4 ms·

The 'toothbrush bot armies' are entirely believable though. The story was not real, but is completely within the realm of reality. E.g. Perhaps the toothbrush

The 'toothbrush bot armies' are entirely believable though. The story was not real, but is completely within the realm of reality. E.g. Perhaps the toothbrush has a connectivity check to OralB servers that triggers once per hour, but you can change it to check a victim webpage once a millisecond. Smart toothbrushes (and/or their docks) have little computers inside of them. Oral B smart toothbrushes offered an API eight years ago https://github.com/dukescript/dukebrush https://github.com/dukescript/dukebrush as well as a real-time web API: https://web.archive.org/web/20160310121235/https://developer.oralb.com/ https://web.archive.org/web/20160310121235/https://developer... All there would need to be is an exploit that allows someone to (1) identify and talk to the toothbrushes, (2) coerce the toothbrush to ping an arbitrary IP, and (3) cause step 2 to happen many times for just one trigger.

hn_throwaway_99 3y ago
> The story was not real, but is completely within the realm of reality. Of course. A good lie is defined by it being relatively believable. Re: the viability of the exploit, my understanding is that most smart toothbrushes do not connect to the Internet, and even if they did, the huge numbers originally presented in the story (3 million toothbrushes) are astronomically high.
- lynndotpy 3y ago
  Yeah; even ~300K or so (like Mirai in 2016) would be surprisingly high.
kube-system 3y ago
Yes it has an API, but that doesn't mean it's on the internet. To connect via that API you have to connect to the toothbrush via bluetooth.
- TeMPOraL 3y ago
  Bluetooth is a PITA, low-budget "smart" devices are all becoming Wi-Fi now.
  - kube-system 3y ago
    Nevertheless, no major toothbrush manufacturers use Wi-Fi. Oral B and Philips connected brushes all use bluetooth.
    - lynndotpy 3y ago
      I know someone who owns an "Oral-B iO series 10" and they said they connected it directly via Wi-Fi. It's possible they got it wrong, but multiple product reviews on the internet explicitly mention difficulties getting their Wi-Fi password onto the device.
    - ben_w 3y ago
      I can't help but feel bluetooth is the wrong symbolism for a toothbrush.
- lynndotpy 3y ago
  > Yes it has an API, but that doesn't mean it's on the internet. See the second link, the "Web API" section. This is the part tells me that it's on the internet. > WEB API > The Oral-B cloud service offers fast and reliable real-time access to Oral-B brushing activity. Fetch brushing data ranging from session frequency and duration to activity stats, achievements and more. Integrate brushing activity data* with health or lifestyle applications. I don't know about all the older models, but I know the latest Oral-B smartbrush connects directly to the internet using Wi-Fi.

hn_throwaway_99 3y ago

> The story was not real, but is completely within the realm of reality. Of course. A good lie is defined by it being relatively believable. Re: the viability of the exploit, my understanding is that most smart toothbrushes do not connect to the Internet, and even if they did, the huge numbers originally presented in the story (3 million toothbrushes) are astronomically high.

lynndotpy 3y ago
Yeah; even ~300K or so (like Mirai in 2016) would be surprisingly high.

kube-system 3y ago

Yes it has an API, but that doesn't mean it's on the internet. To connect via that API you have to connect to the toothbrush via bluetooth.

TeMPOraL 3y ago
Bluetooth is a PITA, low-budget "smart" devices are all becoming Wi-Fi now.
- kube-system 3y ago
  Nevertheless, no major toothbrush manufacturers use Wi-Fi. Oral B and Philips connected brushes all use bluetooth.
  - lynndotpy 3y ago
    I know someone who owns an "Oral-B iO series 10" and they said they connected it directly via Wi-Fi. It's possible they got it wrong, but multiple product reviews on the internet explicitly mention difficulties getting their Wi-Fi password onto the device.
  - ben_w 3y ago
    I can't help but feel bluetooth is the wrong symbolism for a toothbrush.
lynndotpy 3y ago
> Yes it has an API, but that doesn't mean it's on the internet. See the second link, the "Web API" section. This is the part tells me that it's on the internet. > WEB API > The Oral-B cloud service offers fast and reliable real-time access to Oral-B brushing activity. Fetch brushing data ranging from session frequency and duration to activity stats, achievements and more. Integrate brushing activity data* with health or lifestyle applications. I don't know about all the older models, but I know the latest Oral-B smartbrush connects directly to the internet using Wi-Fi.