Hackers could have enslaved 3 million toothbrushes for DDoS attack

[midian182]

WTF?! Another incident illustrates the inherent dangers of making every household item internet-connected. Three million smart toothbrushes were reportedly infected by hackers and enslaved into a botnet used in a DDoS attack on a company in Switzerland – though not everyone believes it really happened.

The story comes from Swiss newspaper Aargauer Zeitung, which states that the unnamed Swiss company targeted by the army of smart toothbrushes was taken down for several hours, costing it millions of dollars. Update (Feb 9): Confirmed, the attack never happened.

The report states that the toothbrushes – the brand isn't named – were vulnerable due to their Java-based OS. While a lot of toothbrushes use Bluetooth for tracking cleaning routines, several also support Wi-Fi connections for their various functions.

Aargauer Zeitung refers to data from cybersecurity company Fortinet in the article. "Every device that is connected to the Internet is a potential target – or can be misused for an attack," said Fortinet system engineer director Stefan Züger.

While such an incident sounds plausible, some believe the story isn't true, including cybersecurity expert Kevin Beaumont. Züger seems to be describing some hypothetical scenarios in the article; however, the publication does state that "The [toothbrush] example, which seems like a Hollywood scenario, really happened that way." (translated).

Real or otherwise, the danger of insecure IoT devices isn't to be underestimated. Züger notes how cybercriminals are constantly on the lookout for vulnerabilities in connected devices. To find out how long it takes for a device to be hijacked, Züger and his team connected a computer to the internet without any protection. It took less than 20 minutes for it to be taken over.

Real or hypothetical, there have been plenty of other stories about webcams, baby monitors, smart fridges, etc. being taken over by hackers, reminding us to ensure our devices are up to date.

Last month brought news of what was also suspected to be an IoT-device hijack: a connected LG washing machine that was using 3.6GB of data per day. Ultimately, the most likely explanation turned out to be a reporting inaccuracy on the part of the Asus router interface tool.

Permalink to story.

https://www.techspot.com/news/101789-hackers-could-have-enslave-3-million-smart-toothbrushes.html

 

[VitalyT]

...unnamed Swiss company targeted by the army of smart toothbrushes

Skynet was overrated, mental ward leaks are more dangerous.

 

[stewi0001]

I'm surprised that I haven't heard of IoT condoms yet.

 

[UdyrL]

Next on: "Simple things that shouldn't be smart".

After the washing machine using excessive data, now we have hacked "smart" toothbrushes that will give you cavity instead of cleaning your teeth.

In the near future we'll have "smart" clothes connected to wifi for an app telling you how much you're sweating daily and what parts of your body are hotter than the rest. (Copyright - Udyr 2024)

 

[wiyosaya]

Whether this story is true or not, IMO, security is a distant afterthought for companies that want to cash in on the IoT FAD. Companies only interested in profit will try to cash in on as much as they can and don't care how they do it.

Honestly, I would not be surprised to see internet connected underwear that tells you whether you've covered your a$$ or not.

 

[Underdog]

It could well happen. Too many people turn off their brains and open their wallets when given a chance to engage with more IoT crap.

 

[Stingy McDuck]

WTF a toothbrush needs internet for? Are there achievements you can unlock by brushing your teeth? Do you need your personal calendar to get updated after you clean your teeth? Does it connect to Spotify to play music while you brush? Am I giving too many ideas to the toothbrush industry?

 

[techstrike]

New IoT devices every day will appear on the market.. this is because of the "mobile app hysteria".

The new generation wants everything on their mobile device ... so we are doomed.

 

[Bamda]

So glad my toilet paper dispenser is offline

 

[Ben Myers]

Whether this story is true or not, IMO, security is a distant afterthought for companies that want to cash in on the IoT FAD. Companies only interested in profit will try to cash in on as much as they can and don't care how they do it.

Honestly, I would not be surprised to see internet connected underwear that tells you whether you've covered your a$$ or not.

Exactly why we have not gotten ANY IoT devices for our house.

 

[Underdog]

Skidmark police!