Schneier on Security
A blog covering security and security technology.
« Eavesdropping on Encrypted Compressed Voice |
| Underhanded Implementation of RC4 »
June 19, 2008
Hacking a Coffee Machine
A Jura F90 Coffee Machine can be hacked remotely over the Internet.
Posted on June 19, 2008 at 3:18 PM
• 27 Comments
To receive these entries once a month by e-mail, sign up for the Crypto-Gram Newsletter.
"Best yet, the software allows a remote attacker to gain access to the Windows XP system it is running on at the level of the user."
Too bad, is that all, I thought I was going to get a free cup of coffee.
Sounds like another Java issue to me. (sorry, had to do it)
I've been impressed by how many people quoting this story have failed to actually read the original article -- the coffee maker can't be hacked, the coffee maker doesn't connect to the internet at all, it uses a PC to do that.
_Software running on a PC_ can be hacked -- which is nothing new, it's just that this software drives a coffeemaker.
Heck, the fact that there's a PC-controllable coffeemaker is also nothing new, this is just an elaborate out-of-the-box approach rather than (if you'll pardon the pun) a homebrew solution.
@Dan: that just means that the whole coffee-making system constitutes not only the maker itself but whatever automation is driving it. If I buy a car with a robot driver, and someone else can tell the robot driver to drive into a tree without my permission, that's a problem with the whole system, regardless of whether the car by itself would be perfectly safe.
The coffee maker trusts the control software, and the control software trusts the Internet erroneously, so the transitive trust creates a security problem.
Hacked coffee is probably better than the coffee they have now, if previous corporate experience is any guide.
This seems a bit like reporting someone has discovered their coffee can be stolen when they install the machine in a public area.
Step one, install software on a Windows XP system that can be remotely accessed and can't be patched...say no more.
fyoder, from Slashdot:
Once the coffee maker is compromised and turned into a rogue email server, breakfast choices will be coffee and spam, coffee egg and spam; coffee egg bacon and spam; coffee egg bacon sausage and spam; coffee spam bacon sausage and spam; coffee spam egg spam spam bacon and spam; coffee spam sausage spam spam bacon spam tomato and spam....
Vikings: Spam spam spam spam...
Haven't you all read the boilerplate disclaimer that takes up more than half of the post Bruce links to? Not being named addressees, we're not even supposed to know this. It can only have been an error that this explicitly confidential information was posted on a publicly archived mailing list. Go scrub your minds, everyone!
I am a named addressee - the first line of the message is "Hi All". That's us.
And the disclaimer is less than half the post, once you include the navigation and advertising junk the list archive has wrapped it up in. Oh, hang on, that doesn't make it better...
"You can hack into my systems, I'll clean up the mess. You can warez my data, I'll restore from backup. You can DDOS my site, I'll weather the storm.
You bastards messed with my coffee. Now... it's payback time."
-- quote from the as yet unreleased "Nerdjitsu, The Vengeance"
> I am a named addressee - the first line of the message
> is "Hi All". That's us.
Nice. Full point.
Nobody messes with my coffee and gets away with it.
damn.. I shall never be able to start a message with "hi all" again...
hi specified recipients of this email;
hi all (all should not to be taken to include people not listed in the original from field of this email. before reading please contact the author to verify that you were correctly addressed and have not been accidentally added to the mail by an automated system or manual forwarding),
Our dynamic staircase pre-plan is leading more cases into our sales pipe we hope our helicopter view will allow us to grab the low hanging fruit and realise new synergies from this in the next quarter.
@moz: "damn.. I shall never be able to start a message with "hi all" again..."
Wrong conclusion ;-)
When posting to public mailing lists, you shall remove that stupid disclaimer.
FWIW, in Germany, although these things are getting common, too, the general legal view is that they are utterly pointless. At the very least, to even have a remote chance of being legally binding, they would have to be at the *beginning* of a mail (so that you can stop reading in time).
Are there any countries where these disclaimers have any force?
I did once manage to persuade a company to replace the silly disclaimer with a more friendly one along the lines of "sorry for bothering you, and we'd appreciate it if you could let the sender know about the mistake". But a year later they'd gone back to the silly legalese.
No longer a DoS attack, but rather escalated to a DoC attack!!!
All your coffee are belong to us!
He's followed that up with a wireless attack on a toothbrush.
Love the Vendor Response section:
"I was unable to get an adequate result from the vendor and the receptionist did not forward the calls after the first few. A direct call to the sales channel resulted in the comment, “who the hell would want to monitor a toothbrush”."
All your bean are belong to us!
@Paeniteo: my favorite bit of the legalese is the part that tells me I have no right to the data and I am required to return it without reading (how, when the notice is at the end? even if the notice is at the beginning how do I know *this* email from a lawyer I know isn't for me?) and can't use it, etc., etc., etc.
If someone accidentally sends me an email, I don't see that I have any obligations regarding that data. Morally I am required to send it back or delete it, by the rules of courtesy I should (and would). Legally I am not party to the transactions and have neither obligations nor rights. The parties have no standing to order me to do/not do anything with the information.
In other words, tough patooties.
I'm just a bean tryin' to get some sleep!
Oh. Wait. I'm a *coffee* bean. Never mind.
Sleep is a symptom of CDD.
Yes, Caffeine Deficit Disorder.
The US courts have consistently ruled that anything arriving by mail which you did not order is a gift, that you can keep or dispose of in any way you see fit. I have a hard time believing that email would be any different.
In the UK at least, if you know that something is confidential and you pass it on, then you might be liable for damages. Then again you might not.
It doesn't matter whether you've accepted any terms and conditions, it's just a fact of law that there are some circumstances where telling someone's secrets is tortious or even criminal. You have no choice in the matter (other than to not use the information) and must take your own legal advice.
There seem to be two styles of this disclaimer clause in the UK. They used to say, "you must X, Y and Z", but I've noticed lately that a lot say, "you are requested to do X, Y and Z". I don't know whether this is the result of a ruling or just a change in the state of the art.
Of course when email is sent internationally, it's anybody's guess what a disclaimer designed for the UK means in the US, and vice versa.
"Legally I am not party to the transactions and have neither obligations nor rights."
Doesn't follow - there are plenty of circumstances in law where you have implicit rights or responsibilities without deliberately becoming a party to any transaction.
If somebody ships something to your address *by accident*, then I don't think you can automatically keep it. I may be wrong. It's when they send you unsolicited rubbish and expect you to either return it or pay for it that the courts have taken a dim view.
Of course the coffe maker must be running java
Ha! That's NOTHING! Today I found a much more useful hack of our Flavia coffee machine when we ran out of the paper cups that come with it.
If you place a different cup on the plate under the dispensing nozzle it will not dispense coffee. That is until you skillfully and carefully place your hand round the base of the incompatible cup (being sure not to touch the cup because it gets hot); then OUT squirts coffee (or tea or whatever was your chosen beverage).
Now That's what I call a hack, and that I think closer to the original sense of that word. And, it's a hardware hack!? (I'm speculating that the sensor relies on local changes in capacitance or something, certainly it doesn't appear to be optically-based.)
Schneier.com is a personal website. Opinions expressed are not necessarily those of BT.