8 ms·
Three million malware-infected smart toothbrushes used in Swiss DDoS attacks
- ano-ther 3y agoMy theory is that every technology goes through a period of experimentation before it’s clear how it should be employed. That’s why we had project plowshare for the bomb and now internet connectivity for every imaginable device, even ones that only need an on-off switch. I am a bit mystified why we need connected toothbrushes, but I very much applaud the spirit of experimentation, even if it sometimes gives us toothbrush-powered botnets.
- Levitating 3y agoIs it really experimentation or just slapping a higher price tag onto a device for added wifi connectivity. How do we sell our product X for more? Just add wifi and AI. You can do it with almost anything.
- 082349872349872 3y agoFirst they came for *The Onion* And I did not speak out For I was not an Onion writer Then they came for *Black Mirror* And I did not speak out For I was not a Mirror writer Then they came for Horselover Fat... The sanity is already here – it's just not evenly distributed.
- nonrandomstring 3y ago> every technology goes through a period of experimentation before it's clear how it should be employed. Sure, but as I said here yesterday [0] experimentation is something that has far reaching consequences, and that's why professional scientists have codes of ethics that seem quite absent in the tech world. Also, as far as the Internet goes, we've had maybe 40 years of time to "experiment". There comes a time for results, conclusions and some sort of maturity in outcomes. [0] https://news.ycombinator.com/context?id=39253045 https://news.ycombinator.com/context?id=39253045
- axus 3y agoNo need to teach your children honesty, when you can just spy on their toothbrushes.
- thomastjeffery 3y agoWe're not taking about experimentation, though. We're talking about a fully hashed-out business model with its own casual acronym (SaaS). The "why" is obvious: there is a market for any aggregate data on human behavior.
- anonymouskimmer 3y ago> Normally, the toothbrushes would have used their connectivity for tracking and improving user oral hygiene habits Along with that thread on the Folk computer the other day (https://news.ycombinator.com/item?id=39241472 https://news.ycombinator.com/item?id=39241472 ), and a discussion on signal interference in long-range wifi and the like (https://news.ycombinator.com/item?id=39246399 https://news.ycombinator.com/item?id=39246399 ) this makes me wonder if broad household surveillance centralized to a single computer per home for analysis might have benefits over decentralized IoT computation.
- hef19898 3y agoHow about no household surveillance at all? Crazy idea, I know.
- anonymouskimmer 3y agoThat's what I do. But I presume others like it, so here's an alternative for them. I have an uncle who was really into household automation back in the 80s/90s.
- true_blue 3y agoWhy do toothbrushes need to be able to make web connections in the first place? I get that it's for tracking brushing habits, but can't that be done with local connectivity only, like LAN or something?
- jprete 3y agoBecause the actual business model is selling the aggregated data?
- Gigachad 3y agoWhat data though? How would it be valuable? From what I saw they are getting money from the device sale itself. These iot toothbrushes are like $400 and basically just track brushing time and pressure. Those don't seem like super valuable ad tracking metrics.
- thaumaturgy 3y agoThis might be a fun exercise. Let's assume we have the following data: the user's email address, some sort of smartphone identifying value, their ip address, and their brushing habits. That's not very much; who would want that? Well, we know this is a person who will drop $400 on a toothbrush. They like shiny things, they have at least a middle-class disposable income, and they don't mind the headaches of internet-connected devices. Let's sell this information to big-box electronics retailers and other smart appliance manufacturers. Maybe this person would like to buy a $500 toaster too, or espresso machine, or soda machine, or bread machine, or microwave. They care a little bit about oral hygiene. Have they seen a dentist lately? If they have $400 for a toothbrush, then they probably have better than average dental insurance. Let's also sell their information to the larger dental offices in their area (as determined by IP). Do they need mouthwash? Let's pop up an ad for a subscription mouthwash service. How about floss? Would they perhaps also appreciate a razor made out of aerospace titanium? Oh, but wait ... their IP address just changed, and they are brushing their teeth 3 hours later than typical. They're traveling! They're traveling and they took their expensive toothbrush with them. This opens up an entirely new set of possibilities. Travel insurance? A credit card with travel incentives? New luggage? How about offers for travel upgrades? There are hundreds of companies paying for the opportunity to contact pre-qualified customers that travel with disposable income. Oh, wait ... they just bought a set of lightbulbs that we also make...
- 082349872349872 3y agoI had misremembered these as a single comic, but you can't have everything: https://i0.wp.com/www.litterboxcomics.com/wp-content/uploads/2020/08/gamify-bonus.png?fit=800%2C500&ssl=1 https://i0.wp.com/www.litterboxcomics.com/wp-content/uploads... https://i0.wp.com/www.litterboxcomics.com/wp-content/uploads/2023/04/flying-cars.png?fit=800%2C999&ssl=1 https://i0.wp.com/www.litterboxcomics.com/wp-content/uploads...
- dist-epoch 3y agoThis also good: https://i.imgur.com/YnBnsKA.jpeg https://i.imgur.com/YnBnsKA.jpeg
- deleted 3y ago[deleted]
- kps 3y ago“The door refused to open. It said, “Five cents, please.” He searched his pockets. No more coins; nothing. “I’ll pay you tomorrow,” he told the door. Again he tried the knob. Again it remained locked tight. “What I pay you,” he informed it, “is in the nature of a gratuity; I don’t have to pay you.” “I think otherwise,” the door said. “Look in the purchase contract you signed when you bought this conapt.” In his desk drawer he found the contract; since signing it he had found it necessary to refer to the document many times. Sure enough; payment to his door for opening and shutting constituted a mandatory fee. Not a tip. “You discover I’m right,” the door said. It sounded smug. From the drawer beside the sink Joe Chip got a stainless steel knife; with it he began systematically to unscrew the bolt assembly of his apt’s money-gulping door. “I’ll sue you,” the door said as the first screw fell out. Joe Chip said, “I’ve never been sued by a door. But I guess I can live through it.” — Philip K Dick, Ubik, 1969
- whoisstan 3y agoWarren Ellis at Thingscon 2017 "1. It’s hard. Don’t get me wrong. I know it’s hard. And Samsung and Apple and several other large corporations want in on it. On the bright side, that will give you lots of exit opportunities, and soon you could be drinking cocktails in Bali while Amazon deals with the backlash from the smart doorlock you sold them that still doesn’t work properly. And they’ll spend the money on iteration until the device either goes away or starts working properly, and the users will have to buy Amazon Prime membership for their houses. And then someone will hack your house through the buggy wifi thermostat you bought, and your house will start ordering DOWNTON ABBEY downloads and you’ll come home to find it’s 40 Celsius indoors and the sink is flooded and your fridge has been turned into a porn spambot and you’ll realise that your house is masturbating to DOWNTON ABBEY. If you can get in the front door."
- snow_mac 3y agoDude. This is too much. My fridge is capable of being connected to the internet, so is my oven, garage door opener and my dishwasher. WHY? These things have worked so well without this crap. I wish manufacturers would stop this insanity.
- soco 3y agoTheory: you just don't connect them, right. Reality: connect or it won't start. Next step: integrated sim card.
- notaustinpowers 3y agoThis literally happened to me on Friday. I was setting up a smart TV for my uncle and he just uses it for his Chromecast so I thought "whatever, I'm not going to connect this TV to his wifi." Come to find out, the TV locks you out of EVERYTHING if you do not connect it to the internet. You see the homescreen but you aren't allowed to switch the input unless you connect to the wifi. Even after connecting to wifi, you only get access to FAST channels, and still have to register with a Samsung account before you get permission to change the input. I don't think I had ever been more upset at a piece of tech in my life.
- jimjimjim 3y agoTVs are the worst. Everything except OLED sets have been getting cheaper and cheaper and I'm certain these manufacturers aren't achieving this via production line optimizations. It starts with the connection to vacuum up the data, next comes overlay ads, in a few years it'll be subscription plans instead of a sticker price. and the general public will love it.
- Vrondi 3y agoI had one like this (Toshiba), and I did the initial setup, then blocked it at my router from ever accessing the Internet again. Next TV purchase was a different brand (TCL) that didn't require such stupidity.
- beardyw 3y agoIf only there was a kind of toothbrush which doesn't use the internet. Seems like an opportunity.
- pixxel 3y agoCalm down grandad, the benevolent cloud demands tooth data and it will have its data.
- WalterBright 3y agoWouldn't one have to give the toothbrush your wifi password so it can connect?
- tmiku 3y agoOne probably has to enter the wifi password in an app and then the connection info gets sent to the brush via Bluetooth. That's how my smart watch behaves.
- zzyzxd 3y ago> Though we don’t have the finer details of the DDoS story, it serves as yet another warning for device owners to do their best to keep their devices, firmware, and software updated; monitor their networks for suspicious activity; install and use security software; and follow network security best practices. Maybe they should only allow qualified consumers with required certification to purchase such a smart toothbrush.
- accrual 3y ago> monitor their networks for suspicious activity Indeed. It's asking the same people who only know their router as a box where the internet comes from to run a packet capture and interpret the results.
- abdullahkhalids 3y agoThe call if of course on device owners, and not device manufacturers whose responsibility it truly is to manufacture secure devices.
- d4mi3n 3y ago100% agree, but I have to wonder how much of the problem is that the cost of security is: A. Not mandated B. Increases cost of the product At what point would people just prefer a regular toothbrush if a smart one doesn't provide enough utility to justify the cost? This isn't specific to toothbrushes, but I wonder what products or services wouldn't exist if they were made to be secure (or safe/ethical/sustainable/etc). Makes me wonder how many existing externalities are causing hard to measure problems that could be prevented by making a higher quality product.
- abdullahkhalids 3y agoOf course it's because security is not mandated. In the past, and in the present, there are many companies who are willing to kill people for the sake of profits, if they can get away with it legally. IMHO, any commercial violations of human rights, like privacy, should have criminal penalties.
- imglorp 3y agoIs nobody going to mention Java running on the toothbrush? One might guess the firmware included a battery controller, bluetooth or wifi stacks, a little storage, and business logic for buttons and brushing.
- cfeduke 3y ago3 billion devices run Java! ;)
- duohedron 3y ago"3 Billion Devices Run Java" Maybe not all of them should.
- tjasko 3y agoWhy does it matter? Embedded Java is quite popular. https://en.wikipedia.org/wiki/Embedded_Java https://en.wikipedia.org/wiki/Embedded_Java
- p91paul 3y agowell, you need to have something to run that business logic (which includes phoning home to the manufacturer), don't you? Java is as good as any other runtime.
- Thaxll 3y agoThat's the reason why you need some serious router at home, one with vlan capabilities so all those iot devices get sandboxed network wise.
- Freebytes 3y agoI dread the inevitable "Internet dildo wars of 2037" where millions of networked dildos and refrigerators wreaked havoc on the entire Internet causing billions in damage. "Suspects remain at large."
- Twirrim 3y agoThat's a really flimsy article. Someone is claiming 3 million smart toothbrushes were used in a DDoS, but no one is talking what/who/how. That seems like the kind of extraordinary claim that requires at least some kind of evidence. There is surely at least some technical details that enabled them to identify the toothbrushes, right?
- blacksmith_tb 3y agoIt also seems odd that even if you (maybe unknowingly) connected your 'smart' toothbrush to wifi, it would be exposed to the public internet. Aren't most people using some kind of clunky cable modem etc. from their ISP, which would have a basic inbound firewall?
- d1sxeyes 3y agoHypothetically, let’s say these toothbrushes connect periodically to an API from which they fetch firmware updates. If you’re able to MitM that connection, you could deliver whatever you like as a firmware payload to the toothbrush. Or maybe someone designed the toothbrush to open ports using UPNP to enable a remote connection to tell the toothbrush that the update server has moved to a new URL?
- Retr0id 3y agoThere's lots of ways for this expectation to be broken. The most obvious is UPnP, where the device can ask the gateway router to forward ports. The second is the fact that devices on the LAN are accessible to other devices on the LAN. Malicious JS in a webpage can scan for and compromise other local devices. And the third is the fact that whatever serves code to the toothbrush (whether it's firmware updates, or an HTML5 dashboard) can be compromised. In the latter case, it could be something as simple as persistent XSS.
- gtirloni 3y ago> The second is the fact that devices on the LAN are accessible to other devices on the LAN. Malicious JS in a webpage can scan for and compromise other local devices. Which browser API enables that?
- stcredzero 3y agoThis headline reads like a story element from the Silicon Valley TV series.
- hsuduebc2 3y agoIn 2024 there will be flying cars! Meanwhile.
- the_wolo 3y agoDental Denial of Service
- dessant 3y agoA warning about Philips electric toothbrushes: you cannot turn off Bluetooth on them, even if you are not using the smart features. Also be careful with all Philips air purifiers that support Wi-Fi, because the remote control feature cannot be disabled. They create a Wi-Fi hotspot that you need to connect to with a smartphone to finish setting up the device, but if you don't use these features, the air purifier will create a permanent Wi-Fi hotspot, waiting to be exploited.
- whyenot 3y agoYou might not be able to turn bluetooth off, but you can choose not to pair them with anything (or remove the pairing after setting up the device).
- dessant 3y agoThe issue is what happens to these toothbrushes in a couple of years when their vulnerabilities will be discovered. Their inevitable exploitation could be prevented by simply allowing to turn off bluetooth. Or even better, only enable bluetooth if the user wants to set up and use these smart features, at least in that case the vulnerable firmware can be updated using the smartphone app.
- ethbr1 3y ago"Shipped dumb by default" is enticing as a legal requirement. Have a colorful switch to enable it, whatever. But poor security posture out of the box, for a questionably-supported, poorly-developed, long-lived physical device seems important enough to mandate slight one-time inconvenience. In the future, this bullshit is going to be looked back at like default passwords on ISP WAPs.
- dmix 3y agoWhat risks could a WiFi hotspot on an air purifier expose if it's not connected to the network or a computer?
- 3y ago
- whyenot 3y agoAssuming that the article accurately reports the facts (I have my doubts) and these unnamed toothbrushes were used in DDoS attacks, it seems like the obvious deterrent would be for the harmed party to sue for damages. That seems like it work to deter companies from making internet connected when they aren't really needed.
- usefulcat 3y agoCame here expecting to find something from The Onion
- jakub_g 3y agoEvery internet-of-shit device should be legally required to go through a security audit, and the vendor should commit to mandatory 5 years of API being up + 5 years of security updates, with N days to fix CVEs with severity over a certain threshold. Would make the shitty vendors think twice before creating piles of e-waste due to zero cost of entry.
- mikkohypponen 3y agoIf It's Smart, It's Vulnerable.
- GrumpyNl 3y agoWhy you would buy a toothbrush that needs a app and wifi is beyond me.
- tjasko 3y agoThis article is strange & many details are lacking. All the big smart toothbrushes use BLE and are not WiFi-connected. Tried to fact-check the article, but nothing. A bunch of BLE chips are also WiFi capable, so not ruling out that someone compromised the firmware to enable WiFi functionality, but I wonder how they were able to connect to WiFi to trigger a botnet in the first place. Quite skeptical of this article, while the premise of the danger of IoT devices still remains, nonetheless.
- a321neo 3y ago>A bunch of BLE chips are also WiFi capable, so not ruling out that someone compromised the firmware to enable WiFi functionality The ESP32 is now used as a general-purposed chip even in applications where an 8-bit MCU would have been enough. A remotely exploitable vulnerability in the ESP32/SDK could have large-scale consequences.
- deleted 3y ago[deleted]
- exe34 3y agoLeaves open the question of how they joined the network - WiFi passwords and such. Maybe stolen from the phones/laptops and then sent to the device as part of the exploit?
- graypegg 3y agoI could imagine there’s a lot of toothbrushes near unsecured wifi hotspots. (Hotels, in backpacks of travellers in a cafe, a demo unit in a store) Could be as simple as polling continuously till one allows the device to phone home. This does seem to be a debunked story though.
- deleted 3y ago[deleted]
- greggsy 3y agoThe only way to load firmware to consumer esp platforms is usually via mobile apps… so, someone with privileged access to consumer’s apps, or the supply chain, used that access to load bespoke firmware to toothbrushes.. highly doubtful.
- a_shoeboy 3y agoI wish my lone internet-of-shit device worked well enough to participate in a botnet. My house came with an internet connected sprinkler system--if the power blips, the sprinkler system boots up before the WIFI router, can't connect and then refuses to work until rebooted. I realized this when my lawn started dying.
- rkagerer 3y agoI have an older Phillips toothbrush without Bluetooth, Internet or vendor-locked heads, and it charges wirelessly in a glass cup. I love it. I recently tried to buy a second one and could only find newer models with all these garbage features I don't want. Who the hell wants their toothbrush to connect to the internet? Wound up turning to eBay to find stock of the old one. It might sound cruel, but I hope the moron who decided to add these features into their product, and the lackey who implemented it, are having a bad day and reflecting on the wisdom of what they did.
- jhbadger 3y agoWifi is silly, but there really is a benefit to the Bluetooth/app connection -- it is used to see where you are brushing and spots you are missing. My dentist definitely has seen an improvement in the plaque in my back teeth since I started using a smart toothbrush that uses an app on my phone.
- kwhitefoot 3y ago> spots you are missing Just brush each tooth systematically. My dentist tells me "Just keep doing what you are doing." I have the cheapest Braun Oral-B with a two minute timer. I've worked out by trial and error that that is about the time to stroke each face of each tooth about twelve times. Now I do that even if it takes a bit longer than two minutes because I occasionally brush slower.
- progbits 3y agoHow does it know the location you are brushing?
- zelphirkalt 3y agoBluetooth from the teeth! It is in the name ; )
- jhbadger 3y agoHa! But presumably the bluetooth is there to tell the app what it measured and to visualize it. But presumably through a combination of sensors and accelerometers
- MichaelMoser123 3y agoStanislav Lem wrote the "Washer Tragedy" where washing machines got smarter and were taking over. I think he would have been proud of these toothbrushes...
- BlueTemplar 3y agoStill better than three million plain infected toothbrushes, which is what this looked at first glance !
- nottorp 3y agoWaiting for the refrigerator...
- beeandapenguin 3y agoWhich toothbrush company/product are they referring to? The stock image implies Phillips, but I don't see any mention of that in the article. Never thought I'd be judging a toothbrush based on cybersecurity, but here we are...
- vivzkestrel 3y agoI challenge the hackers to hack my toothbrush , i ll even send it you with Fedex
- maxglute 3y agoHow many bitcoins can three million toothbrushes mine?
- deleted 3y ago[deleted]
- ongytenes 3y agoThe day is comming... Man: Today I found out my toothbrush has been infected by a virus. Wife: Did you tried soaking it in bleach to sterilize it? Man: It wasn't that kind of virus. It was a computer virus. Wife: !??? .
- croes 3y agoDidn't happen, confirmed by Fortinet https://news.ycombinator.com/item?id=39300373 https://news.ycombinator.com/item?id=39300373