Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Three million malware-infected smart toothbrushes used in Swiss DDoS attacks

tomshardware.com

Post reply on HN
Print view View original

141–150 of 182 posts

Re: Three million malware-infected smart toothbrushes used in Swiss DDoS attacks

#141

Post by Gigachad »

kwhitefoot wrote: post #119
Gigachad wrote: post #104

Earlier quoted context omitted.

And then the user goes out for the day, opens up the app, and wonders why the last 3 days of data is missing. Meanwhile the chip that does Bluetooth also just has wifi bundled in. Aside from the security risk, directly connecting to wifi is a vastly superior experience.

How much data can a toothbrush collect? Surely just a few hundred bytes per brushing session. The ESP32 has 160 kB of usable RAM out of the 520 kB total capacity. Surely enough for weeks of data even if the data structures are badly designed.

The problem is you can't reliably collect it over bluetooth. I doubt iOS allows apps to just run always active background tasks to fetch data over bluetooth while the app is not open.

The user expects the data on the app to always be in sync. If they check it outside of bluetooth range and see days of data is missing, it'll look broken.

Re: Three million malware-infected smart toothbrushes used in Swiss DDoS attacks

#142

Post by cromka »

mynameisvlad wrote: post #88
dessant wrote: post #80

Earlier quoted context omitted.

Anyone in Wi-Fi range can exploit the device. The sensors of the air purifier can be used for spying, and the device could also serve as a hopping point for exploiting other devices in your home.

> The sensors of the air purifier can be used for spying To be able to... know if your target's house has a lot of pollutants? Is particularly warm? There is practically no useful information that can't be gleamed by just looking through their windows, blinds and all. > and the device could also be used as a hopping point for exploiting other devices in your home. It's not connected to your home network, that's the w…

Just a mere few years ago you wouldn’t believe WiFi access point can be used as a sonar to literally scan the area like a low-def camera in real time.

Stuxnet also sounded like a completely made up scenario.

As someone said, you lack imagination. And that’s OK, but you’re also being quite arrogant, too.

Re: Three million malware-infected smart toothbrushes used in Swiss DDoS attacks

#143

Post by quenix »

progbits wrote: post #123
jhbadger wrote: post #110

Earlier quoted context omitted.

Wifi is silly, but there really is a benefit to the Bluetooth/app connection -- it is used to see where you are brushing and spots you are missing. My dentist definitely has seen an improvement in the plaque in my back teeth since I started using a smart toothbrush that uses an app on my phone.

How does it know the location you are brushing?

I would presume a bunch of IMUs and fusing together orientation/accel data?

I can see how knowing the orientation and relative motion of the head might allow one to map this out.

Re: Three million malware-infected smart toothbrushes used in Swiss DDoS attacks

#144

Post by rakslice_ »

tgsovlerkhgsel wrote: post #138
depereo wrote: post #122

Earlier quoted context omitted.

It's not something that actually happened. It's just some bullshit that's gone viral. https://cyberplace.social/@GossiTheDog/111886558855943676

That toot references https://archive.is/2024.01.30-203406/https://www.luzernerzei... which attributes the story to Stefan Züger from the Swiss branch of Fortinet and claims it to be an actual event. I don't see a mention of "NoName Ddosia".

Re "Noname Ddosia": It's from the context, if you know your recent infosec history:

"Jüngst wurden damit auch Server von Schweizer Regierungsstellen während des Weltwirtschaftsforums angegriffen – als Retourkutsche für die Teilnahme des ukrainischen Präsidenten Wolodimir Selenski. Eine russlandnahe Gruppierung bekannte sich zum Angriff."

(translation: "Servers of Swiss government offices were recently attacked during the World Economic Forum - as a retaliation for the participation of Ukrainian President Volodymyr Zelensky. A group close to Russia claimed responsibility for the attack.")

Background: https://www.ncsc.admin.ch/ncsc/en/home/aktuell/im-fokus/2023...

But it's not clear to me that's right, isn't WEF in the summer?

Ah, they've been ongoing, here's the earlier one: https://www.ncsc.admin.ch/ncsc/en/home/aktuell/im-fokus/2023...

Re: Three million malware-infected smart toothbrushes used in Swiss DDoS attacks

#145

Post by croon »

depereo wrote: post #122
tjasko wrote: post #99

This article is strange & many details are lacking. All the big smart toothbrushes use BLE and are not WiFi-connected. Tried to fact-check the article, but nothing. A bunch of BLE chips are also WiFi capable, so not ruling out that someone compromised the firmware to enable WiFi functionality, but I wonder how they were able to connect to WiFi to trigger a botnet in the first place. Quite skeptical of this article, w…

It's not something that actually happened. It's just some bullshit that's gone viral. https://cyberplace.social/@GossiTheDog/111886558855943676

I can't read dutch, but machine translated to english the "original source" as referenced in your link says this:

> The example that comes like a Hollywood scenario has really happened that way.

Re: Three million malware-infected smart toothbrushes used in Swiss DDoS attacks

#146

Post by mynameisvlad »

jamesrr39 wrote: post #139
mynameisvlad wrote: post #130

Earlier quoted context omitted.

Do you understand what data is available in a smart air purifier? Please, explain exactly what sensor fusion would get you actionable data out of the PM2.5 sensor and "gas sensor" in a Philips smart air purifier.

At a guess; if able to monitor over a period of time (e.g. pick up data from a parked car), a potential burglar can see when there is activity and figure what times of the day house occupants are normally at home.

> that can't be gleamed by just looking through their windows, blinds and all.

I mean, sure, but who is going to do that when they can... look to see when people are home.

Re: Three million malware-infected smart toothbrushes used in Swiss DDoS attacks

#147

Post by vel0city »

samatman wrote: post #28
soco wrote: post #10

Earlier quoted context omitted.

Not every toothbrush user has a server at home and the skills to attach to it. I would even say that most of those users had no idea what they enabled when they activated their toothbrushes. And let's not forget about vacuum cleaners, refrigerators, washing machines, coffee makers and the other zillions of "smart" personal data channeling smart appliances. I'd dare a survey, how many HN people actually work on exactl…

I have several gizmos which use Bluetooth. They're a little bit slower to connect to than the WiFi ones, but they work fine, and "a bit slower to connect" seems fine for a toothbrush. I also have several gizmos, including lightbulbs, which use WiFi. To my chagrin, I've had internet outages which meant that I can't turn on a given light until the Internet comes back. I put up with it, because telling my computer to ch…

Separate access points from the router are a thing, and if the command and control for the lights are local they'd continue to work. People just mostly choose to go with a single integrated unit instead of a router, a switch, and one or more access points.

Re: Three million malware-infected smart toothbrushes used in Swiss DDoS attacks

#148

Post by thomastjeffery »

Gigachad wrote: post #141
kwhitefoot wrote: post #119

Earlier quoted context omitted.

How much data can a toothbrush collect? Surely just a few hundred bytes per brushing session. The ESP32 has 160 kB of usable RAM out of the 520 kB total capacity. Surely enough for weeks of data even if the data structures are badly designed.

The problem is you can't reliably collect it over bluetooth. I doubt iOS allows apps to just run always active background tasks to fetch data over bluetooth while the app is not open. The user expects the data on the app to always be in sync. If they check it outside of bluetooth range and see days of data is missing, it'll look broken.

It'll look however the UI designer made it look.

The right answer here is to show them a "last synced" timestamp and a sync button.

Re: Three million malware-infected smart toothbrushes used in Swiss DDoS attacks

#149

Post by II2II »

burningChrome wrote: post #68
dessant wrote: post #49

A warning about Philips electric toothbrushes: you cannot turn off Bluetooth on them, even if you are not using the smart features. Also be careful with all Philips air purifiers that support Wi-Fi, because the remote control feature cannot be disabled. They create a Wi-Fi hotspot that you need to connect to with a smartphone to finish setting up the device, but if you don't use these features, the air purifier will…

I finally got rid of one of my fitness watches that had dreadful battery life and I couldn't figure out why. After a few months of this, I finally realized the same thing, you can't turn off the bluetooth on it. The app on your phone and the watch are constantly searching for each other to always sync and the alternative is to unpair the watch, use it, re-pair, sync and go which became a total headache, but did in fa…

> I switched over to Polar and now the watch I have lasts 5 days on a single charge - quit the change from about a day or less.

I uncovered a cheap digital watch in the cupboard the other day. It hasn't been in use since it's strap broke at least four years ago. It is still keeping time. Poorly, granted. It is off by half an hour, Then again, it is the type of watch that needs updating twice or thrice a year to account for DST and leap years.

I realize that modern watches are much more than timepieces, but the difference is battery life is astounding.

Re: Three million malware-infected smart toothbrushes used in Swiss DDoS attacks

#150

Post by jhbadger »

zelphirkalt wrote: post #128
progbits wrote: post #123

Earlier quoted context omitted.

How does it know the location you are brushing?

Bluetooth from the teeth! It is in the name ; )

Ha! But presumably the bluetooth is there to tell the app what it measured and to visualize it. But presumably through a combination of sensors and accelerometers
Post reply on HN