The three million toothbrush botnet story isn't true | Hacker News Reader

The three million toothbrush botnet story isn't true

cyberplace.social

Related: "Three million malware-infected smart toothbrushes used in Swiss DDoS attacks" (226 points, 136 comments)

[0]: https://news.ycombinator.com/item?id=39277990

I changed the URL from https://cyberplace.social/@GossiTheDog/111886558855943676 to https://cyberplace.social/@GossiTheDog/111892646485958733, as suggested here: https://news.ycombinator.com/item?id=39297612. Readers should probably look at both.

I have no idea why https://cyberplace.social/@GossiTheDog/111886558855943676 doesn't lead to that later post in the thread. Is there a way to guarantee that readers get the entire thread in these things? If people can only see the start, that's not much better than what Twitter does.

676 (original post) does lead to 733 (screenshot of clarification) but the latter is about the sixth reply down the list. Both links guarantee readers see the entire thread, but they would have to know that they need to scroll for additional context.

Not for me, nor apparently for wut42: https://news.ycombinator.com/item?id=39300970.

Scrolling down to see everything is what I'd expect, and had 733 shown up when I scrolled down, I wouldn't have changed the URL.

Huh you're both right, I hadn't checked carefully enough. I guess the Mastodon threads UX needs a bit more work.

Xref to me getting partly to the bottom of it: https://news.ycombinator.com/edit?id=39305884

Starting at https://cyberplace.social/@GossiTheDog/111886558855943676

First reply is from the OP, and the visual "thread" (vertical line) on the left side is broken. Click on that reply ("The toothbrush thing has gone viral despite it being total bollocks.").

Now again scroll down through posts by the OP until the "thread" on the left side breaks. Click on that last reply ("Fortinet also declined to comment to me.").

Finally, the target post appears as a reply to that ("Fortigate have issued me a statement.")

Navigational issue. One might ask what is the difference between the follow-ups that show up automatically and the ones that don't show up until you navigate. I don't know.

Seems like Fortinet lied about the whole translation error thing:

https://www.aargauerzeitung.ch/wirtschaft/cyberangriff-die-g...

>Was nun von der Fortinet-Zentrale in Kalifornien als «Übersetzungsproblem» bezeichnet wird, hat sich bei den Recherchen noch ganz anders angehört: Schweizer Fortinet-Vertreter haben bei einem Gesprächstermin, bei dem es um aktuelle Bedrohungslagen ging, den Zahnbürsten-Fall als reale DDoS-Attacke geschildert.

Translation:

>What the Fortinet headquarters in California is now describing as a "translation problem" sounded very different during the research: Swiss Fortinet representatives described the toothbrush case as a real DDoS attack during a meeting to discuss current threat situations.

And

>Der Text wurde Fortinet vor der Publikation zur Verifizierung vorgelegt. Der Satz, wonach es sich um einen realen Fall handle, der sich wirklich so zugetragen hat, wurde nicht beanstandet.

>The text was submitted to Fortinet for verification before publication. The sentence stating that this was a real case that actually happened was not objected to.

Truth seems not to be part of their business model

https://gpl-violations.org/news/20050414-fortinet/

1) You can have translation errors between people within a company.

2) Just because it was submitted for verification prior to publication doesn't mean that it was read, or read thoroughly. Or heck, maybe it was read by the very employees who mistakenly thought it was real. Plausible if it was, as indicated in your comment, a german article.

3) Violating a software license has nothing to do with "truth", but lawfulness. These would probably be highly correlated traits in many individuals, but they certainly don't have to be.

The story was published January 30th, plenty of time to inform the news paper about the error.

The lied about the use of GPL code by intentional obfuscation of GPL software use.

The linked archived article says quite specifically that while the example sounds like a hollywood story it really did happen.

I don’t doubt that the article is wrong or they misunderstood their source though, since it’s just a random local news article about the dangers of ‘cybercrime’ which was apparently used as a source by these larger publications.

This fake story is propagated in anticipation of significant changes coming into effect in Europe this year wrt the E.U. "Cybersecurity Act" and "Cyber Resilience Act" which specifically targets IoT device security. In the US you will have "Cybersecurity Improvement Act" with serious consequences for non-compliant devices under EO 14028. Expect more "March of the Killer Toothbrushes" stories soon.

Many relevant goals of the IoT Cybersecurity Improvement Act of 2020 [1] have already been implemented. Executive Order E.O. 14028 of May 12, 2021 "Improving the Nation's Cybersecurity" is substantially similar in requirements. NIST in particular got called out for work and already implemented "IoT Cybersecurity Guidance" [2]. Mostly part of "Trustworthy Network of Things". [3] Also [4].

[1] (Public Law No: 116-207), https://www.congress.gov/bill/116th-congress/house-bill/1668

[2] NIST, IoT Guidance and Catalog, https://csrc.nist.gov/News/2021/updates-to-iot-cybersecurity...

[3] Trustworthy Network of Things, https://www.nist.gov/programs-projects/trustworthy-networks-...

[4] IoT Cybersecurity, https://www.nist.gov/itl/applied-cybersecurity/nist-cybersec...

I wish we had a longer form discussion framework, as I'd be curious to know what USians think of how this is going - but anyway thanks very much for those useful links on how it's working stateside.

Either replying here works, or profile has a fairly simple to solve contact if you really want to ask me those questions.

Tend to fairly regularly check comments from at least the last week to see if anybody responded.

Notably, while following the situation, and knowing a bit about the IoT world, not deeply involved in microcontrollers or IoT design. Mostly aerospace personally. Some experience with Wifi and Bluetooth development for Windows and Android, with a bit of Arduino, yet that's the perspective for discussion / questions.

Can refer you to a few NIST folks and some NIST mailing lists.

The article says:

> Das Beispiel, das wie ein Hollywood-Szenario daherkommt, hat sich wirklich so zugetragen.

Google translate:

> This example, which seems like a Hollywood scenario, actually happened.

So this article states that this actually happened.

So OP's claim that this article states it's just an example which didn't happen, is incorrect.

I'm not saying it did happen, just that the article does not state what OP says.

Yes. Or we would end up comparing multiple news stories, presumably at least partly fact-checked (but you never know these days), against a single post on a random social network.

The translation is correct regarding the articles claim of the stories legitimacy.

To expand on the initial dramatized story:

> Sie steht zu Hause im Badezimmer, doch sie ist Teil einer gross angelegten Cyberattacke. Die elektrische Zahnbürste ist mit Java programmiert, und unbemerkt haben Kriminelle darauf eine Schadsoftware installiert – wie auf 3 Millionen anderen Zahnbürsten auch. Ein Befehl genügt, und die ferngesteuerten Zahnbürsten rufen gleichzeitig die Website einer Schweizer Firma auf. Die Seite bricht zusammen und ist für vier Stunden lahm gelegt. Es entsteht ein Schaden in Millionenhöhe.

The article claims that an electric toothbrush with Java-based software was the target of malware. Criminals then leveraged this malware to execute a ddos from the toothbrushes against the website of a swiss business.

The article further claims this led to a downtime for around five hours with expect damages in the millions.

Dentist: You've got seven cavities

Me: Damn garbage collector

>The article claims that an electric toothbrush with Java-based software was the target of malware

The chef's kiss moment of this story would be that it was Log4J vuln that was unable to be patched because why would they make updates to a toothbrush. I'm guessing that would complete somebody's bingo card.

Who had DDoS attack, Botnet, IoT Device, Java, Log4J?

The point of linking to that article is that it's not plausible that a 3-million-device botnet attack would be first reported as a one-paragraph example at the beginning of a general cybersecurity article in a regional German publication.

Proof? This is just some random person claiming it's not true but they link to an article which explicitly states that it is in fact true. Am I missing something?

I believe the Mastodon OP mistranslated the German article, which states:

> Das Beispiel, das wie ein Hollywood-Szenario daherkommt, hat sich wirklich so zugetragen.

Correct translation:

> This example, which seems like a Hollywood scenario, actually happened.

But as you can see, if you miss the last part, it's easy to get the translation wrong.

(Interestingly, the Swiss article doesn't directly quote Fortinet as a source, but as an expert opinion. Maybe something was lost in translation there when the story went viral?)

I think OP wants to say that the only source for such a massive bot net is a tiny newspaper article.

Million dollar damage because a Swiss site wasn't reachable for 4 hours?

I doubt that.

It's Switzerland. Maybe it was a watch website that could sell a few 100k watches...

The claim being made is ludicrous, doesn't hold up to scrutiny or common sense, and the amount of details given is sparse enough to cause disbelief.

If this is real, the article is beyond useless in informing people of what has happened and how it's happened.

I use a couple of TP-Link smart power plugs and one of them occasionally wants to access the internet to get the time from an NTP server. Since I block all their internet access this one goes crazy and brings my DNS server (custom written in Python) down to a halt. Just blocking him in the firewall of the AP would probably also not make him behave and he'd still pollute the RF spectrum. Happens rarely, though. Kicking him off of the WiFi and letting him reconnect makes him behave again.

This is the most anthropomorphically abusive and hilariously accurate comment I've read in awhile.

Funnily enough that happens also when you run the original article through Google translate:

> She's in the bathroom at home, but she's part of a large-scale cyber attack. The electric toothbrush is programmed with Java, and criminals have unnoticed installed malware on it - like on 3 million other toothbrushes.

(In German, toothbrushes are female, like all brushes.)

So the claim is the women started talking and wouldn't be quiet? "Nevertheless, she persisted"

German, like many other European languages, uses gendered nouns and refers to nouns with gendered pronouns.

It means nothing other than that you need to remember the correct pronoun for every noun, which is absurd.

I didn't even consider that parent might come from a gendered language background! Lack of insight on my part.

I just assumed they were gendering inanimate objects, which even non-gendered English speakers will do, but conveys more anthropomorphic intent.

If he were a good boy, he would listen to what is told to him by the DHCP server and use the local NTP server instead (not only is it closer but it's also fed by PPS-accurate GPS data).

> This is the most anthropomorphically abusive and hilariously accurate comment I've read in awhile.

Let's coin a term for this: misanthromorphism.

Kevin Beaumont is not exactly a random person in this instance, he's a pretty experienced writer on cybersecurity.

He elaborates farther down the thread:

> A botnet of 3 million toothbrushes would be twice the size on Mirai's various botnets put together, and a MAJOR infosec event. The person they were interviewing has only worked there about a year, and Fortigate staff don't appear to know about this botnet.

Edit to add:

Imagine you read on TechMeme that room-temperature superconductors are now confirmed to exist. But when you trace the story back, the original citation is an article in the Tucson Regional Business Journal about how scientific research benefits innovation. Would you think "wow, big scoop for the TRBJ!" Or something more like, "I bet that business reporter misunderstood something they heard."

Reminds me of the "Jick Study" that Dopesick talks about[0].

This was a simple letter to the editor, written by a doctor, that became the driving force behind Oxycontin marketing.

[0] https://www.theatlantic.com/health/archive/2017/06/nejm-lett...

Or, similarly, the letter to the editor in NEJM which caused decades of mistrust of MSG -- and which, depending on who you listen to, might or might not have been a deliberate hoax.

https://news.colgate.edu/magazine/2019/02/06/the-strange-cas...

The article claims a million dollar damage because the site of Swiss company wasn't reachable for 4 hours.

Highly unlikely.

Your are missing the part that Fortinet didn't publish the attack themselves but choose a non technical news paper.

Highly suspicious and now confirmed it didn't happen.

https://news.ycombinator.com/item?id=39300373

I was wondering because the toothbrushes I know use BT(LE) and aren't connected to the Internet. However, some light bulbs do have WIFI and sure one day could be exploited. And there are definitely more light bulbs than toothbrushes around here.

And all those TVs and fridges. And even the peacemakers could one day deliver malware. /s

"Be afraid, be very afraid" Wednesday Addams - Addams Family Values

> And all those TVs and fridges. And even the peacemakers could one day deliver malware. /s

It's not the pacemaker malware you want to worry about, it's the pacemaker ransomware!

He said peacemaker, I assume hes talking about colt single action revolver.

Good point. Maybe you have an occasion to defend yourself and the weapon won't unlock [1] before depositing some BTC [2].

[1] https://www.wired.com/2014/05/sentinl-gun-lock/

[2] https://www.bleepingcomputer.com/news/security/hacker-used-r...

You're not thinking like a modern *aaS company. I'm waiting for subscription-based pacemakers. $9.95/mo for up to 60 beats per minute or $19.95 for unlimited heartbeats. Sign up for a year now and get an additional 3 months free :)

"We hope this message finds you with your beats still strong and rhythmic. It is with a heavy heart (pun fully intended) that we, at PulsarTech, your trusted provider of the world's first Internet-connected pacemaker, announce the discontinuation of our heartbeat-as-a-service (HaaS) platform. Yes, it’s time to say goodbye to those sweet, life-sustaining firmware updates and cloud-synced palpitations."

I'm hoping that in this hypothetical there is an OpenHeart group that shared software and build scripts for self-hosting the heartbeat cadence functionality.

> $9.95/mo for up to 60 beats per minute or $19.95 for unlimited heartbeats.

If a company ever did this, I bet they'd charge at least 10 times more than that.

And don't forget OTA updates

"Don't die during reboot"

> And even the peacemakers could one day deliver malware.

Oh, the Convair B-36 Peacemaker definitely delivered malware.

Why would they be talking about a bomber airplane in this context?

They were clearly referring to the Colt Single Action Army revolver handgun.

Because I started thinking about which device (nuke vs. lead bullet) was more capable of delivering computational malware, as that would lend itself to more entertaining pun.

But I eventually decided that wasn't a fruitful vein of humour, so I pared it back to mere mention of the weapon.

I.e., even though I no longer jad a reason to prefer the bomber over the pistol for the pun, I stayed with it out of mere joke-planning inertia.

Why mention just one or the other in my original comment? Well, because, as you probably know, brevity is the soul of wit.

My Home Assistant set up keeps trying to connect to my neighbour's toothbrush via Bluetooth.

Do it!

Jim, my house keeps telling me you aren't brushing enough. Can you start doing that so my home stops sending me notifications? surreal

Here's the link to the actual article instead of someone's social media post that contains a screenshot that contains an unclickable link to the article:

https://www.tomshardware.com/networking/three-million-malwar...

Disclaimer: Maybe the image is clickable or there's a clickable link in the social media post for most people, but because Mastodon doesn't show posts without javascript enabled I can only ever see whatever shows up in the RSS feed.

This is not the original article, it's just an article taking up and spreading the claim. The original article[1] they linked is from a German newspaper in Switzerland, predating the article from tomshardware.com by a whole week.

[1] https://archive.ph/2024.01.30-203406/https://www.luzernerzei...

You are right, it's just the article that was included in the social media post.

The German article says it got the information from a report by fortinet. I didn't notice anything about the DDoS attack there, but i did find these:

https://filestore.fortinet.com/fortiguard/research/mobileiot...

https://filestore.fortinet.com/fortiguard/research/toothbrus...

While part of me wishes the story were true, as it’s just hilarious thinking about _a toothbrush_ carrying out someone else’s ill will. I am glad it’s not.

It’s truthy, of the sort that is plausible.

Someday a headline like this will actually be true.

I think of it more like accidentally publishing a prewritten celebrity obituary.

It's hard to believe that toothbrushes run Java. There's just not enough space in them for that. Plus 3 million is a huge number.

Is Java ME the smallest Java platform with ~8MB of RAM as a requirement?

[edit]

No, Java ME CLDC can run on devices with as little as 160kB of ROM and 8kb of RAM.

You get into "does this still really count as java" but I believe this runs in most sim cards: https://en.wikipedia.org/wiki/Java_Card

Java in a 5x18mm device over 20 years ago: https://csrc.nist.gov/csrc/media/projects/cryptographic-modu...

Not to mention java card

Anyone remember the Java ring given out at JavaOne?

https://www.ebay.com/itm/300495374337

Do you know the origin of Java? Fun fact, it was originally made for embedded, small electrical devices.

While not exactly, small, the first Java product was remote controller with touchscreen...

https://archive.org/details/Star7Demo

You can run Java on an ESP32, though why you would want to is another question.

Connect it to a relay to start your brew in the morning?

At 3 million it would be the 8th largest botnet ever discovered. https://en.wikipedia.org/wiki/Botnet#Historical_list_of_botn...

Most SIM cards run Java

3 billion devices run java.

Your credit / debit card (and probably your SIM card) run Java[1]. So did most cellphones from the early 2000s[2]. I can believe that some IoT devices run chips more powerful than your average phone from 20 years ago.

[1] https://en.wikipedia.org/wiki/Java_Card [2] https://en.wikipedia.org/wiki/Java_Platform,_Micro_Edition

JavaCard has actually lost a lot of its popularity for ICC applications like credit cards and SIMs. It's hard to get good numbers from the industry, which tends towards secretive, but these days SELP and MULTOS seem more popular.

Of course the availability of multiple OS for these devices reinforces the idea that you can run a lot of things on some very low power devices these days.

At the same time, it's important to understand that JavaCard is a very constrained version of Java. Most JavaCard platforms have no support for IP networking, which would make it an unlikely source of DDoS (besides the fact that it requires relatively specialized developer tooling).

> Most JavaCard platforms have no support for IP networking, which would make it an unlikely source of DDoS

I'm not claiming that you could use a smart card for DDoS (the idea seems absurd, but somebody is probably going to prove me wrong one of these days), merely that if some version of Java runs on a smartcard, I don't find it that unimaginable for a toothbrush to have a good enough chip to run Java, perhaps with enough resources for a TCP / IP stack. Something equivalent in performance to an old, WAP-capable phone that also ran Java ME, perhaps.

You can, today, buy ARM chips with support for executing simple Java Bytecode directly. The Jazelle[0] earchitecture is a primary intended to accelerate JVMs[1] and is still found on some devices. There also were some other initiatives around embedded devices on the past to get Java running on smart cards and more.

[0]: https://en.m.wikipedia.org/wiki/Jazelle in [1]: https://developer.arm.com/documentation/ddi0406/c/Applicatio...

My "smart" tooth brush wants my location data to use the app....

https://android.stackexchange.com/questions/160479/why-do-i-...

if you use an iPhone, my apologies

AFAIK that's because granting access to bluetooth potentially allows the app to track your location (via bluetooth beacons). As a result both iOS and Android show the location warning just in case the app wants to do something malicious. Just because you see the warning doesn't mean the app is trying to ship your location to China.

I have had the tooth brush for a while, maybe four or five years.

When I saw your comment I figured I should check and see and it looks like they dropped the location permission.

https://play.google.com/store/apps/details?id=com.philips.cd...

On iPhone, bluetooth is presented to the user as a location check. Big data companies will if you're near your toothbrush then you're at home. And they can figure out where "home" is by other tracking methods.

>Big data companies will if you're near your toothbrush then you're at home. And they can figure out where "home" is by other tracking methods.

You don't need bluetooth to do that. By keeping track of your public/private ip (which requires no special permissions), and correlating it to time of day, it's fairly easy to infer whether you're home or not. If there's a network you're regularly connected to during the evening and weekends, it's highly probable that you're "home".

Reminds me a little of Stuxnet, which certainly happened: https://www.quora.com/What-is-the-most-sophisticated-piece-o...

Things like this combined with AI are the scariest version of the future, I think. If we ask a very capable AI to solve climate change, what if it decides to solve it by creating something like Stuxnet for human infrastructure?

Peter Watts novel Starfish, a stunning quarter century old now, has exactly that problem as part of its side plot. In a chilling detail relevant to today, it posits a black-box trainable neural network (biological in the book but an irrelevant difference overall) tasked with solving some of the big issues, which makes subtle links and determinations in the model which eventually end up potentially disastrous for human kind.

Ooh! Just yesterday I an old radio performance [0] of the short story, "A Logic Named Joe" [1], which also seems very apropos.

Highly recommended!

[0] https://www.relicradio.com/otr/2021/12/a-logic-named-joe-by-...

[1] https://en.wikipedia.org/wiki/A_Logic_Named_Joe

The story isn't true _yet_.

A research presentation by fortinet covering a BLE-enabled toothbrush that communicates with the cloud over a mobile app.

Also mentioned by a comment on the original post.

3M (the Minnesota Mining and Manufacturing Company) makes many products but teethbrushes are not among them. However they are well equipped to satisfy all your PFOA and PFAS needs forever.

If you are using floss, it is likely PFAS coated. Also lipitor, prozac, cipro, flonase and nearly a majority of new pharmaceuticals in development.

'PFAS bad' is about as sophisticated a viewpoint as 'nuclear bad'.

Also, 3M is exiting PFAS tech since it only accounts for a few % of their business: https://news.3m.com/2022-12-20-3M-to-Exit-PFAS-Manufacturing...

This viewpoint seems short-sighted. In the 1940s and 1950s, if somebody were skeptic of lead, you could've replied "Do you paint your home? Get your water from pipes in your house? What about having gas in your car?"

One wears a lead vest when getting x-rays at the hospital or as protective equipment when operating on nuclear reactors.

Moving beyond eating lead doesn't mean not using it intelligently when the risk profile is low. Also, lead-based glass is also an important component of the world's high-efficiency perovskite solar cells.

Many of the industrial products materials we wouldn't want to eat, this just means we have to be better about recycling.

Not sure why x-rays are still being used when there appears to be better and safer alternatives... Specially at the dentist where an inexperienced person shoots them at your head... Thank God they cover your chest with lead though....

> Not sure why x-rays are still being used when there appears to be better and safer alternatives

It all has to do with how medical billing is structured. Xrays were already cheap before the current model was put in place so they are the go to method for diagnostic. Even though there are better ubiquitous options available, price fixing keeps those out of reach for triage and simple diagnostics.

The standard dentist X-ray does you with about as much exposure as you get on a flight from the UK to Spain, I believe

But I have no faith that they know how to adjust the machine....

> 'PFAS bad' is about as sophisticated a viewpoint as 'nuclear bad'.

Is PFAS denialism going to be as bad as climate change denialism is today, or tobacco disease denialism used to be? I'm tired of all these people refusing to acknowledge widespread scientific consensus. (Assuming you're not a 3M or DuPont astroturfer, of course.)

"3M" in the title stands for "3 million", not the company 3M.

I read it as 3M the company. The title should probably be fixed.

"3M" is the Minnesota Mining and Manufacturing Company. "3 M" is 3 million. Typography can be meaningful.

A translation problem. Between a Swiss company and the Swiss newspaper that interviewed them. Of course.

Fortinet confirmed it wasn't a real attack

https://news.ycombinator.com/item?id=39300373

I did think it was kinda sus because those are usually Bluetooth not WLAN connected but hey maybe there are wifi brushes now

There are some: https://oralbconnect.com/faq/#question-6a2zEDL932GFQWv1HhT25...

I'm more surprised people took that seriously.

I really don't think even 1 million toothbrushes exist that have any IP connectivity at all, let alone three million all being pwned. I would assume that if anyone had sold that many Wi-fi models, one of the big manufacturers would have some, and as far as I'm aware, none do, they all use Bluetooth. Not sure I buy that a bluetooth toothbrush can DDOS a website.

From a quick Google search, at the very least Oral-B uses WiFi on some of their models: https://oralbconnect.com/faq/#question-6a2zEDL932GFQWv1HhT25...

I bought a frankly too expensive iO10 and it only connects to my phone via Bluetooth.

Ugh, god. This link led me to read the mastodon front page for a while (popular posts across the mastodon fediverse).

Total ideological lockstep combined with intense self-righteousness, and not a single contrarian opinion in sight.

Wasn’t this a Silicon Valley plot line, but with fridges?

Too bad because it was quite a funny story.

I mean in retrospect, I can imagine it would be almost impossible to find all those toothbrushes and hack them remotely, unless they were all connected to a central server that would have been hijacked, so yeah.

I mean, are you sure your toothbrush is getting security updates?

Because not many other devices on the internet of things are.

isn't true... yet.

Reply on news.ycombinator.com