Slashdot Mirror
All Your Coffee Are Belong To Us
Wolf nipple chips writes "Craig Wright discovered that the Jura F90 Coffee maker, with its honest-to-God Jura Internet Connection Kit, can be taken over by a remote attacker, who can cause the coffee to be weaker or stronger; change the amount of water per cup; or cause the machine to require service (call this one a DDoC). 'Best yet, the software allows a remote attacker to gain access to the Windows XP system it is running on at the level of the user.' An Internet-enabled, remote-controlled coffee-machine and XP backdoor — what more could a hacker ask for?"
Bullshit, those machines are secure as a mainframe.
Bah! Get your coffee and an old school French press to brew the tastiest coffee. Put your hacking efforts into the roasting, selection and cultivation of your beans and leave the time and resource wasting, lame Windows controlled coffee makers to the junk heap of history.
Visit Jonesblog and say hello.
I wonder how well it runs Java...
Sorry, that's the first thing that came to mind on the question of what more could a hacker want.
"Thanks for all the money you paid to us. We've used it to buy off ISO among other things" -Microsoft
I mean come on now... what good can an Internet connected coffee maker really do? No security conscious office will ever want a Windows enabled appliance around. Just imagine the scene:
Special Agent Wilkins: How the Hell did they get in?
Special Agent Thompson: Sir..... I... uh, think they got in through the coffee maker.
Special Agent Wilkins: The What?
Special Agent Thompson: Sir, the coffee maker that we got you for your birthday... the one that you wanted to be able to brew up a cup o joe from your office?
Special Agent Wilkins: Oh fsck me....
Visit Jonesblog and say hello.
Now I'm seriously concerned about a coffee trojan vulnerability.
I would hate to find out that my coffee had been maliciously replaced with decaf.
Of course I didn't RTFA... why would I do that? You really are new here aren't you? Don't let my UID fool you.
For leaving the IP-Enabled CoffeeMachine naked on a publicly accessible address and letting *jimbob nogood-hacker* do as he pleases.
Or maybe he just hadn't had his first coffee that day when it was setup.
Maybe I could hack my boss' coffee maker and weaken his daily dose.
Quick we will weaken their spirits with Weak Coffee then they will let their guard down! NO one can survive without caffeine!
How about the coffee?
and I thought the only security hole in coffee was drugging it. Although technically, you could knock out the entire IT department with that one and probably do less with this digital method. Anyway, if a company approves an internet capable coffee machine in the budget, they deserve to get hacked.
Google's Super Secret Search Algorithm: SELECT @search_results FROM internet WHERE @search_results = 'good'
Screw the company web server. Screw the sql database server. They've hacked the coffee machine! AHHHHHHHHH!!!!!!
-- Will program for bandwidth
So, does this device conform to the HTCPCP (Hyper Text Coffee Pot Control Protocol) [http://www.faqs.org/rfcs/rfc2324.html] ?
As far as I can tell, the coffeemaker *doesn't* run Windows-- the exploit is in the "connection kit", which is software that runs on a PC, which plugs into the coffeemaker, which lets coffee-people fix your coffeemaker from afar.
So this wouldn't have much in the way of applicability unless you knew someone with this particular $2000 coffeemaker, which was already experiencing problems, who had purchased the $100+ coffeemaker diagnostic kit and had the coffeemaker plugged in, through the diagnostic kit, to their PC at the time.
Seems like there are better ways to get into Windows.
... and not, oh, an integrated diabetes management system, pill dispenser, etc...
Help poke pirates in the eyepatch, arr.
... not everything needs an internet connection
If you mod me down, I will become more powerful than you can imagine....
"Fellas, don't drink that coffee! You'd never guess. There was a fish... in the percolator!"
If you let the whole world control your heating elements, bad things happen. When was the last time you saw an Itanium box with a public IP?
There's no failure quite as dissatisfying as a complete and total solution to the wrong problem.
Once the coffee maker is compromised and turned into a rogue email server, breakfast choices will be coffee and spam, coffee egg and spam; coffee egg bacon and spam; coffee egg bacon sausage and spam; coffee spam bacon sausage and spam; coffee spam egg spam spam bacon and spam; coffee spam sausage spam spam bacon spam tomato and spam....
Vikings: Spam spam spam spam...
Loose lips lose spit.
How well is the opposition's dev team going to perform with half strength coffee?
Don't people ever learn. If you don't install a firewall, anti-virus protection, and anti-spyware software on your coffee maker, you deserve to be hacked. My coffee maker runs Linux and has never been hacked.
It would be an attack on the entire company. Imagine the effects of decreased caffeine consumption. Productivity could be going way down. In fact I'd consider the attack a declaration of war.
Distributed Denial of Coffee? Really? This is the attack that will cause the End of the Internet, when caffeine-addicted sysadmins not getting their daily "fix" turns their frustration towards the servers.
From the dark, old days of the Internet when men were men, women were men, and children FBI agents
The most insightful answer here. You may admin the machine remotely all you like but without physical access, the sweet sweet coffee is beyond reach.
DRM: Terminator crops for your mind!
a more sadistic way to slow a business to a crawl
Predicted by this comic: http://tallcomics.com/index.php?strip_id=2
Whatever you do, don't ask it for a cup of tea while it's connected to the Internet. "Share and enjoy."
I, for one, welcome our new coffee brewing overlords.
Does it blend?
or make a decent cup of tea?
I Need someone to rebuild a Digitech Digital Delay pedal for me....for me...for me...for me.
Not only the article does not clarify where the vulnarability is (i.e. in the computer you connect the coffee maker to if it is running a certain version of XP using certain settings), it comes across as extremely superficial without any real information. There was barely any more information in the article as in the quoted short paragraph.
Cool link. I am reminded of those halcyon hacker days of yore, when everyone was smarter and +5 Funny, and winter exited March the second on the dot. I recall my college housemates trying to hack our PBX phone system so that you could call the washer and dryer and find out if your clothes were done, instead of having to walk down 3 flights to look. (It couldn't be done using a personal computer because no one owned such an expensive toy.)
It makes tea then convinces you that you only ever wanted a tea.
Did you hear the one about the Apple coffee maker?
It does an amazing Mocha Frappucino with whipped cream, caramel sauce and a chocolate flake in the top but doesn't know how to make a plain black coffee.
Did you hear the one about the Linux coffee maker?
v0.1 made a good plain coffee but it took a while doing it, v1.0 makes good plain coffee but there's a patch that allows it to make better tea than the Microsoft coffee maker and v2.0 gives you a cup of plain coffee, a cup of whipped cream, a cup of caramel sauce, a chocolate flake in a wrapper and tells you to make the coffee how you want but for a much lower price than the Apple one.
Did you hear the one about the Vista coffee maker?
Nope, neither did I but then who gives a shit.
Gentoo Linux - another day, another USE flag.
Forget Osama. They overtook the coffee maker. The whole fucking coffee maker!
Inspired by Bluto
I hadn't the slightest objection to his spending his time planning massacres for the bourgeoisie... (P.G. Wodehouse)
An Internet-enabled, remote-controlled coffee-machine and XP backdoor -- what more could a hacker ask for?
Access to the coffee his new bot brews?
Doesn't Linus run on coffee while hacking? I'm confused. Which came first, the kernel or the caffeine?
...to simulate network connection! I remember, at one of the labs I worked in as a student, someone had put a IP address label on the coffee machine just like the one on computers. The label read "labcoffee1 192.168.1.123" but the machine had no network connection, just a joke... :)
XML is like violence. If it doesn't solve the problem, use more. Junta
This is probably going to be simply ignored, as it is just one of my pet peeves; but as it is one of my pet peeves, I will proceed none the less. Consequently, this is my Message To The World:
What's the bloody sense in making a thing like this - let alone owning one? It is not exactly demanding, making you own coffee: put ground coffee beans in your favourite cafetiere/filter/mysterious glass thing with a spirit burner, add water, possibly hot. Wait for the magic to unfold right before your very eyes. Pour and drink. If you want to go all out, you grind your own coffee beans.
Recently I've seen more and more of these pointless gadgets where you insert a little foil capsule into a complicated piece of equipment and out comes a mediocre cup of coffee that has cost probably 10 times as much as a good cup of hand-made coffee; and you will have left a huge, reeking carbon footprint in the process. Plus, after a while you will have convinced yourself that you could never go back to doing it the old way - in other words, you have become dependent on a silly gadget, a little bit more helpless.
I suppose that is exactly where the industry wants us: unable to cook our own food, so we have to rely on ready made crap, unable to perform even the simplest of everyday tasks, because we rely on household machinery. Why do people fall for it? We honestly don't need most of these things unless we suffer from a physical disability; and they don't actually save us any meaningful time - by which I mean time we then spend on doing things that are worth doing rather than sit down to watch tv or play computer games.
Go on, hack it to add non-dairy creamer! Be mean!
I dunno, less ads dressed as news on slashdot perhaps?
Sure, but lacking caffeine you'll lack the energy to do anything about it. You'll be assimilated without resistance.
So unless a patch is found, you'll need to set up dedicated hosts ready to launch a devastating counter-strike on their coffee machines within the first microsecond of detecting incoming ICDMs (Internet Coffee Datagrams, Malevolent), and trust to an uneasy policy of Mutually Assured Decaffeination to keep the peace.
http://tools.ietf.org/html/rfc2324
The subject who is truly loyal to the Chief Magistrate will neither advise nor submit to arbitrary measures (Junius)
Not to disagree with you, but to note that a capsule *seems* more user friendly compared with the relatively messiness of doing coffee the cheaper, old fashioned, way.
People become dependent on these machines in the same way they lock themselves in to proprietary software solutions: the coffee capsules are not interchangeable, which allows companies to hike prices for them as they see fit.
Think bubblejet printers and the extortionate prices of ink. Any geek/nerd falling for the same trick when it comes to coffee should hand over his geek card immediately frankly.
IANAL but write like a drunk one.
I wonder how does Blue Screen Of Death look on that machine? Blue coffee??
...involve coffee and a hacking cough, so maybe it would suit me.
Reminds me of the toaster in Red Dwarf.
My coffee machine was designed in the 1950s, and makes brilliant coffee if you put enough love in.
I’m old enough to remember 16K of memory being described as “whopping”
All we need to do to defeat those hackers that have been attacking washington is to hack into their coffee makers and slowly reduce the caffeine content of their coffee. Before long they'll be asleep at their desks, completely unable to do any more harm.
Actually, it says in the FA "Break it by engineering settings that are not compatible (and making it require a service)", so I think it would just be a DoC unless that first 'D' in the summary means something else...
Can I suggest a Talkie Toaster with Artificial Intelligence it can program the coffee maker just what you need it to be. It knows. It always knows and will go on endlessly about it.
http://youtube.com/watch?v=RZslRQvv5zM
Sorry about the writing. Robot fingers, you know? Cliff Steele in DOOM PATROL #23
Do you folks like coffee? Real coffee? From the hills of Columbia? The Ducan Hills will wake you! From a thousand deaths! DUCAN HILLS COFFEE!!
... and not, oh, an integrated diabetes management system, pill dispenser, etc... Don't you mean an integrated drug management system or, rather, a caffeine dispenser...Improper operation of this can have significant impact on your day's performance.
The should have just run NetBSD on it, like on the toaster
Could someone hack into *our* coffee machine and make the coffee taste better?
I feel so enlightened now. Thanks.
RIAA sues coffee machine.
1: Hack your competitiors coffee machine.
2: Set it to only serve decaff.
3: Sit back and watch their productivity go through the floor.
Is this technically a Java exploit ?
*sorry*
When we remember we are all mad, the mysteries disappear and life stands explained.
Geeks have an income; I'm sure that a fair few of us can afford decent coffee, and have the temprement to learn to work the machine!
Wikileaks, no DNS
The Internet is bad and I never use the internet or the "world wide web."
Can there be a coffee make bot army out there?
If there is anyone else really in here, please close up and go home, reality is closed until further notice.
just another entry in a long list of devices that, while harmless otherwise, now have the ability to injure you once integrated with Microsoft Windows.
Good people go to bed earlier.
it already has a critical review about the hack
1 of 3 people found the following review helpful:
This can be hacked by outside attackers People can compromise your coffee maker and take over your computer as a result. Coffee isn't worth that risk. Published 4 hours ago by M. Garza
You have no chance to survive brew your beans.
Ha ha ha.
but i do wonder how they get so much coding done...
The Storm worm now attacks this pot as well; it secretly replaces the coffee with Folger's Crystals.
Are we geeks so lazy that we can't get up to hit a button on a coffee pot anymore? Instead, we use the internet for something that is two feet away. What's next, a toilet programmed to come to you when you need to let one go?
Come on! Mac users are the ones obsessed with connecting everything and anything to their computers. Wrong market here, folks. "My Mac runs my coffee maker, programs my DVR, turns on the lights before I get home and sends reminders to my phone to recharge it when the battery is low. Best of all, it does it all in that sexy 'Veronica' voice that's made me feel all tingly since 1984!"
I have an espresso machine with a Faema E61 brewing group (Poccino Opus One). Very nice machine indeed - what are a few hundred cups of espresso to get the "brandnewness" out of these machines? We're on slashdot, probably the world's biggest bermuda triangle for coffee :-)
I was browsing the Aerobie website, as I am a huge fan of their Astonishing Flying RingsTM, and I came across the aeropress. It looked interesting, but it also seemed like a lot of hype. I thought about grabbing one, but my wife is a little leery about my growing collection of coffee systems. One day she sent me an E-mail saying she had accidentally broken our french press trying to clean it; I had an aeropress by the end of the day.
It makes an excellent cup of coffee, even for an imprecise slob like myself. I doubt it makes as good a cup as the expensive machines, but for the first time ever I can taste the features of the coffee. It really has nutty undertones with a bold aftertaste. Who knew?
It opened new doors for me; expensive coffee finally seems worth the extra money. It's also easier to keep clean than a french press, drip coffee maker or percolator.
I know this reads like a commercial, but I really like the system.
Imagine a morning were get upp and some evil hacker has turn your first cup of joe into a weak version of tea! I'm finally convince that we must act now and force our government to impose draconian laws to stop the possibility of my coffee not following to the brim!!!
Si vis pacem, para bellum! For evil to succeed good men need only do nothing!
This article reminds me of the toaster on Red Dwarf.
Toaster: "Haw do you like your toast"
Lister: "I don't want toast, I don't want muffins. I don't want bagels (etc.)"
Toaster: "Ah I understand! You're a waffles man!."
This thing is a massive waste of money. I once bought a $700 "All-in-one" coffee maker (built in grinder, water, etc) but the coffee tasted horrible so I returned it and got a $50 Mr. Coffee maker.
Now I have a $170 tassimo where you put a pod in and click a button. It worked well, never breaks, and has never been hacked. This begs the question if your so lasy that you can't get up and make your own coffee than maybe you got some pretty bad underlying problems.
If getting up and walking to your break room and waiting a couple minutes for your coffee to brew than you really should just shoot yourself.
If your company spends that much money on a damn coffee maker than it deserves to get hacked.
I am just waiting for the coffee maker to break down and having to pull out the "auxilary" coffee maker. One of those stove top coffee makers.
Than again I'm cuban and we really value our coffee. I used to have one of those $500 commercial espresso makers. Coffee is an art, at least espresso is.
First they came for my donuts I didn't say anything but now they come for my Cup-a-Joe!!?
My cold dead hands! I tell you!! This means WAR!!!
ps. I should probably lay off the extra caffeine in the morning
I have an aeropress at work. They really are as good as they claim to be.
1) way faster than a french press
2) no need to boil the water. Just use an instant hot water tap on the water cooler. Because it brews so fast, and it's all plastic you don't need to have super hot starting water to end up with a very hot drink
3) No additional stuff to clean
4) it's self cleaning without a sink. press out the syringe and the coffee plug falls into the trash can and it's all clean,dry and ready to go back in your drawer.
5) I usually brew an americano (watery espresso) and I find the low acidity of the reduced temperature brewing means I no longer need cream in my coffee. This too is especially useful in the office environment since I don't need a refrigerator and a stock of fresh milk, or messy yucky white powders.
(by the way who was the genius who labeled sysco's coffee creamer "coffee whitener", as though turning it white was the real objecive. It's like something out of Repo man. Tack one of those in the middle of an 8-foot canvas and call it Andy Warhol pop art).
Some drink at the fountain of knowledge. Others just gargle.
This reminds me of Niven & Pournelle's Mote in God's Eye, where the moties did actually use a coffee maker as a means of infiltration...
Need Geek Rock? Try The Franchise!
Tsk. Tsk. Tsk. They should've used the RFC designed especially for this purpose instead.
There's nothing distributed about a single person hacking into it.
Anything that can be automatically done for you,
can be automatically done to you.
Can I get an ETA for how long until someone bricks one of these trying to wipe and install DD-WRT?
Just fill the pot with honey .
Mechanic: Somebody set up us the F90.
Operator: We get signal.
Captain: What!
Operator: Main screen turn on.
Captain: It's you!!
C8H10N4O2: How are you gentlemen!!
C8H10N4O2: All your coffee are belong to us.
C8H10N4O2: You are on the way to withdrawal.
Captain: What you say!!
C8H10N4O2: You have no chance to keep awake make your time.
C8H10N4O2: Ha Ha Ha Ha...
Operator: Captain!!
Giving that aunt who mailed you the fruitcake one of these things would be the gift that kept on giving....
Ceci n'est pas une signature.
Symantec Web technology??
Eww no, I don't want my coffee brewing at half speed and then notifying me every time it brews a new cup with "Hey look at me, I did my job, I updated my filter, aren't I a good boy."
Perhaps ESET makes a coffee pot?
Once a long time ago a man wrote a comic concerning toast, below is my best paraphrase of that comic:
Geek: I DID IT I DID IT!
Pragmatist: Did What?
G: I had my computer make toast!
P: You mean like a toaster?Really? Wow! That is awesome.
G: Here try it!
P: Eww! It tastes like burnt silicon and ash!
G: So what!? The computer made toast! Everywhere computer will start making toast! Just needs some tuning.
P: So did it make it faster?
G: Nope.
P: Is it healthier?
G: Nope.
P: Then why have the computer make toast?
G: Because man! It's computer generated toast!
P: Why not just use a toaster?
G: Because computers are better!
P: Has it ever occured to you that a computer may not be the best tool for everything?
G: My next project I am going to have a computer make a smoothie!
P: Why not just use a blender?
G: Computers are awesome!!!!!
Seriously why does everything have to have a computer in it? Why does everything need to be electric, internet enabled, digitally controlled?
I am waiting for the CPU driven hammer or screwdriver next...
In the mean time I give you a new term to use: Joybread.
Joybread: (noun) A product of a needlessly complex device that could be made from a substantially simpler device.
Joybreading: (verb) To make something in an overly complicated fashion for no reason
Examples:
"I am joybreading toast in a nuclear reactor!"
"It's total joybread, what a waste of resources!"
"I am drinking joybreaded coffee!"
"Really how was it made? In a what?! Wouldn't a coffee pot work better?"
-=[ Who Is John Galt? ]=-
Um, it's a remote exploit. My first request
What is the cost of sending a donut express mail (wouldn't want it to get stale) to Nigeria?
Squirrel!
Have you seen my new Coffee Bot?
He could ask for his fairy godmother to turn him into an *actual* hacker, until the clock strikes 12 and the spell wears off... as opposed to merely being mislabelled as one.
Hasan
-- what more could a hacker ask for?"
Oh, I don't know....how about delivery of a caffe latte? No flavors, please.
Thanks!
WTF? Over?
who's laughing now????
oh, wait...
___ I don't respond to Anonymous Cowards, and I Never Mod them UP.
We have a fully automatic espresso machine at work(a Jura at the moment). It makes consistently good coffee. At home I have a good manual one. The choice for manual is hard to defend. In both instances the best beans are ground on the spot, and they're always fairly fresh. To most people I'd recommend an automatic unless they like to play with their food. Starbucks has other problems.
I, for one, welcome our IPv6-enabled, internet-exploitable appliances, and their leader, the Jura F90 Coffee Maker with Internet Connection Kit!
How much brew
could a brew bot brew
if a brew bot could bot brew?
The Kruger Dunning explains most post on
That depends on the bean and the roast--for some beans, french press is better, and for others, a vacuum pot is better.
:)
The vac pot is also cooler
It near-boils the water in the lower chamber, forcing it by the vapor pressure to the upper. Heat is then removed, and the coffee comes back down. This just about guarantees the 200F optimal water temperature rather than boiling.
slight flavor differences between the two methods; you'll need a real expert to explain more
hawk
For the English speaking crowd, I think just deleating teh word "Are" would help it make more sense.
--
Yeah, that's right, I said it.
OK, it's a fridge, but this comic is safe for work and quite funny, and addresses this exact issue.
http://www.ibiblio.org/Dave/Dr-Fun/df200306/df20030604.jpg
This is going to escalate Internet warfare. Up until now, when geeks got hacked, they generally retaliated in kind. No one really got hurt. No blood spatters or bodies in the streets. Now it's going to take on a whole new dimension: the physical. Now the hackers are messing with other people's drugs. Deprived of their caffeine fix, people are going to start looking up the attackers' IP numbers, correlate locations with Google maps, get visas and airline tickets and come after them in a real, physical way. Major, major escalation.
Every country will see this as a threat to their security. There is no military that doesn't run on coffee. If governments don't get this under control quickly, there's going to be real warfare.
Does it run Linux? (Seriously, because this wouldn't be happening if it did.)
I nearly choked when I read that. You're sick. Funny, but sick.
Would it be a Distributed Denial of Coffee (DDoC) or just a Denial of Coffee (DoC) attack? Is the vulnerability something that one would actually dedicate zombies to make it a distributed attack?!? That is on serious coffee machine that demands that kind of attention. Of course it could be in the office of a high powered corporate leader of industry or something.
they wouldn't be l33t geeks.
audiophiles and wine snobs waste money and effort on what other people consider tiny, unimportant or nonexistent differences. Trivial differences are common, improvements that are really just changes are common. Psychological bias is common.
But if you put the emphasis on placebo effects, then that will cover a lot of things that appear nonexistent to the novice but are obvious to more experienced people. I wouldn't play that card. I can easily distinguish between a collection of cdplayers I'm familiar with, and I've heard the difference between cables connecting hifi sets.
As with coffee there is the buildup of experience and refinement. The range of what is acceptable changes and what used to appear small improvements become large improvements. There is the question how much extra fuss and mess you want to put up with, and how much money and effort you want to invest.
but um...the Jura F90 doesn't run on Windows. It uses a legacy operating system to control the simple process of making coffee. The internet connectivity kit is not a permanent attachment. It is only used to update the machine periodically, so it is not going to be attached to the machine all of the time anyway.
FYI, most of the newer models of automatic coffee machines that we sell have data ports. The smaller Jura range have the propriority port. Some of the larger models also have an RS-232 port. Then we have other manufacturers whom are using USB 2.0.
We do have a unit rigged up in the workshop connected to our network. When we want a coffee we email the network resource and it triggers the hot beverage. For instance:
Enjoy your coffee but sorry to debunk the OP myth.
Thats why we dont drink coffee because its bad for your health, even without hackers.
I hang out with groups that prefer going to get a coffee, others that prefer a pint, and some that are argree-able to either. I live in a more urban area, but if I'm visiting people in the suburbs (where everyone has to drive to get anywhere), then drinking isn't always an option if we don't have a designated driver (or if everyone ends up bring their own car instead of pooling).
I have no interest in watching sports on TV (playing is fun though), so getting together for the Big Game(tm) with a couple of brewskies isn't my thing. If friends want to go to a bar and talk about Goedel and Wittgenstein then I'm there.
(Though personally I prefer tea over coffee as a general rule.)
I understand quite well that other people consider my hifi, my wine and my espresso a waste of money.