Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacking my “smart” toothbrush

kuenzi.dev

Post reply on HN
Print view View original

71–80 of 311 posts

Re: Hacking my “smart” toothbrush

#71

Post by Semaphor »

josephcsible wrote: post #26
mikestew wrote: post #23

Earlier quoted context omitted.

Because it's a feature customers ask for? What laws do you want written? How "secure" am I allowed to make my product before the Feds come a-knockin'? And what does a "factory reset" accomplish? The hacker trying to get company IP (or whatever the password is protecting) gets three more attempts at it after the reset? Finally, and I'm not saying this makes it okay, but e-fuses are common as dirt these days. I don't k…

> Because it's a feature customers ask for? Aren't switches to temporarily bypass emissions controls in cars illegal, despite being a feature customers ask for? > What laws do you want written? I want all e-fuses to be banned, as well as any other means for manufacturers to permanently reduce, restrict, or remove functionality from products after they've been sold. > How "secure" am I allowed to make my product befor…

> I want all e-fuses to be banned, as well as any other means for manufacturers to permanently reduce, restrict, or remove functionality from products after they've been sold.

One thing, I can think of, are hardware-based security devices that disable themselves after recognizing break-in attempts.

Re: Hacking my “smart” toothbrush

#72

Post by userbinator »

I guess this is one of the downsides of ubiquitous cheap electronics --- DRM everywhere. A similar thing happened relatively recently with label printers: https://news.ycombinator.com/item?id=30420918

(...and people have come up with a "modchip" to bypass that restriction already: https://www.eevblog.com/forum/reviews/dymo-550-thermal-print... )

All my tries to guess to one-way function for generating the passwords failed.

In case anyone else wants to try having a go at this (without inspecting the firmware): ignoring the first and last two bytes of the UID, we see that 79 is farther from EC and D7 in a similar way that FF is far from 61 and 67, and EC and D7 look closer together too. I wonder if they used "real" crypto or just a simple XOR/shift/add/sub cipher.

There's more info about the device itself here: https://device.report/philips-oral-healthcare/hx68

(Unfortunately they've requested the schematics/block diagram/functional description to be kept "permanently"[1] confidential, and the inside photos are difficult for me to make out the part numbers on the MCU and other components.)

[1] I wish those who have been leaking secrets about our government would've gone after stuff like this instead of things like the NSA...

Re: Hacking my “smart” toothbrush

#73

Post by ballenf »

qingcharles wrote: post #44
mikestew wrote: post #4

Great article, the most interesting part of which is that you can lock your self out of your toothbrush head after three wrong password attempts. I didn't dig into the data sheet for the NFC chip very deeply, but I imagine that it's just the default that the chip ships with. Or maybe Philips really wants that $25 for a new toothbrush head. :-) EDIT: nope, not the default. From the data sheet, last sentence: "To preve…

Welcome Time Travellers! This is 2023 where you can find yourself locked out of your toothbrush after too many failed password attempts.

For Philips' sake, I hope no one wanders the toothbrush aisle of a retailer having forgotten to turn off the password brute forcer.

Re: Hacking my “smart” toothbrush

#74

Post by userbinator »

Zak wrote: post #40
josephcsible wrote: post #20

Earlier quoted context omitted.

I don't really mean about the toothbrush. I mean, why is it legal for NXP to make chips that permanently brick instead of just factory resetting when too many wrong passwords are tried?

I'm inclined to take the common HN position of "trying to lock people out of modifying their own stuff is bad", however there are plenty of situations in which someone who is not the owner might access an NFC tag and try to make it do things the owner does not want it to. Bricking it seems like the nuclear option, but it's not inherently evil to offer the option of NFC tags that are both tamper-resistant and tamper-e…

"tamper-evident" would be easily accomplished by completely wiping the contents.

Re: Hacking my “smart” toothbrush

#75

Post by SV_BubbleTime »

nl wrote: post #50
SV_BubbleTime wrote: post #42

Earlier quoted context omitted.

It can’t be far off that they ship a BLE or Wifi enabled Sonicare that reports your best brushing habits to the app that then posts it on Facebook for philipPoints you compete with your friends on… oh shit… what have I done!? Anyhow, blocking unofficial heads is just an OTA firmware update away.

Umm this has been a thing for ages. Although the points don't go to Facebook - you get "rewards" for them. Eg: > Pair one or more brushes to our iOS or Android app, then you’re all set. quip’s Bluetooth® Smart Motor will automatically store your routine, no phone needed! To check your brushing stats and the points you’ve earned, tap the app. > Earn bonuses for never missing a beat! Redeem points for rewards you’ll lo…

This future is fucking stupid.

Re: Hacking my “smart” toothbrush

#76

Post by quijoteuniv »

mikestew wrote: post #4

Great article, the most interesting part of which is that you can lock your self out of your toothbrush head after three wrong password attempts. I didn't dig into the data sheet for the NFC chip very deeply, but I imagine that it's just the default that the chip ships with. Or maybe Philips really wants that $25 for a new toothbrush head. :-) EDIT: nope, not the default. From the data sheet, last sentence: "To preve…

I guess the shortage of chips did not affect the toothbrush industry.

Re: Hacking my “smart” toothbrush

#77

Post by imp0cat »

usui wrote: post #65
rendaw wrote: post #47

Earlier quoted context omitted.

I swap toothbrush heads 4-5 times a day (a couple times per brushing session) and one of my major issues until now was that I didn't know how long I had used any individual toothbrush head and when to replace them (I didn't start using all of them at the same time). With per-head usage tracking this is much easier... I wasn't expecting it, but I'm glad Phlips is considering and supporting my use case.

Hahaha thanks for the laugh

Well, I do that, too. Single brush body and multiple brush heads.

Re: Hacking my “smart” toothbrush

#78

Post by AlbertCory »

hoosieree wrote: post #34
AlbertCory wrote: post #14

Earlier quoted context omitted.

what is this "as documented" of which you speak? /s toothbrushes come with documentation???

Brush for 2 minutes. No more, no less. One is not enough. Three is too much. Four is right out.

the SonicCare has this "quad-pacer" feature where every 30 seconds it makes a sound to remind you to change quadrants of your mouth, and after 2 minutes it shuts off.

Re: Hacking my “smart” toothbrush

#79

Post by imp0cat »

aaronbrethorst wrote: post #63

Me, dumb: I change my Sonicare toothbrush head whenever it tells me to. I haven’t had a cavity in 8 years. You, a clever toothbrush-hacking genius: haha, the head is new again! This is neat, and I find the process of reverse engineering the Sonicare toothbrush fascinating, especially sniffing the NFC communication, but please change your toothbrush head every three months.

Yes, I realize I might be in the minority here, but isn't this actually great use of a smart device?

Not having to keep track of brush head changes, awesome! One less thing to worry about, as the device is smart enough to tell me when it's time for a new one.

Re: Hacking my “smart” toothbrush

#80

Post by joshspankit »

I agree with another commenter who said enjoyable read.

I’m normally all about hacks and whatnot, but I found myself much more drawn to the idea of scanning the toothbrush head after brushing to be able to automatically track brush time. No password required.

Post reply on HN