right?

[Anonymous Coward]

or an IoT penis on your face. This could be a truly historic moment in history. The first digital dick facing.

[cyberdemon]

To be fair, the dev has deliberately left out the bit that encodes a custom image for the masks. So anyone casually downloading and running this will only be able to display the standard fox face on some unsuspecting trick-or-treater.

[JLV]

One thing about being a big Sci Fi reader is trying to project into a reverse Connecticut Yankee situation. Imagine you're a tech-savvy 1950s dude(tte) who went into a coma and has just been revived with the wonders of modern medicine...

What is this article about? The words are English but make little sense. What is "hacking" and once you understand the term, what on earth does it have it to do with Halloween masks? Why would someone computerize a Halloween mask? Probably with more computing horse power than the Space Shuttle? Why would someone hack it?

Jump forward to 2150 and think about the sweet summer children of the early 21st century that allowed unprotected computing nodes to proliferate. A hacked mask could do all sorts of things, including eavesdropping on nearby Bluetooth emissions and reporting back to far-removed surveillance nodes via other hacked consumer devices in a mesh.

Much like late 1990s folk who would send each other meme .EXEs via email for entertainment. And run the ones they received.

[Jellied Eel]

.. reporting back to far-removed surveillance nodes via other hacked consumer devices in a mesh.

Surveillance nodes you say? So I'm kinda wondering what fun could be had with the HD mask vs facial recognition systems. Tempted to buy one now, especially if it's easy to load it with your own images. But also perhaps wait. 2.1mm pixels this year, and wonder how long it'll take to reduce that to 1mm or smaller.

[Elongated Muskrat]

Compromising Children's Halloween Masks?

What could possibly go wrong?

It's almost time, kids.

[LBJsPNS]

Re: Compromising Children's Halloween Masks?

The most annoying song ever. Didn't even have to click on the link.

[Elongated Muskrat]

Re: Compromising Children's Halloween Masks?

The masks contain ear-worms. Amongst other things.

[John Brown (no body)]

Trick or treat?

Well, nice to the "trick" part of trick or treat being put to good effect. Mostly these days it's entirely about the treat part. Or demanding money with menaces as some would see it :-)

It did, after all, get imported to the US from Scotland, via Canada, and was originally more about the participants performing some little act or song and then getting a treat for doing so.

[ComicalEngineer]

I love Halloween...

Especially when our large dog hears people at the door and kicks off with his equally large and loud bark.

No need for masks, the fear on the little monsters' faces is enough. ;-)

[Anonymous Coward]

Does it also work on Vapes ?

From the discarded and smashed examples littering our streets there seems to be some electronics in there so I wouldn't be surprised if BLE was in there too.

You could remotely turn the blighters off in public spaces.

I just realized there are more "intimate" BT/BLE controlled "adult devices" that possibly don't require pairing ...

[JPCavendish]

Re: Does it also work on Vapes ?

"I just realized there are more "intimate" BT/BLE controlled "adult devices" that possibly don't require pairing ..."

There are. Walk around with a suitably configured RPI and all you have to do is listen for the unexpected gasp. Or shriek, depending on how you've configured it.

[sedregj]

Re: Does it also work on Vapes ?

"Teledildonics" is a search term ...

[Anonymous Coward]

Re: Does it also work on Vapes ?

Set them all to vibrate

- 1812 overture

- crazy frog theme

- wah wah wah let down type sound

- hotel California

- medley of Disney songs

[Simon Harris]

Re: Does it also work on Vapes ?

From these very pages from a few years ago…

https://www.theregister.com/2018/02/02/adult_fun_toy_security_fail/

[Anonymous Coward]

I see no downside.

[that one in the corner]

My LED mask just came on full brightness; I see nothing at all except purple splodges.

[PRR]

> there was no pairing or authentication checks

OTOH, my app will NOT pair to my hearing aid unless I power-down and re-start phone and aid, multiple times, and maybe not then. The latest discovery is that they won't pair unless the phone has internet connection--- which is the usual case when I go into a noisy restaurant unexpectedly.