20 ms·
The three million toothbrush botnet story isn't true
- nevi-me 3y agoIt's hard to believe that toothbrushes run Java. There's just not enough space in them for that. Plus 3 million is a huge number.
- aidenn0 3y agoIs Java ME the smallest Java platform with ~8MB of RAM as a requirement? [edit] No, Java ME CLDC can run on devices with as little as 160kB of ROM and 8kb of RAM.
- vizzier 3y agoYou get into "does this still really count as java" but I believe this runs in most sim cards: https://en.wikipedia.org/wiki/Java_Card https://en.wikipedia.org/wiki/Java_Card
- supportengineer 3y agoAnyone remember the Java ring given out at JavaOne? https://www.ebay.com/itm/300495374337 https://www.ebay.com/itm/300495374337
- throw-away_42 3y agoJava in a 5x18mm device over 20 years ago: https://csrc.nist.gov/csrc/media/projects/cryptographic-module-validation-program/documents/security-policies/140sp111.pdf https://csrc.nist.gov/csrc/media/projects/cryptographic-modu...
- jeffbee 3y agoNot to mention java card
- nicce 3y agoDo you know the origin of Java? Fun fact, it was originally made for embedded, small electrical devices. While not exactly, small, the first Java product was remote controller with touchscreen... https://archive.org/details/Star7Demo https://archive.org/details/Star7Demo
- anigbrowl 3y agoYou can run Java on an ESP32, though why you would want to is another question.
- adolph 3y agoConnect it to a relay to start your brew in the morning?
- clwg 3y agoAt 3 million it would be the 8th largest botnet ever discovered. https://en.wikipedia.org/wiki/Botnet#Historical_list_of_botnets https://en.wikipedia.org/wiki/Botnet#Historical_list_of_botn...
- askvictor 3y agoMost SIM cards run Java
- Retr0id 3y ago3 billion devices run java.
- miki123211 3y agoYour credit / debit card (and probably your SIM card) run Java[1]. So did most cellphones from the early 2000s[2]. I can believe that some IoT devices run chips more powerful than your average phone from 20 years ago. [1] https://en.wikipedia.org/wiki/Java_Card https://en.wikipedia.org/wiki/Java_Card [2] https://en.wikipedia.org/wiki/Java_Platform,_Micro_Edition https://en.wikipedia.org/wiki/Java_Platform,_Micro_Edition
- jcrawfordor 3y agoJavaCard has actually lost a lot of its popularity for ICC applications like credit cards and SIMs. It's hard to get good numbers from the industry, which tends towards secretive, but these days SELP and MULTOS seem more popular. Of course the availability of multiple OS for these devices reinforces the idea that you can run a lot of things on some very low power devices these days. At the same time, it's important to understand that JavaCard is a very constrained version of Java. Most JavaCard platforms have no support for IP networking, which would make it an unlikely source of DDoS (besides the fact that it requires relatively specialized developer tooling).
- miki123211 3y ago> Most JavaCard platforms have no support for IP networking, which would make it an unlikely source of DDoS I'm not claiming that you could use a smart card for DDoS (the idea seems absurd, but somebody is probably going to prove me wrong one of these days), merely that if some version of Java runs on a smartcard, I don't find it that unimaginable for a toothbrush to have a good enough chip to run Java, perhaps with enough resources for a TCP / IP stack. Something equivalent in performance to an old, WAP-capable phone that also ran Java ME, perhaps.
- c0balt 3y agoYou can, today, buy ARM chips with support for executing simple Java Bytecode directly. The Jazelle[0] earchitecture is a primary intended to accelerate JVMs[1] and is still found on some devices. There also were some other initiatives around embedded devices on the past to get Java running on smart cards and more. [0]: https://en.m.wikipedia.org/wiki/Jazelle https://en.m.wikipedia.org/wiki/Jazelle in [1]: https://developer.arm.com/documentation/ddi0406/c/Application-Level-Architecture/Application-Level-Programmers--Model/Jazelle-direct-bytecode-execution-support?lang=en https://developer.arm.com/documentation/ddi0406/c/Applicatio...
- stairlane 3y agoWhile part of me wishes the story were true, as it’s just hilarious thinking about _a toothbrush_ carrying out someone else’s ill will. I am glad it’s not.
- hinkley 3y agoIt’s truthy, of the sort that is plausible. Someday a headline like this will actually be true. I think of it more like accidentally publishing a prewritten celebrity obituary.
- gnabgib 3y agoRelated: "Three million malware-infected smart toothbrushes used in Swiss DDoS attacks" (226 points, 136 comments) [0]: https://news.ycombinator.com/item?id=39277990 https://news.ycombinator.com/item?id=39277990
- tempest_ 3y agoMy "smart" tooth brush wants my location data to use the app....
- RockRobotRock 3y agohttps://android.stackexchange.com/questions/160479/why-do-i-need-to-turn-on-location-services-to-pair-with-a-bluetooth-device https://android.stackexchange.com/questions/160479/why-do-i-... if you use an iPhone, my apologies
- gruez 3y agoAFAIK that's because granting access to bluetooth potentially allows the app to track your location (via bluetooth beacons). As a result both iOS and Android show the location warning just in case the app wants to do something malicious. Just because you see the warning doesn't mean the app is trying to ship your location to China.
- tempest_ 3y agoI have had the tooth brush for a while, maybe four or five years. When I saw your comment I figured I should check and see and it looks like they dropped the location permission. https://play.google.com/store/apps/details?id=com.philips.cdp.ohc.tuscany&hl=en_CA&gl=US https://play.google.com/store/apps/details?id=com.philips.cd...
- abhibeckert 3y agoOn iPhone, bluetooth is presented to the user as a location check. Big data companies will if you're near your toothbrush then you're at home. And they can figure out where "home" is by other tracking methods.
- gruez 3y ago>Big data companies will if you're near your toothbrush then you're at home. And they can figure out where "home" is by other tracking methods. You don't need bluetooth to do that. By keeping track of your public/private ip (which requires no special permissions), and correlating it to time of day, it's fairly easy to infer whether you're home or not. If there's a network you're regularly connected to during the evening and weekends, it's highly probable that you're "home".
- mysterydip 3y agoisn't true... yet.
- autoexec 3y agoHere's the link to the actual article instead of someone's social media post that contains a screenshot that contains an unclickable link to the article: https://www.tomshardware.com/networking/three-million-malware-infected-smart-toothbrushes-used-in-swiss-ddos-attacks-botnet-causes-millions-of-euros-in-damages https://www.tomshardware.com/networking/three-million-malwar... Disclaimer: Maybe the image is clickable or there's a clickable link in the social media post for most people, but because Mastodon doesn't show posts without javascript enabled I can only ever see whatever shows up in the RSS feed.
- deleted 3y ago[deleted]
- PurpleRamen 3y agoThis is not the original article, it's just an article taking up and spreading the claim. The original article[1] they linked is from a German newspaper in Switzerland, predating the article from tomshardware.com by a whole week. [1] https://archive.ph/2024.01.30-203406/https://www.luzernerzeitung.ch/wirtschaft/kriminalitaet-die-zahnbuersten-greifen-an-das-sind-die-aktuellen-cybergefahren-und-so-koennen-sie-sich-schuetzen-ld.2569480 https://archive.ph/2024.01.30-203406/https://www.luzernerzei...
- autoexec 3y agoYou are right, it's just the article that was included in the social media post. The German article says it got the information from a report by fortinet. I didn't notice anything about the DDoS attack there, but i did find these: https://filestore.fortinet.com/fortiguard/research/mobileiot-vb.pdf https://filestore.fortinet.com/fortiguard/research/mobileiot... https://filestore.fortinet.com/fortiguard/research/toothbrush.pdf https://filestore.fortinet.com/fortiguard/research/toothbrus...
- 2024throwaway 3y agoThe story isn't true _yet_.
- RobCodeSlayer 3y agoWasn’t this a Silicon Valley plot line, but with fridges?
- compiler-guy 3y agoI mean, are you sure your toothbrush is getting security updates? Because not many other devices on the internet of things are.
- __jonas 3y agoThe linked archived article says quite specifically that while the example sounds like a hollywood story it really did happen. I don’t doubt that the article is wrong or they misunderstood their source though, since it’s just a random local news article about the dangers of ‘cybercrime’ which was apparently used as a source by these larger publications.
- BangbokAsin 3y ago[flagged]
- Aaronmacaron 3y agoProof? This is just some random person claiming it's not true but they link to an article which explicitly states that it is in fact true. Am I missing something?
- n2d4 3y agoI believe the Mastodon OP mistranslated the German article, which states: > Das Beispiel, das wie ein Hollywood-Szenario daherkommt, hat sich wirklich so zugetragen. Correct translation: > This example, which seems like a Hollywood scenario, actually happened. But as you can see, if you miss the last part, it's easy to get the translation wrong. (Interestingly, the Swiss article doesn't directly quote Fortinet as a source, but as an expert opinion. Maybe something was lost in translation there when the story went viral?)
- croes 3y agoI think OP wants to say that the only source for such a massive bot net is a tiny newspaper article. Million dollar damage because a Swiss site wasn't reachable for 4 hours? I doubt that.
- sschueller 3y agoIt's Switzerland. Maybe it was a watch website that could sell a few 100k watches...
- parl_match 3y agoThe claim being made is ludicrous, doesn't hold up to scrutiny or common sense, and the amount of details given is sparse enough to cause disbelief. If this is real, the article is beyond useless in informing people of what has happened and how it's happened.
- deleted 3y ago[deleted]
- qwertox 3y ago
- deleted 3y ago[deleted]
- Havoc 3y agoI did think it was kinda sus because those are usually Bluetooth not WLAN connected but hey maybe there are wifi brushes now
- n2d4 3y agoThere are some: https://oralbconnect.com/faq/#question-6a2zEDL932GFQWv1HhT255-sense https://oralbconnect.com/faq/#question-6a2zEDL932GFQWv1HhT25...
- SushiHippie 3y agoThe article says: > Das Beispiel, das wie ein Hollywood-Szenario daherkommt, hat sich wirklich so zugetragen. Google translate: > This example, which seems like a Hollywood scenario, actually happened. So this article states that this actually happened. So OP's claim that this article states it's just an example which didn't happen, is incorrect. I'm not saying it did happen, just that the article does not state what OP says.
- hobobaggins 3y agoYes. Or we would end up comparing multiple news stories, presumably at least partly fact-checked (but you never know these days), against a single post on a random social network.
- c0balt 3y agoThe translation is correct regarding the articles claim of the stories legitimacy. To expand on the initial dramatized story: > Sie steht zu Hause im Badezimmer, doch sie ist Teil einer gross angelegten Cyberattacke. Die elektrische Zahnbürste ist mit Java programmiert, und unbemerkt haben Kriminelle darauf eine Schadsoftware installiert – wie auf 3 Millionen anderen Zahnbürsten auch. Ein Befehl genügt, und die ferngesteuerten Zahnbürsten rufen gleichzeitig die Website einer Schweizer Firma auf. Die Seite bricht zusammen und ist für vier Stunden lahm gelegt. Es entsteht ein Schaden in Millionenhöhe. The article claims that an electric toothbrush with Java-based software was the target of malware. Criminals then leveraged this malware to execute a ddos from the toothbrushes against the website of a swiss business. The article further claims this led to a downtime for around five hours with expect damages in the millions.
- gotoeleven 3y agoDentist: You've got seven cavities Me: Damn garbage collector
- dylan604 3y ago>The article claims that an electric toothbrush with Java-based software was the target of malware The chef's kiss moment of this story would be that it was Log4J vuln that was unable to be patched because why would they make updates to a toothbrush. I'm guessing that would complete somebody's bingo card. Who had DDoS attack, Botnet, IoT Device, Java, Log4J?
- Linda231 3y ago[flagged]
- xp84 3y agoI'm more surprised people took that seriously. I really don't think even 1 million toothbrushes exist that have any IP connectivity at all, let alone three million all being pwned. I would assume that if anyone had sold that many Wi-fi models, one of the big manufacturers would have some, and as far as I'm aware, none do, they all use Bluetooth. Not sure I buy that a bluetooth toothbrush can DDOS a website.
- n2d4 3y agoFrom a quick Google search, at the very least Oral-B uses WiFi on some of their models: https://oralbconnect.com/faq/#question-6a2zEDL932GFQWv1HhT255-sense https://oralbconnect.com/faq/#question-6a2zEDL932GFQWv1HhT25...
- c0balt 3y agoRelated: https://filestore.fortinet.com/fortiguard/research/toothbrush.pdf https://filestore.fortinet.com/fortiguard/research/toothbrus... A research presentation by fortinet covering a BLE-enabled toothbrush that communicates with the cloud over a mobile app. Also mentioned by a comment on the original post.
- WeylandYutani 3y agoI bought a frankly too expensive iO10 and it only connects to my phone via Bluetooth.
- jfoster 3y agoReminds me a little of Stuxnet, which certainly happened: https://www.quora.com/What-is-the-most-sophisticated-piece-of-software-ever-written-1/answer/John-Byrd-2 https://www.quora.com/What-is-the-most-sophisticated-piece-o... Things like this combined with AI are the scariest version of the future, I think. If we ask a very capable AI to solve climate change, what if it decides to solve it by creating something like Stuxnet for human infrastructure?
- NikolaNovak 3y agoPeter Watts novel Starfish, a stunning quarter century old now, has exactly that problem as part of its side plot. In a chilling detail relevant to today, it posits a black-box trainable neural network (biological in the book but an irrelevant difference overall) tasked with solving some of the big issues, which makes subtle links and determinations in the model which eventually end up potentially disastrous for human kind.
- CoastalCoder 3y agoOoh! Just yesterday I an old radio performance [0] of the short story, "A Logic Named Joe" [1], which also seems very apropos. Highly recommended! [0] https://www.relicradio.com/otr/2021/12/a-logic-named-joe-by-dimension-x-2/ https://www.relicradio.com/otr/2021/12/a-logic-named-joe-by-... [1] https://en.wikipedia.org/wiki/A_Logic_Named_Joe https://en.wikipedia.org/wiki/A_Logic_Named_Joe
- deleted 3y ago[deleted]
- camdenlock 3y agoUgh, god. This link led me to read the mastodon front page for a while (popular posts across the mastodon fediverse). Total ideological lockstep combined with intense self-righteousness, and not a single contrarian opinion in sight.
- Volpmolll 3y ago[flagged]
- Volpmolll 3y ago[flagged]
- croes 3y agoFortinet confirmed it wasn't a real attack https://news.ycombinator.com/item?id=39300373 https://news.ycombinator.com/item?id=39300373
- m_st 3y agoI was wondering because the toothbrushes I know use BT(LE) and aren't connected to the Internet. However, some light bulbs do have WIFI and sure one day could be exploited. And there are definitely more light bulbs than toothbrushes around here.
- hulitu 3y agoAnd all those TVs and fridges. And even the peacemakers could one day deliver malware. /s "Be afraid, be very afraid" Wednesday Addams - Addams Family Values
- bArray 3y ago> And all those TVs and fridges. And even the peacemakers could one day deliver malware. /s It's not the pacemaker malware you want to worry about, it's the pacemaker ransomware!
- peteradio 3y agoHe said peacemaker, I assume hes talking about colt single action revolver.
- bArray 3y agoGood point. Maybe you have an occasion to defend yourself and the weapon won't unlock [1] before depositing some BTC [2]. [1] https://www.wired.com/2014/05/sentinl-gun-lock/ https://www.wired.com/2014/05/sentinl-gun-lock/ [2] https://www.bleepingcomputer.com/news/security/hacker-used-ransomware-to-lock-victims-in-their-iot-chastity-belt/ https://www.bleepingcomputer.com/news/security/hacker-used-r...
- asystole 3y agoYou're not thinking like a modern *aaS company. I'm waiting for subscription-based pacemakers. $9.95/mo for up to 60 beats per minute or $19.95 for unlimited heartbeats. Sign up for a year now and get an additional 3 months free :)
- jakedata 3y ago3M (the Minnesota Mining and Manufacturing Company) makes many products but teethbrushes are not among them. However they are well equipped to satisfy all your PFOA and PFAS needs forever.
- mensetmanusman 3y agoIf you are using floss, it is likely PFAS coated. Also lipitor, prozac, cipro, flonase and nearly a majority of new pharmaceuticals in development. 'PFAS bad' is about as sophisticated a viewpoint as 'nuclear bad'. Also, 3M is exiting PFAS tech since it only accounts for a few % of their business: https://news.3m.com/2022-12-20-3M-to-Exit-PFAS-Manufacturing-by-the-End-of-2025 https://news.3m.com/2022-12-20-3M-to-Exit-PFAS-Manufacturing...
- possibly_not 3y agoThis viewpoint seems short-sighted. In the 1940s and 1950s, if somebody were skeptic of lead, you could've replied "Do you paint your home? Get your water from pipes in your house? What about having gas in your car?"
- mensetmanusman 3y agoOne wears a lead vest when getting x-rays at the hospital or as protective equipment when operating on nuclear reactors. Moving beyond eating lead doesn't mean not using it intelligently when the risk profile is low. Also, lead-based glass is also an important component of the world's high-efficiency perovskite solar cells. Many of the industrial products materials we wouldn't want to eat, this just means we have to be better about recycling.
- apapapa 3y agoNot sure why x-rays are still being used when there appears to be better and safer alternatives... Specially at the dentist where an inexperienced person shoots them at your head... Thank God they cover your chest with lead though....
- nonrandomstring 3y agoThis fake story is propagated in anticipation of significant changes coming into effect in Europe this year wrt the E.U. "Cybersecurity Act" and "Cyber Resilience Act" which specifically targets IoT device security. In the US you will have "Cybersecurity Improvement Act" with serious consequences for non-compliant devices under EO 14028. Expect more "March of the Killer Toothbrushes" stories soon.
- araes 3y agoMany relevant goals of the IoT Cybersecurity Improvement Act of 2020 [1] have already been implemented. Executive Order E.O. 14028 of May 12, 2021 "Improving the Nation's Cybersecurity" is substantially similar in requirements. NIST in particular got called out for work and already implemented "IoT Cybersecurity Guidance" [2]. Mostly part of "Trustworthy Network of Things". [3] Also [4]. [1] (Public Law No: 116-207), https://www.congress.gov/bill/116th-congress/house-bill/1668 https://www.congress.gov/bill/116th-congress/house-bill/1668 [2] NIST, IoT Guidance and Catalog, https://csrc.nist.gov/News/2021/updates-to-iot-cybersecurity-guidance-and-catalog https://csrc.nist.gov/News/2021/updates-to-iot-cybersecurity... [3] Trustworthy Network of Things, https://www.nist.gov/programs-projects/trustworthy-networks-things https://www.nist.gov/programs-projects/trustworthy-networks-... [4] IoT Cybersecurity, https://www.nist.gov/itl/applied-cybersecurity/nist-cybersecurity-iot-program https://www.nist.gov/itl/applied-cybersecurity/nist-cybersec...
- nonrandomstring 3y agoI wish we had a longer form discussion framework, as I'd be curious to know what USians think of how this is going - but anyway thanks very much for those useful links on how it's working stateside.
- araes 3y agoEither replying here works, or profile has a fairly simple to solve contact if you really want to ask me those questions. Tend to fairly regularly check comments from at least the last week to see if anybody responded. Notably, while following the situation, and knowing a bit about the IoT world, not deeply involved in microcontrollers or IoT design. Mostly aerospace personally. Some experience with Wifi and Bluetooth development for Windows and Android, with a bit of Arduino, yet that's the perspective for discussion / questions. Can refer you to a few NIST folks and some NIST mailing lists.
- croes 3y agoSeems like Fortinet lied about the whole translation error thing: https://www.aargauerzeitung.ch/wirtschaft/cyberangriff-die-gehackten-zahnbuersten-gehen-medial-um-die-welt-und-loesen-fragen-aus-wie-es-dazu-kam-ld.2577182 https://www.aargauerzeitung.ch/wirtschaft/cyberangriff-die-g... >Was nun von der Fortinet-Zentrale in Kalifornien als «Übersetzungsproblem» bezeichnet wird, hat sich bei den Recherchen noch ganz anders angehört: Schweizer Fortinet-Vertreter haben bei einem Gesprächstermin, bei dem es um aktuelle Bedrohungslagen ging, den Zahnbürsten-Fall als reale DDoS-Attacke geschildert. Translation: >What the Fortinet headquarters in California is now describing as a "translation problem" sounded very different during the research: Swiss Fortinet representatives described the toothbrush case as a real DDoS attack during a meeting to discuss current threat situations. And >Der Text wurde Fortinet vor der Publikation zur Verifizierung vorgelegt. Der Satz, wonach es sich um einen realen Fall handle, der sich wirklich so zugetragen hat, wurde nicht beanstandet. >The text was submitted to Fortinet for verification before publication. The sentence stating that this was a real case that actually happened was not objected to. Truth seems not to be part of their business model https://gpl-violations.org/news/20050414-fortinet/ https://gpl-violations.org/news/20050414-fortinet/
- anonymouskimmer 3y ago1) You can have translation errors between people within a company. 2) Just because it was submitted for verification prior to publication doesn't mean that it was read, or read thoroughly. Or heck, maybe it was read by the very employees who mistakenly thought it was real. Plausible if it was, as indicated in your comment, a german article. 3) Violating a software license has nothing to do with "truth", but lawfulness. These would probably be highly correlated traits in many individuals, but they certainly don't have to be.
- croes 3y agoThe story was published January 30th, plenty of time to inform the news paper about the error. The lied about the use of GPL code by intentional obfuscation of GPL software use.
- jokoon 3y agoToo bad because it was quite a funny story. I mean in retrospect, I can imagine it would be almost impossible to find all those toothbrushes and hack them remotely, unless they were all connected to a central server that would have been hijacked, so yeah.
- dang 3y agoI changed the URL from https://cyberplace.social/@GossiTheDog/111886558855943676 https://cyberplace.social/@GossiTheDog/111886558855943676 to https://cyberplace.social/@GossiTheDog/111892646485958733 https://cyberplace.social/@GossiTheDog/111892646485958733, as suggested here: https://news.ycombinator.com/item?id=39297612 https://news.ycombinator.com/item?id=39297612. Readers should probably look at both. I have no idea why https://cyberplace.social/@GossiTheDog/111886558855943676 https://cyberplace.social/@GossiTheDog/111886558855943676 doesn't lead to that later post in the thread. Is there a way to guarantee that readers get the entire thread in these things? If people can only see the start, that's not much better than what Twitter does.
- proactivesvcs 3y ago676 (original post) does lead to 733 (screenshot of clarification) but the latter is about the sixth reply down the list. Both links guarantee readers see the entire thread, but they would have to know that they need to scroll for additional context.
- dang 3y agoNot for me, nor apparently for wut42: https://news.ycombinator.com/item?id=39300970 https://news.ycombinator.com/item?id=39300970. Scrolling down to see everything is what I'd expect, and had 733 shown up when I scrolled down, I wouldn't have changed the URL.
- proactivesvcs 3y agoHuh you're both right, I hadn't checked carefully enough. I guess the Mastodon threads UX needs a bit more work.
- WhyUVoteGarbage 3y agoXref to me getting partly to the bottom of it: https://news.ycombinator.com/edit?id=39305884 https://news.ycombinator.com/edit?id=39305884 Starting at https://cyberplace.social/@GossiTheDog/111886558855943676 https://cyberplace.social/@GossiTheDog/111886558855943676 First reply is from the OP, and the visual "thread" (vertical line) on the left side is broken. Click on that reply ("The toothbrush thing has gone viral despite it being total bollocks."). Now again scroll down through posts by the OP until the "thread" on the left side breaks. Click on that last reply ("Fortinet also declined to comment to me."). Finally, the target post appears as a reply to that ("Fortigate have issued me a statement.") Navigational issue. One might ask what is the difference between the follow-ups that show up automatically and the ones that don't show up until you navigate. I don't know.
- xg15 3y agoA translation problem. Between a Swiss company and the Swiss newspaper that interviewed them. Of course.