Hacking a Coffee Machine
A Jura F90 Coffee Machine can be hacked remotely over the Internet.
Comments
DVD • June 19, 2008 4:13 PM
Sounds like another Java issue to me. (sorry, had to do it)
Dan • June 19, 2008 4:19 PM
I’ve been impressed by how many people quoting this story have failed to actually read the original article — the coffee maker can’t be hacked, the coffee maker doesn’t connect to the internet at all, it uses a PC to do that.
Software running on a PC can be hacked — which is nothing new, it’s just that this software drives a coffeemaker.
Heck, the fact that there’s a PC-controllable coffeemaker is also nothing new, this is just an elaborate out-of-the-box approach rather than (if you’ll pardon the pun) a homebrew solution.
Phuubaar • June 19, 2008 4:33 PM
@Dan: that just means that the whole coffee-making system constitutes not only the maker itself but whatever automation is driving it. If I buy a car with a robot driver, and someone else can tell the robot driver to drive into a tree without my permission, that’s a problem with the whole system, regardless of whether the car by itself would be perfectly safe.
The coffee maker trusts the control software, and the control software trusts the Internet erroneously, so the transitive trust creates a security problem.
Davi Ottenheimer • June 19, 2008 5:07 PM
This seems a bit like reporting someone has discovered their coffee can be stolen when they install the machine in a public area.
Step one, install software on a Windows XP system that can be remotely accessed and can’t be patched…say no more.
Anonymous • June 19, 2008 5:24 PM
fyoder, from Slashdot:
Once the coffee maker is compromised and turned into a rogue email server, breakfast choices will be coffee and spam, coffee egg and spam; coffee egg bacon and spam; coffee egg bacon sausage and spam; coffee spam bacon sausage and spam; coffee spam egg spam spam bacon and spam; coffee spam sausage spam spam bacon spam tomato and spam….
Vikings: Spam spam spam spam…
Henning Makholm • June 19, 2008 5:26 PM
Haven’t you all read the boilerplate disclaimer that takes up more than half of the post Bruce links to? Not being named addressees, we’re not even supposed to know this. It can only have been an error that this explicitly confidential information was posted on a publicly archived mailing list. Go scrub your minds, everyone!
SteveJ • June 19, 2008 6:08 PM
@Henning
I am a named addressee – the first line of the message is “Hi All”. That’s us.
And the disclaimer is less than half the post, once you include the navigation and advertising junk the list archive has wrapped it up in. Oh, hang on, that doesn’t make it better…
Pat Cahalan • June 19, 2008 6:46 PM
“You can hack into my systems, I’ll clean up the mess. You can warez my data, I’ll restore from backup. You can DDOS my site, I’ll weather the storm.
You bastards messed with my coffee. Now… it’s payback time.”
— quote from the as yet unreleased “Nerdjitsu, The Vengeance”
Pat Cahalan • June 19, 2008 6:48 PM
@SteveJ
I am a named addressee – the first line of the message
is “Hi All”. That’s us.
Nice. Full point.
Michael Hampton • June 19, 2008 8:18 PM
Nobody messes with my coffee and gets away with it.
moz • June 20, 2008 12:54 AM
damn.. I shall never be able to start a message with “hi all” again…
hi specified recipients of this email;
hi addressees;
hi all (all should not to be taken to include people not listed in the original from field of this email. before reading please contact the author to verify that you were correctly addressed and have not been accidentally added to the mail by an automated system or manual forwarding),
Our dynamic staircase pre-plan is leading more cases into our sales pipe we hope our helicopter view will allow us to grab the low hanging fruit and realise new synergies from this in the next quarter.
Paeniteo • June 20, 2008 1:52 AM
@moz: “damn.. I shall never be able to start a message with “hi all” again…”
Wrong conclusion 😉
When posting to public mailing lists, you shall remove that stupid disclaimer.
FWIW, in Germany, although these things are getting common, too, the general legal view is that they are utterly pointless. At the very least, to even have a remote chance of being legally binding, they would have to be at the beginning of a mail (so that you can stop reading in time).
Stephen • June 20, 2008 2:50 AM
Are there any countries where these disclaimers have any force?
I did once manage to persuade a company to replace the silly disclaimer with a more friendly one along the lines of “sorry for bothering you, and we’d appreciate it if you could let the sender know about the mistake”. But a year later they’d gone back to the silly legalese.
greg • June 20, 2008 3:09 AM
No longer a DoS attack, but rather escalated to a DoC attack!!!
ALF • June 20, 2008 5:04 AM
All your coffee are belong to us!
Chris Samuel • June 20, 2008 6:20 AM
He’s followed that up with a wireless attack on a toothbrush.
http://gse-compliance.blogspot.com/2008/06/craig-wright-security-advisory-0002.html
Love the Vendor Response section:
“I was unable to get an adequate result from the vendor and the receptionist did not forward the calls after the first few. A direct call to the sales channel resulted in the comment, “who the hell would want to monitor a toothbrush”.”
Harry • June 20, 2008 8:25 AM
@Paeniteo: my favorite bit of the legalese is the part that tells me I have no right to the data and I am required to return it without reading (how, when the notice is at the end? even if the notice is at the beginning how do I know this email from a lawyer I know isn’t for me?) and can’t use it, etc., etc., etc.
If someone accidentally sends me an email, I don’t see that I have any obligations regarding that data. Morally I am required to send it back or delete it, by the rules of courtesy I should (and would). Legally I am not party to the transactions and have neither obligations nor rights. The parties have no standing to order me to do/not do anything with the information.
In other words, tough patooties.
DaveAronson • June 20, 2008 9:53 AM
I’m just a bean tryin’ to get some sleep!
Oh. Wait. I’m a coffee bean. Never mind.
Anonymous • June 20, 2008 2:28 PM
The US courts have consistently ruled that anything arriving by mail which you did not order is a gift, that you can keep or dispose of in any way you see fit. I have a hard time believing that email would be any different.
SteveJ • June 21, 2008 8:30 AM
@Harry:
In the UK at least, if you know that something is confidential and you pass it on, then you might be liable for damages. Then again you might not.
It doesn’t matter whether you’ve accepted any terms and conditions, it’s just a fact of law that there are some circumstances where telling someone’s secrets is tortious or even criminal. You have no choice in the matter (other than to not use the information) and must take your own legal advice.
There seem to be two styles of this disclaimer clause in the UK. They used to say, “you must X, Y and Z”, but I’ve noticed lately that a lot say, “you are requested to do X, Y and Z”. I don’t know whether this is the result of a ruling or just a change in the state of the art.
Of course when email is sent internationally, it’s anybody’s guess what a disclaimer designed for the UK means in the US, and vice versa.
“Legally I am not party to the transactions and have neither obligations nor rights.”
Doesn’t follow – there are plenty of circumstances in law where you have implicit rights or responsibilities without deliberately becoming a party to any transaction.
@Anonymous:
If somebody ships something to your address by accident, then I don’t think you can automatically keep it. I may be wrong. It’s when they send you unsolicited rubbish and expect you to either return it or pay for it that the courts have taken a dim view.
Anonymous • June 22, 2008 11:01 AM
They set us up the bean!
Anonymous • June 24, 2008 2:06 PM
Of course the coffe maker must be running java
2Easy2Worry2MUCH • June 25, 2008 10:50 AM
Ha! That’s NOTHING! Today I found a much more useful hack of our Flavia coffee machine when we ran out of the paper cups that come with it.
If you place a different cup on the plate under the dispensing nozzle it will not dispense coffee. That is until you skillfully and carefully place your hand round the base of the incompatible cup (being sure not to touch the cup because it gets hot); then OUT squirts coffee (or tea or whatever was your chosen beverage).
Now That’s what I call a hack, and that I think closer to the original sense of that word. And, it’s a hardware hack!? (I’m speculating that the sensor relies on local changes in capacitance or something, certainly it doesn’t appear to be optically-based.)
Subscribe to comments on this entry
Leave a comment
Sidebar photo of Bruce Schneier by Joe MacInnis.
Anonymous • June 19, 2008 3:45 PM
“Best yet, the software allows a remote attacker to gain access to the Windows XP system it is running on at the level of the user.”
Too bad, is that all, I thought I was going to get a free cup of coffee.