Security disclosure about a Bluetooth toilet

https://www.trustwave.com/spiderlabs/advisories/TWSL2013-020.txt

by tosbourn • 13 years ago

98 28 13 years ago

trustwave.com

tinco• 13 years ago

.. so you can flush without touching the toilet? .. brilliant :P

gambiting3• 13 years ago

But that means you have to touch your phone, probably before washing your hands first. Less than ideal.

beaumartinez• 13 years ago

Less than ideal, but phones are a breeding ground for bacteria already.

mavhc• 13 years ago

Not with the Moto X, "OK Google Now, flush toilet"

jkestner• 13 years ago

Finally, a use for the Leap Motion.

fein• 13 years ago

"OK Glass, flush!"

sneak• 13 years ago

It was already in my hand anyway.

dragonwriter• 13 years ago

But that means you have to touch your phone, probably before washing your hands first.

If you can one-hand your phone, and do the other task with one hand, this isn't a problem.

supermatt• 13 years ago

Although not mentioned in the advisory, this particular model also allows you to play sounds through the toilets internal speaker.

Any exploit should surely consist of the lid flapping open and closed while the toilet whispers to you, beckoning you to come closer, and finally squirting you in the eye with the bidet.

smacktoward• 13 years ago

"Didn't your parents tell you never to listen to toilets?"

unimpressive• 13 years ago

According to this[0] the flush volume of this toilet is 5 liters. If it takes two minutes to flush and refill then the amount of water you could waste in an hour is:

30 * 5 = 150L

If a family is away on vacation, you could theoretically flush for days.

24 * 150 = 3600L per day

In Seattle the water costs about 4.5 cents per cubic foot.[1] (If it costs 4.50 dollars for one CCF (which is 100 cubic feet) then I move the decimal place over two times.)

According to this[2] "1 Liter = 0.0353146667 Cubic Foot"

If that's the case then at 3600L per day you can flush 127.1328001 Cubic Feet of water.

127.1328001 * 4.5 = 572.0976005 cents

Round down to 572, divide by one hundred:

You can grief somebody for $5.72 a day in Seattle with this exploit. If you were to constantly flush all year it would cost you:

$5.72 * 365 = $2087.8

One way you could exploit this is if you obsessively watched out for the neighbors to see when they came and went and flushed when they aren't home.

[0] http://www.inax-usa.com/download/catalog/pdf/0008-2.pdf (Page 18, flushing volume)

[1] http://www.seattle.gov/util/MyServices/Rates/WaterRates/Resi...

[2] http://www.asknumbers.com/LiterToCubicFeet.aspx

rohansingh• 13 years ago

I was always under the impression that our water in Seattle is cheaper than in most places?

Probably the greatest monetary cost you could cause the owner to incur is if they thought the toilet was faulty in some way due to the continuous flushing and had to call in a plumber.

Also I can't believe I'm seriously having a discussion about toilets on HN. Heh.

larcher• 13 years ago

In Austin I pay about 1.3 cents/gallon, or 10.4 cents/cubic foot of water, $10.40/CCF. This is including waste water service, which is nearly twice as much as water service (but based on the same amount of water).

However, this is based on my own bill (total billed amount divided by total water used) -- a bit tricky since there are tiers and surcharges.

Also, we're under water restrictions due to the drought - water the lawn once a week, no washing your car in the driveway, etc.

jmharvey• 13 years ago

Many water utilities also have a penalty rate if you exceed a given usage.

gambiting3• 13 years ago

In some parts of the UK water is unlimited - you only pay a yearly fee for access, but you can literally use as much as you like - it's not metered. So flushing your neighbour's toilet would be at most amusing,but not costly.

ben1040• 13 years ago

I live in St Louis, MO, where in many parts of the area the water system is old enough that they don't even have meters.

The water division charges a flat rate based on the number of rooms and toilets/showers in the house, as that information is on file with the property tax assessor's records. If you ever add or remove a room or water fixture, you have to get a permit, which would get those upgrades reflected on the assessor's records.

jlgreco• 13 years ago

A better way to grief somebody with this is to probably just flush their toilet a bunch while they are home. That would get annoying real quick.

benjamincburns• 13 years ago

I'm going to go ahead and file this away as an example of how needless complexity can bite you in the ass. In this case, almost literally.

chris_wot• 13 years ago

Toilets are awesome. We rarely talk about them (or sewers), but they are a VERY important part of disease control. Toilets save lives, we just don't realise it.

alphakappa• 13 years ago

And electronic bidets are the most awesome of toilets. Once you get used to them (and they are fairly affordable as long as you don't go for Toto), using paper feels so... primitive.

cynwoody• 13 years ago

Almost eleven years ago, one Stana Claus contributed† the following factoid to history:

    Just so you know, some varieties of corn have a dark reddish cob
    while others have more of a whitish colored cob. When I was but a
    wee child I was told by my beloved grandfather that the proper
    outhouse technique required "two reds and a white". The red cobs
    (apparently more readily available, at least in that locale) were
    used for bulk removal, and the white was used to determine if the
    job was sufficiently done. Surely, my grandfather wouldn't have
    lied to a small impressionable child about such a thing!

†http://boards.straightdope.com/sdmb/showpost.php?p=2363912&p...

donutz• 13 years ago

Here's the app that goes along with the toilet: https://play.google.com/store/apps/details?id=jp.co.lixil.re...

At least the poop journal aspects shouldn't be compromised even if your toilet is :)

Security disclosure about a Bluetooth toilet

Related Stories