7 ms·
Dishwasher has directory traversal bug
- flukus 10y agoWhat's the value of an internet connected dishwasher? All I can think of is remotely starting it, but all the real world applications of this could be handled by a delay start button. The other would be to tell you when it's done, which isn't really something I've ever been concerned about. Even industrial washers that require reporting on temperatures reached and stuff like that don't really benefit from a connection.
- catmanjan 10y agoI can see how load/fault data would be valuable to the manufacturer, but to a consumer...?
- markwakeford 10y agoThis is a commercial medical laboratory Washer-disinfector. The reporting is most likely mandated based on its usage in a medical setting. Some of these devices print out reports that are required to be stored. I suppose this would allow them to easily keep those records paperless. I am in no way justifying the lack of security but I think its important to understand that its unlikely to be opened up for a free for all connected to the public internet.
- flukus 10y agoWas there something wrong with having a serial connection to another device that handled the reporting like every other machine? >I am in no way justifying the lack of security but I think its important to understand that its unlikely to be opened up for a free for all connected to the public internet. Considering hospitals and technology I don't think this distinction matters much. There only line of defense seems to be isolation but things like wireless devices are becoming more common.
- detaro 10y ago> Was there something wrong with having a serial connection to another device that handled the reporting like every other machine? From the manufacturer docs, that is the most common option for these things: https://www.miele.de/media/ex/hk/Professional/CSSD.pdf https://www.miele.de/media/ex/hk/Professional/CSSD.pdf Slightly cynical answer: In medical environments? Then the device on the other end of the serial connection is probably vulnerable and/or horribly outdated, either by being an embedded device made to the same (lack of) quality standards, or by being a desktop PC running Windows 2000, or software requiring to run as Domain Admin for no good reason, ...
- flukus 10y agoI would hope it's one way link, so the PC may be compromised but the operation of the machine wouldn't be.
- kijin 10y ago> its unlikely to be opened up for a free for all connected to the public internet. Unfortunately, that kind of thought process is how you end up with dozens of vulnerable devices connected to a hospital intranet. Everything works fine as long as nobody tries anything fishy, but all you need is one device with a buggy Bluetooth implementation to bring down the whole house of cards and kill a bunch of people.
- i336_ 10y agoApologies for my denseness, but how could buggy Bluetooth bring everything down? I vaguely recall something about a faulty hospital device with Bluetooth or Wi-Fi being posted here a little while ago, but I'm not certain.
- kijin 10y agoBuggy means vulnerable in this context. A vulnerability in the Bluetooth or Wi-Fi stack is a good way for someone to compromise a machine remotely. Once you compromise one machine, you're inside the firewall and in a much better position to exploit vulnerabilities in other machines in the network.
- tedunangst 10y agoHow did hospitals ever wash dishes two years ago?
- jessriedel 10y agoThey kept worse records. Don't we expect some procedures that were impossible in the past to become mandatory in the future when enabled by new tech?
- flukus 10y agoOr they kept the same records and had users log them into another system, which was about 2 seconds of work. AFAIK the only important stats for medical washers is the max temperature reached and how long it maintained a certain critical temperature. They also have redundant checks anyway, like a pad that put in that would change color at a certain temperature, much like those radiation pads you see in TV shows.
- Someone 10y agoIf that took them "about 2 seconds of work", I bet "They kept worse records.", the statement you reacted to, wasn't just correct, but an understatement.
- i336_ 10y ago> I think its important to understand that its unlikely to be opened up for a free for all connected to the public internet. That just gave me an idea... https://www.shodan.io/search?query=%22PST10+WebServer%22 https://www.shodan.io/search?query=%22PST10+WebServer%22 > No results found Can't say I'm sad about that. (Searching for just "PST" finds a single irrelevant SMB share.)
- DigitalSea 10y agoWhy does everything need to be connected to the internet? Whatever happened to just adding in a USB port or something so you can download the data if you need it? Add in some storage and surely, a dishwasher doesn't need much storage so it would alleviate the problem and surely be cheaper not having to licence wifi.
- bschwindHN 10y agoWhy does a dishwasher need to have "storage" at all?
- wapz 10y agoThis is a medical dishwasher that keeps logs of all the washes (required by hospitals somewhere). I do hope they are only used on private networks but I don't know web security at all so I don't even know if that would protect them.
- blisterpeanuts 10y agoWhy connectivity for a dishwasher? I can think of one or maybe two scenarios: 1 - send the owner an urgent email in the event of catastrophic failure, i.e. drain blockage which might lead to overflow all over the kitchen floor. 2 - let owner know status of current cycle, in real time. Some people might like to know that, though I'm not sure why. Usually you run the dishes at night or during some open ended period of time so you don't have to care when it finishes. You could theoretically control the appliance with a computer or mobile device. Why would you want to? Beats me, but it's one of those gimmicks that might please some gadget-happy segment of the consumer market. What evil things could a hacker do to your dishwasher? Make it start in the middle of the night? Ruin the delicate plastic stuff? I'd personally be very happy just to own a dishwasher that actually cleans stuff. I've had several dishwashers and have yet to see one that cleans as well as I can with my Scotch blue pad and Ajax.
- flukus 10y ago> What evil things could a hacker do to your dishwasher? Make it start in the middle of the night? Ruin the delicate plastic stuff? Waste a lot of water/electricity. Run cold water only so it doesn't disinfect. Use it as a platform to attack other household devices. Most hackers would only have a motivation for the latter.
- taneliv 10y agoOr distribute illegal material.
- lewiscollard 10y ago> What evil things could a hacker do to your dishwasher? Turning it into a botnet node, cf. Mirai. If the only harm that came from Internet-all-the-things was that to the owners of the devices I'd welcome it; the person who buys this junk is one who deserves everything they get. It's the damage being done to the rest of us that is worth caring about.
- mattkrause 10y agoDespite the photo in the article, it's not a home dishwasher; it's a "disinfector" meant for hospital or medical labs. Most users probably want to--or are required to--keep records about the cycle length, maximum temperature, and stuff like that. We had an older machine that printed this information on cash register paper, but clearly that's not ideal if you want the data to be stored and searchable. Similarly, the remote monitoring/alarms could useful for keeping procedures on schedule.
- crwalker 10y agoThe FDA requires information panel labeling for most food: I think it's reasonable to want to know roughly what we're eating. I would not be surprised to see similar printed labeling requirements for IoT devices, in bite sized chunks that are more standardized than a device-specific EULA, e.g.: This device runs on: firmware A (unaudited) web server B (UL approved) update expiry date: Jan 1, 2020 This device may: capture video, sound, and/or user input send user data to our servers send aggregated user data to 3rd parties
- microcolonel 10y agoI think the solution is much simpler: don't put an open web server in your dishwasher, and use standard authenticated, encrypted channels between the application and the appliance so that at least only somebody with credentials can use your dishwasher an espionage device. And failing that, some Good Old All-American Common Law suits should do the industry a world of good. This product surely has an implied warranty of some kind.
- tinus_hn 10y agoWhat provides standard encrypted channels? Why would such a service not have vulnerabilities?
- beaconstudios 10y agoI'm guessing they meant TLS for comms and SSH/VPN for authentication.
- norea-armozel 10y agoOr even simpler: don't put any kind of writable software/firmware on the dishwasher in the first place. Beyond maybe some scheduled washing options, why does a dishwater need to be IoT'd? Seriously, I think all this is meant to pad the price of the appliances rather than give users an actual working product.
- 10y ago
- _xgw 10y agoWhat's the worst thing that could happen from someone exploiting this vulnerability?
- crystalPalace 10y agoA malicious actor could add the dishwasher to their botnet and conduct DDOS attacks or distribute spam. You could also use the server as a proxy or as an attack vector into whatever network the dishwasher is connected to.
- aptwebapps 10y agoAs long as we're speculating, depending on the controls afforded, you could possibly break it or damage a load. Could even be a bit dangerous.
- jaclaz 10y agoAttacker could lower temperature of washing cycle and make it shorter, enough for a given type of germ or virus to survive the washing, if the thingy is used in hospital and records are kept it should mean that actual sterilization is the main scope.
- cperciva 10y agoRemember, the S in IoT stands for "Security".
- peterwwillis 10y agoAnyone who buys a networked home appliance really deserves any problems they create. But unfortunately, they'll eventually affect all the people who didn't buy them, too.
- aptwebapps 10y agoSomeday soon the salesperson will ask you, "Botnet or no botnet?" Actually, they'll probably start trying to sell you copies of Norton or McAfee to keep it "safe" ...
- a3n 10y agoI wonder when my clothes are going to start tweeting about when they were cleaned. "Washed in my General Electric" like "Sent from my iPhone."
- hoodoof 10y agoHow does your dishwasher get onto your home network?
- wapz 10y agoWhen you follow the directions to set it up.. I'm not sure if that was a serious question or not.
- aptwebapps 10y agoSeems like there might be a market for some sort of universal IoT base unit that could be sold and maintained by someone who knew what they were doing. It could have a simple userland API and a simple external API, REST or otherwise, and OTA update capability. We need a (competent) Cisco for IoT devices. All of these various manufacturers are never going to get their act together. Even if they do, individually, the additional costs are likely to make them less competitive.
- netsharc 10y agoFascinating idea... offer GPIO ports to read (and write) signals, offer cheap models ("2 GPIO ports? You got it!") to enterprise ones ("You want 1024 GPIO ports? You got it!"). And sell the backend solution too for enterprises, and offer a hosting solution for small scaled deployments. There's definitely a market for that. And imagine if you're the Mark Zuckerberg ("They 'trust me'. Dumb f*cks.") of all these devices. All that data...
- edmccard 10y agoIf you're wondering what this "dishwasher" (actually a laboratory glassware washer) really looks like, here's its product page: http://www.miele-pro.com/us/prof/products/14071_16161.htm http://www.miele-pro.com/us/prof/products/14071_16161.htm