Live data from Hacker News

Hacking my “smart” toothbrush

kuenzi.dev

51–60 of 311 posts

Re: Hacking my “smart” toothbrush

#51

Earlier quoted context omitted.

Welcome Time Travellers! This is 2023 where you can find yourself locked out of your toothbrush after too many failed password attempts.

I hope that this is a warning to time travelers from the past and not a friendly welcome to time travelers from the future that are looking back on simpler times.

I’m not sure of OP’s intentions but in practical terms everyone who read that is a time traveller from the past.

Re: Hacking my “smart” toothbrush

#52
post #4

Great article, the most interesting part of which is that you can lock your self out of your toothbrush head after three wrong password attempts. I didn't dig into the data sheet for the NFC chip very deeply, but I imagine that it's just the default that the chip ships with. Or maybe Philips really wants that $25 for a new toothbrush head. :-) EDIT: nope, not the default. From the data sheet, last sentence: "To preve…

Welcome Time Travellers! This is 2023 where you can find yourself locked out of your toothbrush after too many failed password attempts.

Guess we'll have to brute force clean our teeth by moving the locked toothbrush up and down, side to side, and in circular motions.

Re: Hacking my “smart” toothbrush

#53

This was an enjoyable read. My GE fridge uses RFID for keeping track of when to change the water filter. This isn't really an area I'm familiar with but I'm curious how much I would be able to figure out with the right tools.

There is a much simpler solution, buy the bypass plug which has the rfid chip in it for about $50, cut a chunk of plastic with the chip off being careful not to harm the antenna, and tape it to the inside of the fridge in the same area. Only downside is you have to use your brain to replace the filter with a compatible one every once in a while, and it says “not filtering” on the front panel when you dispense water or ice.

Re: Hacking my “smart” toothbrush

#54

This was an enjoyable read. My GE fridge uses RFID for keeping track of when to change the water filter. This isn't really an area I'm familiar with but I'm curious how much I would be able to figure out with the right tools.

In GE's defense, limiting the amount of time you can use a water filter for is probably a good idea considering what the filter media fills up with if you do nothing.

The OEM filters cost like 2-4x what a suitable generic costs. Would have been cheaper for GE to add a software feature to warn you after 6 months and allow you to reset it.

Re: Hacking my “smart” toothbrush

#56

Earlier quoted context omitted.

Welcome Time Travellers! This is 2023 where you can find yourself locked out of your toothbrush after too many failed password attempts.

I hope that this is a warning to time travelers from the past and not a friendly welcome to time travelers from the future that are looking back on simpler times.

Even with such a toothbrush "lockout", criminals could still go on to put other people's toothbrushes in their mouths.

This type of deviant behavior came to a screeching halt when Crest released their breath-activated toothbrush defense system (BATDS) in 2028. BATDS enabled devices deliver a non-lethal shock to the perpetrator, rendering them unconscious. While BATDS was immediately deemed illegal in most countries due to disputed claims that it caused significant brain damage throughout a large control group, it remains popular in single family households in the US.

Re: Hacking my “smart” toothbrush

#57

I'm curious to see, but I don't think the algorithm for calculating the password from the identifier would be very sophisticated. Assuming they didn't want to add costs to prevent easy retrieval of any secret key from the device, a complex algorithm would be kind of a waste.

I mean, even something as simple as `md5("very-long-secret-only-phillips-knows" + uid)[:4]` would be effectively unguessable. Not hard if you have the code for the firmware, but nigh-impossible otherwise.

The Sonicare app lets you download the latest firmware blob. So all you'd do is intercept it and find the function responsible for generating the password.

Re: Hacking my “smart” toothbrush

#58
post #4

Great article, the most interesting part of which is that you can lock your self out of your toothbrush head after three wrong password attempts. I didn't dig into the data sheet for the NFC chip very deeply, but I imagine that it's just the default that the chip ships with. Or maybe Philips really wants that $25 for a new toothbrush head. :-) EDIT: nope, not the default. From the data sheet, last sentence: "To preve…

Welcome Time Travellers! This is 2023 where you can find yourself locked out of your toothbrush after too many failed password attempts.

And for literally no improvement or benefit over normal toothbrushes.

Re: Hacking my “smart” toothbrush

#59

I'd like to skip the whole "smart" toothbrush phase and go straight to the "smart ass" toothbrush, which razzes me about my sugar intake and gossips with the toaster behind my back.

As a bachelor who lives alone, it would actually be very motivating if I overheard my appliances making hushed comments about how I "look a little more plump than usual."

Re: Hacking my “smart” toothbrush

#60

Earlier quoted context omitted.

Why is this kind of thing legal? For starters, my experience says that, unlike an HP printer, your toothbrush still works just fine[0] if you ignore anything that tells you to replace the head. [0] At least as fine as a toothbrush with a worn-out head is going to work.

I don't really mean about the toothbrush. I mean, why is it legal for NXP to make chips that permanently brick instead of just factory resetting when too many wrong passwords are tried?

Because NXP makes this chip compliant with ISO/IEC14443, meaning it can be used in payment cards. EMV requires shit like this in their credit card NFC and I'm thankful for it.

https://en.wikipedia.org/wiki/ISO/IEC_14443

Post reply on HN