6 ms·

Hacking the Philips Sonicare NFC Password

125 points by nmstoker 3y ago

snakey 3y ago
An unrolled version kindly posted by a user in the original thread: https://threadreaderapp.com/thread/1667252413051424773.html https://threadreaderapp.com/thread/1667252413051424773.html Hopefully much easier to read.
JasserInicide 3y ago
Somewhat related: my 10 year old Sonicare is starting to shit the bed so I started to look for a new one. Back then there was 2 models. Now there's like 8, each with several variations and fucking phone app integrations and are several hundred dollars. It was headache-inducing to read through.
- culturestate 3y ago
  I just went through this too, and I ended up with a Philips One. Its only smart-ish feature is the vibrating quadrant timer, it feels like it cleans more or less the same as my old Sonicare, it uses a normal AAA, and best of all it was like $30. There's no real third-party ecosystem for heads yet, but I'll happily trade that for something that just works.
  - beebeepka 3y ago
    I bought the simplest one. No app, no 1000 "different" vibration patterns, no charging glass, no nothing. To me, it looks like they are charging more for increased inconvenience. What a crazy world
    - exmadscientist 3y ago
      Also, consider the Kids model. It's the real deal, just with a kid-friendly sticker on it (designed to be interchangeable by kids, so easy to remove). It's got the full-featured, full-power previous(?) generation Sonicare resonant motor, no NFC, no stupid "pressure sensor" button, and no BS. If you can stand that sticker!
  - cwilkes 3y ago
    Expect that to change as Phillips bought SonicCare in 2020. Maybe soniccare will be the high end model and Phillips will be the one with “special offers” aka making you listen to a jingle about mouthwash while brushing your teeth.
    - culturestate 3y ago
      Philips has owned Sonicare for as long as I can remember, at least 15-20 years. My toothbrush is actually branded “Philips One by Sonicare,” but I won’t pretend to know what their strategy is with that.
- johnchristopher 3y ago
  > my 10 year old Sonicare is starting to shit the bed so I started to look for a new one. Back then there was 2 models. Now there's like 8, each with several variations Electric toothbrush marketing designations are out of control. When I was looking for one I found a website that went out of its way to identify which models were behind marketing wording and numbers and what their specs were (mainly: movements per minute and pulsations per minute). Companies love to rebrand the same models with different numbers based on how many additional brushes they put in the package but they rarely put those specs on their own websites. Anyway, oral b 2700 still looks good. > is starting to shit the bed Off-topic but... language, please ?
  - exmadscientist 3y ago
    > movements per minute and pulsations per minute According to an ex-Sonicare senior engineer I work with, this is not actually what's important at all. The key thing they looked at (and still do look at) is the amplitude/travel distance of the bristle tips, and how that changes under load. It should stay strong under light load, but collapse under heavy load (so that when you mash the thing way too hard into your gums, power transfer stops and your gums don't get brutalized). It's a surprisingly delicate balance. We recently had cause to look at a few of these devices (sorry for the vagueness, you know how it goes) and most of the non-Sonicare ones are pretty awful. The rotary Oral-B ones aren't bad at what they are, but they aren't the same. There is one Sonicare clone that really impressed though, and it's not expensive.
    - johnchristopher 3y ago
      > The key thing they looked at (and still do look at) is the amplitude/travel distance of the bristle tips, and how that changes under load. It should stay strong under light load, but collapse under heavy load (so that when you mash the thing way too hard into your gums, power transfer stops and your gums don't get brutalized). It's a surprisingly delicate balance. Isn't that what the pressure sensor is supposed to be for ?
      - exmadscientist 3y ago
- bredren 3y ago
  We have a pair of 2019 Sonicare that need battery replacements. I picked up a compatible battery but haven’t taken the time to pull it apart yet. It does require soldering. The company scrambled the model numbers and it’s not easy to figure out which are similar or even the same. The obfuscation of product differences, release dates and nerfs to longevity are all over consumer goods. I hope open product designs + micro hyper local manufacturing capability will deeply erode the power of companies creating these wasteful, capital-driven artifacts.
- userbinator 3y ago
  I'd pay several hundred for a toothbrush that had easily replaceable batteries and other components like shaft seals (with them being standard commonly-available parts), and was designed to last many decades. I don't want any of the "app" crap.
- throw0101b 3y ago
  > It was headache-inducing to read through. So what did you decide on?
PreInternet01 3y ago
TL;DR: recent (2020-ish) Sonicare brush handles have an alert to remind you when the attached tip has exceeded its useful life, according to the manufacturer's recommendations (which are printed on the packaging as well). This functionality is implemented using NFC, and as per protocol recommendations, there is a password. Given the low cost requirements and extremely low risks, this password is static, and can be sniffed as described in this blog post. If you are at all offended by this, you can feel free to either ignore the Sonicare handle's beeps/lights upon tip expiry, use non-NFC third-party tips, use a non-Sonicare brush handle, use a regular toothbrush, or not brush your teeth at all (not medical advice). Big Toothbrush may be out to get you, but they're not quite there yet. If you think this is actually kind-of cool, good for you! Analyzing NFC and other 'household' protocols is a really nice hobby, and you can get started using low-cost tools. P.S. Just got a HN 'if this is really your comment, please press Submit again' prompt that I hadn't seen before. Doing as instructed worked, but escaped the formatting chars in my comment, i.e. every asterisk got replaced by a backslash-asterisk. Thrilling, I know...
- GoToRO 3y ago
  Just to add: It's also used to change the cleaning mode of the handle to match the type of the brush attached.
  - masklinn 3y ago
    I assume it’s cleaning mode as in vibration pattern? I ask because I have an old base with an UV brush compartment but I’m quite sure the base has no NFC.
    - exmadscientist 3y ago
      It's probably not even the pattern, just the drive frequency. The system is operated just off resonance, so getting the frequency right is really important. You can do this easily with feedback from the drive assembly and no NFC, or you can do with with NFC to tell you what's on the other end and just do it open-loop. The feedback method is cheaper (I think), so it's what was done previously. But if you want brush head ID, you go the other route....
_Microft 3y ago
On Nitter if you don't want to visit the birdsite: https://nitter.net/atc1441/status/1667252413051424773 https://nitter.net/atc1441/status/1667252413051424773
politelemon 3y ago
This is my favorite kind of HN content, people following their curiosity. This a double-deal since the original story (https://kuenzi.dev/toothbrush/ https://kuenzi.dev/toothbrush/) had someone trying to investigate their toothbrush, someone else couldn't stop thinking about the story, and decided to take it further. Thanks for posting this!
buzer 3y ago
Earlier discussion about the initial hack (sniffing the password & resetting usage hours): https://news.ycombinator.com/item?id=36128617 https://news.ycombinator.com/item?id=36128617
squarefoot 3y ago
Now Philips can choose between: 1- remove that NFC nonsense. 2- leave everything as it is and pretend nothing happened (very likely if the news about the hack don't spread too much). 3- waste time and resources to implement proper encryption plus protection, then enforce it in new Sonicare products, possibly giving also them in exchange of old ones for being "new and upgraded for customer's convenience". Not holding my breath waiting for 1 to happen.
- ac29 3y ago
  > 1- remove that NFC nonsense. That "NFC nonsense" is an optional brushhead replacement reminder feature. It never stops you from continuing to use a brushhead, and if you hate the reminder, you can turn the feature off completely. You can also buy brushheads that dont have NFC chips in them - its not required.
  - sentientslug 3y ago
    I haven't found a way to turn it off completely. I did the thing where you hold the power button but I still get a yellow warning light that the head should be replaced every time I use it.
SV_BubbleTime 3y ago
A 16bit CRC is there “encryption”? Lol, of course it is.

125 points by nmstoker 3y ago

An unrolled version kindly posted by a user in the original thread: https://threadreaderapp.com/thread/1667252413051424773.html https://threadreaderapp.com/thread/1667252413051424773.html Hopefully much easier to read.

JasserInicide 3y ago

Somewhat related: my 10 year old Sonicare is starting to shit the bed so I started to look for a new one. Back then there was 2 models. Now there's like 8, each with several variations and fucking phone app integrations and are several hundred dollars. It was headache-inducing to read through.

culturestate 3y ago
I just went through this too, and I ended up with a Philips One. Its only smart-ish feature is the vibrating quadrant timer, it feels like it cleans more or less the same as my old Sonicare, it uses a normal AAA, and best of all it was like $30. There's no real third-party ecosystem for heads yet, but I'll happily trade that for something that just works.
- beebeepka 3y ago
  I bought the simplest one. No app, no 1000 "different" vibration patterns, no charging glass, no nothing. To me, it looks like they are charging more for increased inconvenience. What a crazy world
  - exmadscientist 3y ago
    Also, consider the Kids model. It's the real deal, just with a kid-friendly sticker on it (designed to be interchangeable by kids, so easy to remove). It's got the full-featured, full-power previous(?) generation Sonicare resonant motor, no NFC, no stupid "pressure sensor" button, and no BS. If you can stand that sticker!
- cwilkes 3y ago
  Expect that to change as Phillips bought SonicCare in 2020. Maybe soniccare will be the high end model and Phillips will be the one with “special offers” aka making you listen to a jingle about mouthwash while brushing your teeth.
  - culturestate 3y ago
    Philips has owned Sonicare for as long as I can remember, at least 15-20 years. My toothbrush is actually branded “Philips One by Sonicare,” but I won’t pretend to know what their strategy is with that.
johnchristopher 3y ago
> my 10 year old Sonicare is starting to shit the bed so I started to look for a new one. Back then there was 2 models. Now there's like 8, each with several variations Electric toothbrush marketing designations are out of control. When I was looking for one I found a website that went out of its way to identify which models were behind marketing wording and numbers and what their specs were (mainly: movements per minute and pulsations per minute). Companies love to rebrand the same models with different numbers based on how many additional brushes they put in the package but they rarely put those specs on their own websites. Anyway, oral b 2700 still looks good. > is starting to shit the bed Off-topic but... language, please ?
- exmadscientist 3y ago
  > movements per minute and pulsations per minute According to an ex-Sonicare senior engineer I work with, this is not actually what's important at all. The key thing they looked at (and still do look at) is the amplitude/travel distance of the bristle tips, and how that changes under load. It should stay strong under light load, but collapse under heavy load (so that when you mash the thing way too hard into your gums, power transfer stops and your gums don't get brutalized). It's a surprisingly delicate balance. We recently had cause to look at a few of these devices (sorry for the vagueness, you know how it goes) and most of the non-Sonicare ones are pretty awful. The rotary Oral-B ones aren't bad at what they are, but they aren't the same. There is one Sonicare clone that really impressed though, and it's not expensive.
  - johnchristopher 3y ago
    > The key thing they looked at (and still do look at) is the amplitude/travel distance of the bristle tips, and how that changes under load. It should stay strong under light load, but collapse under heavy load (so that when you mash the thing way too hard into your gums, power transfer stops and your gums don't get brutalized). It's a surprisingly delicate balance. Isn't that what the pressure sensor is supposed to be for ?
    - exmadscientist 3y ago
bredren 3y ago
We have a pair of 2019 Sonicare that need battery replacements. I picked up a compatible battery but haven’t taken the time to pull it apart yet. It does require soldering. The company scrambled the model numbers and it’s not easy to figure out which are similar or even the same. The obfuscation of product differences, release dates and nerfs to longevity are all over consumer goods. I hope open product designs + micro hyper local manufacturing capability will deeply erode the power of companies creating these wasteful, capital-driven artifacts.
userbinator 3y ago
I'd pay several hundred for a toothbrush that had easily replaceable batteries and other components like shaft seals (with them being standard commonly-available parts), and was designed to last many decades. I don't want any of the "app" crap.
throw0101b 3y ago
> It was headache-inducing to read through. So what did you decide on?

PreInternet01 3y ago

TL;DR: recent (2020-ish) Sonicare brush handles have an alert to remind you when the attached tip has exceeded its useful life, according to the manufacturer's recommendations (which are printed on the packaging as well). This functionality is implemented using NFC, and as per protocol recommendations, there is a password. Given the low cost requirements and extremely low risks, this password is static, and can be sniffed as described in this blog post. If you are at all offended by this, you can feel free to either ignore the Sonicare handle's beeps/lights upon tip expiry, use non-NFC third-party tips, use a non-Sonicare brush handle, use a regular toothbrush, or not brush your teeth at all (not medical advice). Big Toothbrush may be out to get you, but they're not quite there yet. If you think this is actually kind-of cool, good for you! Analyzing NFC and other 'household' protocols is a really nice hobby, and you can get started using low-cost tools. P.S. Just got a HN 'if this is really your comment, please press Submit again' prompt that I hadn't seen before. Doing as instructed worked, but escaped the formatting chars in my comment, i.e. every asterisk got replaced by a backslash-asterisk. Thrilling, I know...

GoToRO 3y ago
Just to add: It's also used to change the cleaning mode of the handle to match the type of the brush attached.
- masklinn 3y ago
  I assume it’s cleaning mode as in vibration pattern? I ask because I have an old base with an UV brush compartment but I’m quite sure the base has no NFC.
  - exmadscientist 3y ago
    It's probably not even the pattern, just the drive frequency. The system is operated just off resonance, so getting the frequency right is really important. You can do this easily with feedback from the drive assembly and no NFC, or you can do with with NFC to tell you what's on the other end and just do it open-loop. The feedback method is cheaper (I think), so it's what was done previously. But if you want brush head ID, you go the other route....

_Microft 3y ago

On Nitter if you don't want to visit the birdsite: https://nitter.net/atc1441/status/1667252413051424773 https://nitter.net/atc1441/status/1667252413051424773

politelemon 3y ago

This is my favorite kind of HN content, people following their curiosity. This a double-deal since the original story (https://kuenzi.dev/toothbrush/ https://kuenzi.dev/toothbrush/) had someone trying to investigate their toothbrush, someone else couldn't stop thinking about the story, and decided to take it further. Thanks for posting this!

buzer 3y ago

Earlier discussion about the initial hack (sniffing the password & resetting usage hours): https://news.ycombinator.com/item?id=36128617 https://news.ycombinator.com/item?id=36128617

squarefoot 3y ago

Now Philips can choose between: 1- remove that NFC nonsense. 2- leave everything as it is and pretend nothing happened (very likely if the news about the hack don't spread too much). 3- waste time and resources to implement proper encryption plus protection, then enforce it in new Sonicare products, possibly giving also them in exchange of old ones for being "new and upgraded for customer's convenience". Not holding my breath waiting for 1 to happen.

ac29 3y ago
> 1- remove that NFC nonsense. That "NFC nonsense" is an optional brushhead replacement reminder feature. It never stops you from continuing to use a brushhead, and if you hate the reminder, you can turn the feature off completely. You can also buy brushheads that dont have NFC chips in them - its not required.
- sentientslug 3y ago
  I haven't found a way to turn it off completely. I did the thing where you hold the power button but I still get a yellow warning light that the head should be replaced every time I use it.

SV_BubbleTime 3y ago

A 16bit CRC is there “encryption”? Lol, of course it is.