Three million malware-infected smart toothbrushes used in Swiss DDoS attacks

https://www.tomshardware.com/networking/three-million-malware-infected-smart-toothbrushes-used-in-swiss-ddos-attacks-botnet-causes-millions-of-euros-in-damages

by dist-epoch • 2 years ago

284 175 2 years ago

tomshardware.com

ano-ther• 2 years ago

My theory is that every technology goes through a period of experimentation before it’s clear how it should be employed.

That’s why we had project plowshare for the bomb and now internet connectivity for every imaginable device, even ones that only need an on-off switch.

I am a bit mystified why we need connected toothbrushes, but I very much applaud the spirit of experimentation, even if it sometimes gives us toothbrush-powered botnets.

Levitating• 2 years ago

Is it really experimentation or just slapping a higher price tag onto a device for added wifi connectivity.

How do we sell our product X for more? Just add wifi and AI. You can do it with almost anything.

0823498723498722• 2 years ago

  First they came for *The Onion*
  And I did not speak out
  For I was not an Onion writer

  Then they came for *Black Mirror*
  And I did not speak out
  For I was not a Mirror writer

  Then they came for Horselover Fat...

The sanity is already here – it's just not evenly distributed.

nonrandomstring4• 2 years ago

every technology goes through a period of experimentation before it's clear how it should be employed.

Sure, but as I said here yesterday [0] experimentation is something that has far reaching consequences, and that's why professional scientists have codes of ethics that seem quite absent in the tech world.

Also, as far as the Internet goes, we've had maybe 40 years of time to "experiment". There comes a time for results, conclusions and some sort of maturity in outcomes.

[0] https://news.ycombinator.com/context?id=39253045

axus• 2 years ago

No need to teach your children honesty, when you can just spy on their toothbrushes.

thomastjeffery3• 2 years ago

We're not taking about experimentation, though. We're talking about a fully hashed-out business model with its own casual acronym (SaaS).

The "why" is obvious: there is a market for any aggregate data on human behavior.

anonymouskimmer2• 2 years ago

Normally, the toothbrushes would have used their connectivity for tracking and improving user oral hygiene habits

Along with that thread on the Folk computer the other day (https://news.ycombinator.com/item?id=39241472 ), and a discussion on signal interference in long-range wifi and the like (https://news.ycombinator.com/item?id=39246399 ) this makes me wonder if broad household surveillance centralized to a single computer per home for analysis might have benefits over decentralized IoT computation.

hef19898• 2 years ago

How about no household surveillance at all? Crazy idea, I know.

anonymouskimmer2• 2 years ago

That's what I do. But I presume others like it, so here's an alternative for them. I have an uncle who was really into household automation back in the 80s/90s.

true_blue• 2 years ago

Why do toothbrushes need to be able to make web connections in the first place? I get that it's for tracking brushing habits, but can't that be done with local connectivity only, like LAN or something?

jprete• 2 years ago

Because the actual business model is selling the aggregated data?

Gigachad6• 2 years ago

What data though? How would it be valuable? From what I saw they are getting money from the device sale itself. These iot toothbrushes are like $400 and basically just track brushing time and pressure. Those don't seem like super valuable ad tracking metrics.

pmontra• 2 years ago

I'm with you, but unless the brush stores the data on itself, which appliance should receive those data in a typical home?

jawns• 2 years ago

What's wrong with "the brush stores the data on itself"? Plenty of consumer products do that.

IncreasePosts• 2 years ago

The users phone, via a Bluetooth connection?

soco3• 2 years ago

Not every toothbrush user has a server at home and the skills to attach to it. I would even say that most of those users had no idea what they enabled when they activated their toothbrushes. And let's not forget about vacuum cleaners, refrigerators, washing machines, coffee makers and the other zillions of "smart" personal data channeling smart appliances. I'd dare a survey, how many HN people actually work on exactly these technologies, how many read these words, and how many actually care?

nonrandomstring4• 2 years ago

I'd dare a survey, how many HN people actually work on exactly these technologies, how many read these words, and how many actually care?

This is an excellent question. We'd likely find that there is an enormous disconnect between high IQ, well educated engineers and high emotional and social intelligence.

The perennial excuses; "it's just a job" , "everybody's doing it", "if I didn't build <monstrosity x> then someone else would" ... these have grown tiresome and weak. Everybody now knows these are stupid and dangerous things we are doing.

Is there a kind of fatalistic malice at work? How do people who work on this kind of thing manage the dissonance?

samatman3• 2 years ago

I have several gizmos which use Bluetooth. They're a little bit slower to connect to than the WiFi ones, but they work fine, and "a bit slower to connect" seems fine for a toothbrush.

I also have several gizmos, including lightbulbs, which use WiFi. To my chagrin, I've had internet outages which meant that I can't turn on a given light until the Internet comes back. I put up with it, because telling my computer to change the lights is too much fun, but when the internet goes out, I'm embarrassed both personally and professionally.

Somehow we've failed as a profession to provide people with a home network which continues to function as long as the router has power, and that sucks.

kwhitefoot5• 2 years ago

Just have the toothbrush run a web server and then the user can point a web browser at it. It can also come with a mobile app that would scan the local network looking for the device in order to discover the IP.

Gigachad6• 2 years ago

I was at the store looking at them recently and all the toothbrushes advertise having "AI", an app, wifi/bluetooth etc. I guess it's hard to come up with reasonable upsells on this stuff.

0823498723498722• 2 years ago

I had misremembered these as a single comic, but you can't have everything:

https://i0.wp.com/www.litterboxcomics.com/wp-content/uploads...

dist-epoch• 2 years ago

This also good:

https://i.imgur.com/YnBnsKA.jpeg

kps2• 2 years ago

“The door refused to open. It said, “Five cents, please.” He searched his pockets. No more coins; nothing. “I’ll pay you tomorrow,” he told the door. Again he tried the knob. Again it remained locked tight. “What I pay you,” he informed it, “is in the nature of a gratuity; I don’t have to pay you.” “I think otherwise,” the door said. “Look in the purchase contract you signed when you bought this conapt.” In his desk drawer he found the contract; since signing it he had found it necessary to refer to the document many times. Sure enough; payment to his door for opening and shutting constituted a mandatory fee. Not a tip. “You discover I’m right,” the door said. It sounded smug. From the drawer beside the sink Joe Chip got a stainless steel knife; with it he began systematically to unscrew the bolt assembly of his apt’s money-gulping door. “I’ll sue you,” the door said as the first screw fell out. Joe Chip said, “I’ve never been sued by a door. But I guess I can live through it.”

— Philip K Dick, Ubik, 1969

mckn1ght• 2 years ago

So do I drink my verification can before or after brushing?

shrimp_emoji• 2 years ago

Before. Otherwise, you're washing down all the fluoride instead of giving it time to bind to your enamel via chemical API calls.

snow_mac• 2 years ago

Dude. This is too much. My fridge is capable of being connected to the internet, so is my oven, garage door opener and my dishwasher. WHY? These things have worked so well without this crap. I wish manufacturers would stop this insanity.

soco3• 2 years ago

Theory: you just don't connect them, right. Reality: connect or it won't start. Next step: integrated sim card.

notaustinpowers• 2 years ago

This literally happened to me on Friday. I was setting up a smart TV for my uncle and he just uses it for his Chromecast so I thought "whatever, I'm not going to connect this TV to his wifi."

Come to find out, the TV locks you out of EVERYTHING if you do not connect it to the internet. You see the homescreen but you aren't allowed to switch the input unless you connect to the wifi. Even after connecting to wifi, you only get access to FAST channels, and still have to register with a Samsung account before you get permission to change the input.

I don't think I had ever been more upset at a piece of tech in my life.

nonrandomstring4• 2 years ago

My fridge is capable of being connected to the internet, so is my oven, garage door opener and my dishwasher. WHY?

Because you bought them dude! :)

carleton• 2 years ago

These are all things that renters would not purchase. How many people actually try and use appliances at a rental property before signing?

NoboruWataya• 2 years ago

Genuine question, are these things really the norm where you live? I don't have a garage but none of those other appliances are capable of being connected to the internet for me. I am well aware that there are "smart" models out there and their prevalence is probably on the rise but it surprises me that someone so opposed to everything being internet-connected has so many such appliances.

I'm in the UK, are these smart appliances way more common in the US or something?

klabb3• 2 years ago

If you’ve ever tried to use these extra “connected features”, you’ll notice that they are completely useless.

Aside from the small detail that these things don’t really solve any problem, these companies are not… let’s say software savvy.

beardyw• 2 years ago

If only there was a kind of toothbrush which doesn't use the internet. Seems like an opportunity.

pixxel• 2 years ago

Calm down grandad, the benevolent cloud demands tooth data and it will have its data.

WalterBright• 2 years ago

Wouldn't one have to give the toothbrush your wifi password so it can connect?

tmiku• 2 years ago

One probably has to enter the wifi password in an app and then the connection info gets sent to the brush via Bluetooth. That's how my smart watch behaves.

zzyzxd• 2 years ago

Though we don’t have the finer details of the DDoS story, it serves as yet another warning for device owners to do their best to keep their devices, firmware, and software updated; monitor their networks for suspicious activity; install and use security software; and follow network security best practices.

Maybe they should only allow qualified consumers with required certification to purchase such a smart toothbrush.

accrual• 2 years ago

monitor their networks for suspicious activity

Indeed. It's asking the same people who only know their router as a box where the internet comes from to run a packet capture and interpret the results.

abdullahkhalids2• 2 years ago

The call if of course on device owners, and not device manufacturers whose responsibility it truly is to manufacture secure devices.

d4mi3n• 2 years ago

100% agree, but I have to wonder how much of the problem is that the cost of security is:

A. Not mandated

B. Increases cost of the product

At what point would people just prefer a regular toothbrush if a smart one doesn't provide enough utility to justify the cost?

This isn't specific to toothbrushes, but I wonder what products or services wouldn't exist if they were made to be secure (or safe/ethical/sustainable/etc). Makes me wonder how many existing externalities are causing hard to measure problems that could be prevented by making a higher quality product.

chankstein38• 2 years ago

Maybe the device owner only needs to be certified if the device was manufactured by a company that has had compromises or breaches in the past. That way, their sales take a massive hit if they have a problem. That may motivate these companies to do something about security.

imglorp• 2 years ago

Is nobody going to mention Java running on the toothbrush?

One might guess the firmware included a battery controller, bluetooth or wifi stacks, a little storage, and business logic for buttons and brushing.

cfeduke• 2 years ago

3 billion devices run Java!

;)

duohedron• 2 years ago

"3 Billion Devices Run Java"

Maybe not all of them should.

tjasko2• 2 years ago

Why does it matter? Embedded Java is quite popular. https://en.wikipedia.org/wiki/Embedded_Java

p91paul• 2 years ago

well, you need to have something to run that business logic (which includes phoning home to the manufacturer), don't you? Java is as good as any other runtime.

Thaxll• 2 years ago

That's the reason why you need some serious router at home, one with vlan capabilities so all those iot devices get sandboxed network wise.

Freebytes• 2 years ago

I dread the inevitable "Internet dildo wars of 2037" where millions of networked dildos and refrigerators wreaked havoc on the entire Internet causing billions in damage. "Suspects remain at large."

RajT88• 2 years ago

"ChatGPT-enabled Internet-Connected Dildo" is a devastating insult for internet commenters.

kramerger• 2 years ago

Didn't we already have a smart dildo incident in 2022?

Something about the sound recordings made by the accompanying app leaking?

Twirrim• 2 years ago

That's a really flimsy article. Someone is claiming 3 million smart toothbrushes were used in a DDoS, but no one is talking what/who/how. That seems like the kind of extraordinary claim that requires at least some kind of evidence.

There is surely at least some technical details that enabled them to identify the toothbrushes, right?

blacksmith_tb2• 2 years ago

It also seems odd that even if you (maybe unknowingly) connected your 'smart' toothbrush to wifi, it would be exposed to the public internet. Aren't most people using some kind of clunky cable modem etc. from their ISP, which would have a basic inbound firewall?

d1sxeyes• 2 years ago

Hypothetically, let’s say these toothbrushes connect periodically to an API from which they fetch firmware updates. If you’re able to MitM that connection, you could deliver whatever you like as a firmware payload to the toothbrush. Or maybe someone designed the toothbrush to open ports using UPNP to enable a remote connection to tell the toothbrush that the update server has moved to a new URL?

Retr0id6• 2 years ago

There's lots of ways for this expectation to be broken.

The most obvious is UPnP, where the device can ask the gateway router to forward ports.

The second is the fact that devices on the LAN are accessible to other devices on the LAN. Malicious JS in a webpage can scan for and compromise other local devices.

And the third is the fact that whatever serves code to the toothbrush (whether it's firmware updates, or an HTML5 dashboard) can be compromised. In the latter case, it could be something as simple as persistent XSS.

zoeysmithe• 2 years ago

A lot of home, small business, or neglected enterprise routers and firewalls are broken into permanently. Many of these will not auto-update their firmware or the attackers got in before the patch was available.

Then the initial actor sells access to them to other actors. I believe the Ubiquity Edge router, a small/medium/AV industry favorite, was paired with other exploits by a state actor to perform attacks on high value orgs.

Retr0id6• 2 years ago

I'd like to see more details too, but it's not that extraordinary in my opinion - par for the course for low-cost wifi-enabled appliances.

stcredzero• 2 years ago

This headline reads like a story element from the Silicon Valley TV series.

hsuduebc2• 2 years ago

In 2024 there will be flying cars!

Meanwhile.

the_wolo• 2 years ago

Dental Denial of Service

dessant3• 2 years ago

A warning about Philips electric toothbrushes: you cannot turn off Bluetooth on them, even if you are not using the smart features.

Also be careful with all Philips air purifiers that support Wi-Fi, because the remote control feature cannot be disabled. They create a Wi-Fi hotspot that you need to connect to with a smartphone to finish setting up the device, but if you don't use these features, the air purifier will create a permanent Wi-Fi hotspot, waiting to be exploited.

whyenot2• 2 years ago

You might not be able to turn bluetooth off, but you can choose not to pair them with anything (or remove the pairing after setting up the device).

dessant3• 2 years ago

The issue is what happens to these toothbrushes in a couple of years when their vulnerabilities will be discovered. Their inevitable exploitation could be prevented by simply allowing to turn off bluetooth. Or even better, only enable bluetooth if the user wants to set up and use these smart features, at least in that case the vulnerable firmware can be updated using the smartphone app.

dmix• 2 years ago

What risks could a WiFi hotspot on an air purifier expose if it's not connected to the network or a computer?

LesZedCB• 2 years ago

you could believe you're inhaling purified air but, lo! you are breathing impure air, muahahaha!

rightbyte• 2 years ago

Worst case would be a fire hazard. Maybe produce too much poisonous ozone.

If the hardware is fail safe I guess it can waste electricity.

dessant3• 2 years ago

Anyone in Wi-Fi range can exploit the device. The sensors of the air purifier can be used for spying, and the device could also serve as a hopping point for exploiting other devices in your home.

burningChrome• 2 years ago

I finally got rid of one of my fitness watches that had dreadful battery life and I couldn't figure out why. After a few months of this, I finally realized the same thing, you can't turn off the bluetooth on it. The app on your phone and the watch are constantly searching for each other to always sync and the alternative is to unpair the watch, use it, re-pair, sync and go which became a total headache, but did in fact give me better battery life.

The weird thing is I complained to the company's CSR people online and they had no idea why the battery was so bad and just told me to try and factory hard reset the phone as there must be something I changed in the settings.

I switched over to Polar and now the watch I have lasts 5 days on a single charge - quit the change from about a day or less.

inglor_cz• 2 years ago

My Garmin stays connected to my Samsung smartphone via Bluetooth constantly and will last about 6-8 days on a single charge. I can't imagine charging my watch every night.

LeifCarrotson• 2 years ago

I've been using Garmin GPS watches for more than a decade, they get two weeks on a single charge (double or triple that if you don't use 24/7 heart rate, or GPS, or Bluetooth/Wifi, but even on long trips I don't need months without a charge). And they have Bluetooth that syncs with my phone for weather data and optionally shows notifications, but it doesn't need a phone connection to be a great watch.

Sure, my top-end Fenix 6 Pro cost $750 new in 2019, and very little of that is hardware BOM (there's a lot of price segmentation), but it's still just as good as it was then. It's honestly extremely refreshing to deal with a company and an app that tries to build and sell good hardware rather than tricking you into a subscription.

II2II• 2 years ago

I switched over to Polar and now the watch I have lasts 5 days on a single charge - quit the change from about a day or less.

I uncovered a cheap digital watch in the cupboard the other day. It hasn't been in use since it's strap broke at least four years ago. It is still keeping time. Poorly, granted. It is off by half an hour, Then again, it is the type of watch that needs updating twice or thrice a year to account for DST and leap years.

I realize that modern watches are much more than timepieces, but the difference is battery life is astounding.

UberFly• 2 years ago

I'm reminded of this that I read a few days ago:

Home assistant picked up my neighbours Bluetooth toothbrush and now I can see when they brush their teeth.

https://old.reddit.com/r/homeassistant/comments/1306pcw/home...

Animats• 2 years ago

Send them a message if they miss a brushing.

radicality• 2 years ago

The exact same thing happened to me! Randomly one day a new toothbrush entity appeared in HA, even though I’m still using a “dumb” electric toothbrush.

HnUser12• 2 years ago

Same with my samsung tv and my neighbour keeps trying to pair her watch to it for reasons I don’t know.

SoftTalker• 2 years ago

She most likely doesn't know either.

manicorganic• 2 years ago

Since we're on the subject, also be careful of Philips CPAP machines, they will slowly spray disintegrating cancer-causing foam into your lungs as you sleep.

Great company though, it's not like they had the choice to not buy out one of the best CPAP manufacturers and then skimp out on materials until they hit the cancer recall margin of diminishing returns (and then hide it for as long as possible).

whyenot2• 2 years ago

Assuming that the article accurately reports the facts (I have my doubts) and these unnamed toothbrushes were used in DDoS attacks, it seems like the obvious deterrent would be for the harmed party to sue for damages. That seems like it work to deter companies from making internet connected when they aren't really needed.

usefulcat• 2 years ago

Came here expecting to find something from The Onion

jakub_g• 2 years ago

Every internet-of-shit device should be legally required to go through a security audit, and the vendor should commit to mandatory 5 years of API being up + 5 years of security updates, with N days to fix CVEs with severity over a certain threshold.

Would make the shitty vendors think twice before creating piles of e-waste due to zero cost of entry.

mikkohypponen• 2 years ago

If It's Smart, It's Vulnerable.

GrumpyNl• 2 years ago

Why you would buy a toothbrush that needs a app and wifi is beyond me.

tjasko2• 2 years ago

This article is strange & many details are lacking. All the big smart toothbrushes use BLE and are not WiFi-connected. Tried to fact-check the article, but nothing.

A bunch of BLE chips are also WiFi capable, so not ruling out that someone compromised the firmware to enable WiFi functionality, but I wonder how they were able to connect to WiFi to trigger a botnet in the first place.

Quite skeptical of this article, while the premise of the danger of IoT devices still remains, nonetheless.

a321neo• 2 years ago

A bunch of BLE chips are also WiFi capable, so not ruling out that someone compromised the firmware to enable WiFi functionality

The ESP32 is now used as a general-purposed chip even in applications where an 8-bit MCU would have been enough. A remotely exploitable vulnerability in the ESP32/SDK could have large-scale consequences.

exe34• 2 years ago

Leaves open the question of how they joined the network - WiFi passwords and such. Maybe stolen from the phones/laptops and then sent to the device as part of the exploit?

greggsy• 2 years ago

The only way to load firmware to consumer esp platforms is usually via mobile apps… so, someone with privileged access to consumer’s apps, or the supply chain, used that access to load bespoke firmware to toothbrushes.. highly doubtful.

Cpoll• 2 years ago

but I wonder how they were able to connect to WiFi to trigger a botnet in the first place.

Wardriving for oral health?

depereo2• 2 years ago

It's not something that actually happened. It's just some bullshit that's gone viral.

https://cyberplace.social/@GossiTheDog/111886558855943676

tgsovlerkhgsel• 2 years ago

That toot references https://archive.is/2024.01.30-203406/https://www.luzernerzei... which attributes the story to Stefan Züger from the Swiss branch of Fortinet and claims it to be an actual event.

I don't see a mention of "NoName Ddosia".

croon2• 2 years ago

I can't read dutch, but machine translated to english the "original source" as referenced in your link says this:

The example that comes like a Hollywood scenario has really happened that way.

smashed• 2 years ago

I tried to fact check it also. They talk about a "java-based" os that could have been the cause.

I know java me was a thing and there are micro jvm that can run on microcontrollers but still, it does not add up.

I think a DDoS attack happened (happens all the time) and security "experts" mentioned that these things could come from anywhere, even toothbrush, and the details got lost in translation / used for click bait.

a_shoeboy• 2 years ago

I wish my lone internet-of-shit device worked well enough to participate in a botnet. My house came with an internet connected sprinkler system--if the power blips, the sprinkler system boots up before the WIFI router, can't connect and then refuses to work until rebooted. I realized this when my lawn started dying.

rkagerer• 2 years ago

I have an older Phillips toothbrush without Bluetooth, Internet or vendor-locked heads, and it charges wirelessly in a glass cup. I love it.

I recently tried to buy a second one and could only find newer models with all these garbage features I don't want. Who the hell wants their toothbrush to connect to the internet? Wound up turning to eBay to find stock of the old one.

It might sound cruel, but I hope the moron who decided to add these features into their product, and the lackey who implemented it, are having a bad day and reflecting on the wisdom of what they did.

jhbadger2• 2 years ago

Wifi is silly, but there really is a benefit to the Bluetooth/app connection -- it is used to see where you are brushing and spots you are missing. My dentist definitely has seen an improvement in the plaque in my back teeth since I started using a smart toothbrush that uses an app on my phone.

kwhitefoot5• 2 years ago

spots you are missing

Just brush each tooth systematically. My dentist tells me "Just keep doing what you are doing." I have the cheapest Braun Oral-B with a two minute timer. I've worked out by trial and error that that is about the time to stroke each face of each tooth about twelve times. Now I do that even if it takes a bit longer than two minutes because I occasionally brush slower.

progbits2• 2 years ago

How does it know the location you are brushing?

MichaelMoser123• 2 years ago

Stanislav Lem wrote the "Washer Tragedy" where washing machines got smarter and were taking over. I think he would have been proud of these toothbrushes...

BlueTemplar• 2 years ago

Still better than three million plain infected toothbrushes, which is what this looked at first glance !

nottorp• 2 years ago

Waiting for the refrigerator...

beeandapenguin• 2 years ago

Which toothbrush company/product are they referring to? The stock image implies Phillips, but I don't see any mention of that in the article.

Never thought I'd be judging a toothbrush based on cybersecurity, but here we are...

vivzkestrel• 2 years ago

I challenge the hackers to hack my toothbrush , i ll even send it you with Fedex

maxglute• 2 years ago

How many bitcoins can three million toothbrushes mine?

ongytenes• 2 years ago

The day is comming...

Man: Today I found out my toothbrush has been infected by a virus.

Wife: Did you tried soaking it in bleach to sterilize it?

Man: It wasn't that kind of virus. It was a computer virus.

Wife: !??? .

croes• 2 years ago

Didn't happen, confirmed by Fortinet

https://news.ycombinator.com/item?id=39300373

Three million malware-infected smart toothbrushes used in Swiss DDoS attacks

Related Stories