Slashdot Mirror
All Your Coffee Are Belong To Us
Wolf nipple chips writes "Craig Wright discovered that the Jura F90 Coffee maker, with its honest-to-God Jura Internet Connection Kit, can be taken over by a remote attacker, who can cause the coffee to be weaker or stronger; change the amount of water per cup; or cause the machine to require service (call this one a DDoC). 'Best yet, the software allows a remote attacker to gain access to the Windows XP system it is running on at the level of the user.' An Internet-enabled, remote-controlled coffee-machine and XP backdoor — what more could a hacker ask for?"
Bah! Get your coffee and an old school French press to brew the tastiest coffee. Put your hacking efforts into the roasting, selection and cultivation of your beans and leave the time and resource wasting, lame Windows controlled coffee makers to the junk heap of history.
Visit Jonesblog and say hello.
I wonder how well it runs Java...
Sorry, that's the first thing that came to mind on the question of what more could a hacker want.
"Thanks for all the money you paid to us. We've used it to buy off ISO among other things" -Microsoft
I mean come on now... what good can an Internet connected coffee maker really do? No security conscious office will ever want a Windows enabled appliance around. Just imagine the scene:
Special Agent Wilkins: How the Hell did they get in?
Special Agent Thompson: Sir..... I... uh, think they got in through the coffee maker.
Special Agent Wilkins: The What?
Special Agent Thompson: Sir, the coffee maker that we got you for your birthday... the one that you wanted to be able to brew up a cup o joe from your office?
Special Agent Wilkins: Oh fsck me....
Visit Jonesblog and say hello.
How about the coffee?
Screw the company web server. Screw the sql database server. They've hacked the coffee machine! AHHHHHHHHH!!!!!!
-- Will program for bandwidth
Yeahhhhhh, i'm gonna have to go ahead & ... disagree with you there, yeahhh. I'm not sure hacking Lumberg's coffee maker is going to have any affect on him, yeahhh, you see, Lumberg doesn't sleep as he is up all night continually drinking from his perpetually-full mug, even as he bangs your girlfriend.
:-P
btw, I'm gonna have to ask you to go ahead and come in on Sunday, too...
So, does this device conform to the HTCPCP (Hyper Text Coffee Pot Control Protocol) [http://www.faqs.org/rfcs/rfc2324.html] ?
As far as I can tell, the coffeemaker *doesn't* run Windows-- the exploit is in the "connection kit", which is software that runs on a PC, which plugs into the coffeemaker, which lets coffee-people fix your coffeemaker from afar.
So this wouldn't have much in the way of applicability unless you knew someone with this particular $2000 coffeemaker, which was already experiencing problems, who had purchased the $100+ coffeemaker diagnostic kit and had the coffeemaker plugged in, through the diagnostic kit, to their PC at the time.
Seems like there are better ways to get into Windows.
I can. I can stop caffeine any time I want to.
... and not, oh, an integrated diabetes management system, pill dispenser, etc...
Help poke pirates in the eyepatch, arr.
... not everything needs an internet connection
If you mod me down, I will become more powerful than you can imagine....
If you let the whole world control your heating elements, bad things happen. When was the last time you saw an Itanium box with a public IP?
There's no failure quite as dissatisfying as a complete and total solution to the wrong problem.
Once the coffee maker is compromised and turned into a rogue email server, breakfast choices will be coffee and spam, coffee egg and spam; coffee egg bacon and spam; coffee egg bacon sausage and spam; coffee spam bacon sausage and spam; coffee spam egg spam spam bacon and spam; coffee spam sausage spam spam bacon spam tomato and spam....
Vikings: Spam spam spam spam...
Loose lips lose spit.
Don't people ever learn. If you don't install a firewall, anti-virus protection, and anti-spyware software on your coffee maker, you deserve to be hacked. My coffee maker runs Linux and has never been hacked.
Have the RIAA sent it a DMCA takedown notice for sharing files yet?
PC LOAD COFFEE
Whatever you do, don't ask it for a cup of tea while it's connected to the Internet. "Share and enjoy."
I, for one, welcome our new coffee brewing overlords.
It makes tea then convinces you that you only ever wanted a tea.
Did you hear the one about the Apple coffee maker?
It does an amazing Mocha Frappucino with whipped cream, caramel sauce and a chocolate flake in the top but doesn't know how to make a plain black coffee.
Did you hear the one about the Linux coffee maker?
v0.1 made a good plain coffee but it took a while doing it, v1.0 makes good plain coffee but there's a patch that allows it to make better tea than the Microsoft coffee maker and v2.0 gives you a cup of plain coffee, a cup of whipped cream, a cup of caramel sauce, a chocolate flake in a wrapper and tells you to make the coffee how you want but for a much lower price than the Apple one.
Did you hear the one about the Vista coffee maker?
Nope, neither did I but then who gives a shit.
Gentoo Linux - another day, another USE flag.
An Internet-enabled, remote-controlled coffee-machine and XP backdoor -- what more could a hacker ask for?
Access to the coffee his new bot brews?
You know the first step in getting help is admitting that you have a problem.
This is probably going to be simply ignored, as it is just one of my pet peeves; but as it is one of my pet peeves, I will proceed none the less. Consequently, this is my Message To The World:
What's the bloody sense in making a thing like this - let alone owning one? It is not exactly demanding, making you own coffee: put ground coffee beans in your favourite cafetiere/filter/mysterious glass thing with a spirit burner, add water, possibly hot. Wait for the magic to unfold right before your very eyes. Pour and drink. If you want to go all out, you grind your own coffee beans.
Recently I've seen more and more of these pointless gadgets where you insert a little foil capsule into a complicated piece of equipment and out comes a mediocre cup of coffee that has cost probably 10 times as much as a good cup of hand-made coffee; and you will have left a huge, reeking carbon footprint in the process. Plus, after a while you will have convinced yourself that you could never go back to doing it the old way - in other words, you have become dependent on a silly gadget, a little bit more helpless.
I suppose that is exactly where the industry wants us: unable to cook our own food, so we have to rely on ready made crap, unable to perform even the simplest of everyday tasks, because we rely on household machinery. Why do people fall for it? We honestly don't need most of these things unless we suffer from a physical disability; and they don't actually save us any meaningful time - by which I mean time we then spend on doing things that are worth doing rather than sit down to watch tv or play computer games.
http://tools.ietf.org/html/rfc2324
The subject who is truly loyal to the Chief Magistrate will neither advise nor submit to arbitrary measures (Junius)
...involve coffee and a hacking cough, so maybe it would suit me.
Reminds me of the toaster in Red Dwarf.
My coffee machine was designed in the 1950s, and makes brilliant coffee if you put enough love in.
I’m old enough to remember 16K of memory being described as “whopping”
But if I don't have a problem, then I don't need help, so why should I admit anything?
1: Hack your competitiors coffee machine.
2: Set it to only serve decaff.
3: Sit back and watch their productivity go through the floor.
Is this technically a Java exploit ?
*sorry*
When we remember we are all mad, the mysteries disappear and life stands explained.
just another entry in a long list of devices that, while harmless otherwise, now have the ability to injure you once integrated with Microsoft Windows.
Good people go to bed earlier.
The solution I proposed there was that a coffee pot does not get a full Internet connection. Instead of the default being full access we switch to default deny. It only gets to connect to the local net at all after authentication. And it only gets access that is appropriate to its function and consistent with site policy. Obviously the typical consumer is not going to be writing security policies so this process is going to have to be automated which is where a small amount of Semantic Web technology comes in.
Looking for an Information Security student project suggestion?
Try http://dotcrimeManifesto.com/
PC LOAD COFFEE? WTF does that mean?
Here's some extra text to get past the caps filter.
Anthropic principle: We see the universe the way it is because if it were different we would not be here to see it.
A simpler solution is, when putting your coffee maker on the Internet, to make sure JavaScript is turned off.
:)
Yes, I made a horrible pun.