Security disclosure about a Bluetooth toilet

#1

Post by tosbourn » Fri, Aug 02, 2013, 10:55 AM UTC

Security disclosure about a Bluetooth toilet
trustwave.com

Re: Security disclosure about a Bluetooth toilet

#2

Post by tinco » Fri, Aug 02, 2013, 11:10 AM UTC

.. so you can flush without touching the toilet? .. brilliant :P

Re: Security disclosure about a Bluetooth toilet

#3

Post by gambiting » Fri, Aug 02, 2013, 11:17 AM UTC

tinco wrote: post #2

.. so you can flush without touching the toilet? .. brilliant :P

But that means you have to touch your phone, probably before washing your hands first. Less than ideal.

Re: Security disclosure about a Bluetooth toilet

#4

Post by [deleted] » Fri, Aug 02, 2013, 11:20 AM UTC

[deleted]

Re: Security disclosure about a Bluetooth toilet

#5

Post by supermatt » Fri, Aug 02, 2013, 11:22 AM UTC

Although not mentioned in the advisory, this particular model also allows you to play sounds through the toilets internal speaker.

Any exploit should surely consist of the lid flapping open and closed while the toilet whispers to you, beckoning you to come closer, and finally squirting you in the eye with the bidet.

Re: Security disclosure about a Bluetooth toilet

#6

Post by beaumartinez » Fri, Aug 02, 2013, 11:24 AM UTC

gambiting wrote: post #3

tinco wrote: post #2

.. so you can flush without touching the toilet? .. brilliant :P

But that means you have to touch your phone, probably before washing your hands first. Less than ideal.

Less than ideal, but phones are a breeding ground for bacteria already.

Re: Security disclosure about a Bluetooth toilet

#7

Post by mavhc » Fri, Aug 02, 2013, 11:27 AM UTC

gambiting wrote: post #3

tinco wrote: post #2

.. so you can flush without touching the toilet? .. brilliant :P

But that means you have to touch your phone, probably before washing your hands first. Less than ideal.

Not with the Moto X, "OK Google Now, flush toilet"

Re: Security disclosure about a Bluetooth toilet

#8

Post by ics » Fri, Aug 02, 2013, 11:37 AM UTC

mavhc wrote: post #7

gambiting wrote: post #3

Earlier quoted context omitted.

But that means you have to touch your phone, probably before washing your hands first. Less than ideal.

Not with the Moto X, "OK Google Now, flush toilet"

"Siri, spray shiri," in this case.

Re: Security disclosure about a Bluetooth toilet

#9

Post by jkestner » Fri, Aug 02, 2013, 11:41 AM UTC

gambiting wrote: post #3

tinco wrote: post #2

.. so you can flush without touching the toilet? .. brilliant :P

But that means you have to touch your phone, probably before washing your hands first. Less than ideal.

Finally, a use for the Leap Motion.

Re: Security disclosure about a Bluetooth toilet

#10

Post by unimpressive » Fri, Aug 02, 2013, 11:51 AM UTC

According to this[0] the flush volume of this toilet is 5 liters. If it takes two minutes to flush and refill then the amount of water you could waste in an hour is:

30 * 5 = 150L

If a family is away on vacation, you could theoretically flush for days.

24 * 150 = 3600L per day

In Seattle the water costs about 4.5 cents per cubic foot.[1] (If it costs 4.50 dollars for one CCF (which is 100 cubic feet) then I move the decimal place over two times.)

According to this[2] "1 Liter = 0.0353146667 Cubic Foot"

If that's the case then at 3600L per day you can flush 127.1328001 Cubic Feet of water.

127.1328001 * 4.5 = 572.0976005 cents

Round down to 572, divide by one hundred:

You can grief somebody for $5.72 a day in Seattle with this exploit. If you were to constantly flush all year it would cost you:

$5.72 * 365 = $2087.8

One way you could exploit this is if you obsessively watched out for the neighbors to see when they came and went and flushed when they aren't home.

[0]: http://www.inax-usa.com/download/catalog/pdf/0008-2.pdf (Page 18, flushing volume)

[1]: http://www.seattle.gov/util/MyServices/Rates/WaterRates/Resi...

[2]: http://www.asknumbers.com/LiterToCubicFeet.aspx