Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Three million malware-infected smart toothbrushes used in Swiss DDoS attacks

tomshardware.com

Post reply on HN
Print view View original

71–80 of 182 posts

Re: Three million malware-infected smart toothbrushes used in Swiss DDoS attacks

#71

Post by metadat »

gtirloni wrote: post #66
Retr0id wrote: post #63

Earlier quoted context omitted.

There's lots of ways for this expectation to be broken. The most obvious is UPnP, where the device can ask the gateway router to forward ports. The second is the fact that devices on the LAN are accessible to other devices on the LAN. Malicious JS in a webpage can scan for and compromise other local devices. And the third is the fact that whatever serves code to the toothbrush (whether it's firmware updates, or an HT…

> The second is the fact that devices on the LAN are accessible to other devices on the LAN. Malicious JS in a webpage can scan for and compromise other local devices. Which browser API enables that?

I was skeptical at first, but did some superficial scouting.. it's trivial for a malicious website to do nasty things to any internal resource which doesn't have a strict CORS policy.

https://security.stackexchange.com/questions/177486/can-webs...

As the adage goes, the "S" in IOT stands for "Security".

Re: Three million malware-infected smart toothbrushes used in Swiss DDoS attacks

#72

Post by LesZedCB »

dmix wrote: post #65
dessant wrote: post #49

A warning about Philips electric toothbrushes: you cannot turn off Bluetooth on them, even if you are not using the smart features. Also be careful with all Philips air purifiers that support Wi-Fi, because the remote control feature cannot be disabled. They create a Wi-Fi hotspot that you need to connect to with a smartphone to finish setting up the device, but if you don't use these features, the air purifier will…

What risks could a WiFi hotspot on an air purifier expose if it's not connected to the network or a computer?

you could believe you're inhaling purified air but, lo! you are breathing impure air, muahahaha!

Re: Three million malware-infected smart toothbrushes used in Swiss DDoS attacks

#74

Post by blacksmith_tb »

gtirloni wrote: post #66
Retr0id wrote: post #63

Earlier quoted context omitted.

There's lots of ways for this expectation to be broken. The most obvious is UPnP, where the device can ask the gateway router to forward ports. The second is the fact that devices on the LAN are accessible to other devices on the LAN. Malicious JS in a webpage can scan for and compromise other local devices. And the third is the fact that whatever serves code to the toothbrush (whether it's firmware updates, or an HT…

> The second is the fact that devices on the LAN are accessible to other devices on the LAN. Malicious JS in a webpage can scan for and compromise other local devices. Which browser API enables that?

I suppose you could just loop through all the IPs for some common ranges like 10.0.0.0/16 and 192.168.0.0/16 looking for a given port, if you knew the toothbrushes exposed it and there was something exploitable there, that makes sense.

Re: Three million malware-infected smart toothbrushes used in Swiss DDoS attacks

#75

Post by Retr0id »

metadat wrote: post #71
gtirloni wrote: post #66

Earlier quoted context omitted.

> The second is the fact that devices on the LAN are accessible to other devices on the LAN. Malicious JS in a webpage can scan for and compromise other local devices. Which browser API enables that?

I was skeptical at first, but did some superficial scouting.. it's trivial for a malicious website to do nasty things to any internal resource which doesn't have a strict CORS policy. https://security.stackexchange.com/questions/177486/can-webs... As the adage goes, the "S" in IOT stands for "Security".

Yes, I have (non-public) variations of the https://rootmy.tv/ exploit that can fully compromise an LG smart TV from the browser session of any other LAN-adjacent device.

Re: Three million malware-infected smart toothbrushes used in Swiss DDoS attacks

#76

Post by zoeysmithe »

blacksmith_tb wrote: post #42
Twirrim wrote: post #34

That's a really flimsy article. Someone is claiming 3 million smart toothbrushes were used in a DDoS, but no one is talking what/who/how. That seems like the kind of extraordinary claim that requires at least some kind of evidence. There is surely at least some technical details that enabled them to identify the toothbrushes, right?

It also seems odd that even if you (maybe unknowingly) connected your 'smart' toothbrush to wifi, it would be exposed to the public internet. Aren't most people using some kind of clunky cable modem etc. from their ISP, which would have a basic inbound firewall?

A lot of home, small business, or neglected enterprise routers and firewalls are broken into permanently. Many of these will not auto-update their firmware or the attackers got in before the patch was available.

Then the initial actor sells access to them to other actors. I believe the Ubiquity Edge router, a small/medium/AV industry favorite, was paired with other exploits by a state actor to perform attacks on high value orgs.

Re: Three million malware-infected smart toothbrushes used in Swiss DDoS attacks

#77

Post by metadat »

blacksmith_tb wrote: post #74
gtirloni wrote: post #66

Earlier quoted context omitted.

> The second is the fact that devices on the LAN are accessible to other devices on the LAN. Malicious JS in a webpage can scan for and compromise other local devices. Which browser API enables that?

I suppose you could just loop through all the IPs for some common ranges like 10.0.0.0/16 and 192.168.0.0/16 looking for a given port, if you knew the toothbrushes exposed it and there was something exploitable there, that makes sense.

Even 192.168.1.0/8 will probably get you ~95% coverage for residential networks.

Re: Three million malware-infected smart toothbrushes used in Swiss DDoS attacks

#78

Post by rightbyte »

dmix wrote: post #65
dessant wrote: post #49

A warning about Philips electric toothbrushes: you cannot turn off Bluetooth on them, even if you are not using the smart features. Also be careful with all Philips air purifiers that support Wi-Fi, because the remote control feature cannot be disabled. They create a Wi-Fi hotspot that you need to connect to with a smartphone to finish setting up the device, but if you don't use these features, the air purifier will…

What risks could a WiFi hotspot on an air purifier expose if it's not connected to the network or a computer?

Worst case would be a fire hazard. Maybe produce too much poisonous ozone.

If the hardware is fail safe I guess it can waste electricity.

Re: Three million malware-infected smart toothbrushes used in Swiss DDoS attacks

#79

Post by kps »

LesZedCB wrote: post #72
dmix wrote: post #65

Earlier quoted context omitted.

What risks could a WiFi hotspot on an air purifier expose if it's not connected to the network or a computer?

you could believe you're inhaling purified air but, lo! you are breathing impure air, muahahaha!

You may think you're joking, but 4 days ago: https://news.ycombinator.com/item?id=39223982

Re: Three million malware-infected smart toothbrushes used in Swiss DDoS attacks

#80

Post by dessant »

dmix wrote: post #65
dessant wrote: post #49

A warning about Philips electric toothbrushes: you cannot turn off Bluetooth on them, even if you are not using the smart features. Also be careful with all Philips air purifiers that support Wi-Fi, because the remote control feature cannot be disabled. They create a Wi-Fi hotspot that you need to connect to with a smartphone to finish setting up the device, but if you don't use these features, the air purifier will…

What risks could a WiFi hotspot on an air purifier expose if it's not connected to the network or a computer?

Anyone in Wi-Fi range can exploit the device. The sensors of the air purifier can be used for spying, and the device could also serve as a hopping point for exploiting other devices in your home.
Post reply on HN