Security disclosure about a Bluetooth toilet | Hacker News Reader

Security disclosure about a Bluetooth toilet

trustwave.com

98 pointstosbourn28 comments

According to this[0] the flush volume of this toilet is 5 liters. If it takes two minutes to flush and refill then the amount of water you could waste in an hour is:

30 * 5 = 150L

If a family is away on vacation, you could theoretically flush for days.

24 * 150 = 3600L per day

In Seattle the water costs about 4.5 cents per cubic foot.[1] (If it costs 4.50 dollars for one CCF (which is 100 cubic feet) then I move the decimal place over two times.)

According to this[2] "1 Liter = 0.0353146667 Cubic Foot"

If that's the case then at 3600L per day you can flush 127.1328001 Cubic Feet of water.

127.1328001 * 4.5 = 572.0976005 cents

Round down to 572, divide by one hundred:

You can grief somebody for $5.72 a day in Seattle with this exploit. If you were to constantly flush all year it would cost you:

$5.72 * 365 = $2087.8

One way you could exploit this is if you obsessively watched out for the neighbors to see when they came and went and flushed when they aren't home.

[0]: http://www.inax-usa.com/download/catalog/pdf/0008-2.pdf (Page 18, flushing volume)

[1]: http://www.seattle.gov/util/MyServices/Rates/WaterRates/Resi...

[2]: http://www.asknumbers.com/LiterToCubicFeet.aspx

I was always under the impression that our water in Seattle is cheaper than in most places?

Probably the greatest monetary cost you could cause the owner to incur is if they thought the toilet was faulty in some way due to the continuous flushing and had to call in a plumber.

Also I can't believe I'm seriously having a discussion about toilets on HN. Heh.

In Austin I pay about 1.3 cents/gallon, or 10.4 cents/cubic foot of water, $10.40/CCF. This is including waste water service, which is nearly twice as much as water service (but based on the same amount of water).

However, this is based on my own bill (total billed amount divided by total water used) -- a bit tricky since there are tiers and surcharges.

Also, we're under water restrictions due to the drought - water the lawn once a week, no washing your car in the driveway, etc.

Many water utilities also have a penalty rate if you exceed a given usage.

In some parts of the UK water is unlimited - you only pay a yearly fee for access, but you can literally use as much as you like - it's not metered. So flushing your neighbour's toilet would be at most amusing,but not costly.

I live in St Louis, MO, where in many parts of the area the water system is old enough that they don't even have meters.

The water division charges a flat rate based on the number of rooms and toilets/showers in the house, as that information is on file with the property tax assessor's records. If you ever add or remove a room or water fixture, you have to get a permit, which would get those upgrades reflected on the assessor's records.

A better way to grief somebody with this is to probably just flush their toilet a bunch while they are home. That would get annoying real quick.

Although not mentioned in the advisory, this particular model also allows you to play sounds through the toilets internal speaker.

Any exploit should surely consist of the lid flapping open and closed while the toilet whispers to you, beckoning you to come closer, and finally squirting you in the eye with the bidet.

"Didn't your parents tell you never to listen to toilets?"

I'm going to go ahead and file this away as an example of how needless complexity can bite you in the ass. In this case, almost literally.

Here's the app that goes along with the toilet: https://play.google.com/store/apps/details?id=jp.co.lixil.re...

At least the poop journal aspects shouldn't be compromised even if your toilet is :)

Toilets are awesome. We rarely talk about them (or sewers), but they are a VERY important part of disease control. Toilets save lives, we just don't realise it.

And electronic bidets are the most awesome of toilets. Once you get used to them (and they are fairly affordable as long as you don't go for Toto), using paper feels so... primitive.

Almost eleven years ago, one Stana Claus contributed† the following factoid to history:

    Just so you know, some varieties of corn have a dark reddish cob
    while others have more of a whitish colored cob. When I was but a
    wee child I was told by my beloved grandfather that the proper
    outhouse technique required "two reds and a white". The red cobs
    (apparently more readily available, at least in that locale) were
    used for bulk removal, and the white was used to determine if the
    job was sufficiently done. Surely, my grandfather wouldn't have
    lied to a small impressionable child about such a thing!

†http://boards.straightdope.com/sdmb/showpost.php?p=2363912&p...

.. so you can flush without touching the toilet? .. brilliant :P

But that means you have to touch your phone, probably before washing your hands first. Less than ideal.

Less than ideal, but phones are a breeding ground for bacteria already.

...but hopefully not fecal bacteria.

I don't know, Angry Birds (and smart phones in general) ushered in a new era of bathroom-related hygienic disasters.

Yes, but you usually use the phone while seating on the toilet, then put it away, wipe, go and wash your hands. Therefore there is no contact with your phone between wiping and washing your hands. With this - you need to flush, so you will use your phone to flush, then wash your hands, and then touch your phone again - bam,all the bacteria are on your hands again.

http://healthland.time.com/2011/10/17/study-1-in-6-cell-phon...

> What’s on your smartphone? Probably fecal matter

More like "probably not fecal matter" if it's 1 out of 6.

Not with the Moto X, "OK Google Now, flush toilet"

"Siri, spray shiri," in this case.

Finally, a use for the Leap Motion.

"OK Glass, flush!"

It was already in my hand anyway.

> But that means you have to touch your phone, probably before washing your hands first.

If you can one-hand your phone, and do the other task with one hand, this isn't a problem.

Reply on news.ycombinator.com