Keurig 2.0 Genuine K-Cup Spoofing Vulnerability

An anonymous reader writes A security researcher has released a humorous vulnerability description for the Keurig 2.0 coffee maker, which includes DRM designed to only brew Keurig brand coffe pods (K-Cups): "Keurig 2.0 Coffee Maker contains a vulnerability in which the authenticity of coffee pods, known as K-Cups, uses weak verification methods, which are subject to a spoofing attack through re-use of a previously verified K-Cup." The vulnerability description even includes mitigating controls, such as keeping the Keurig in a locked cabinet when not in use. Also at Hackaday.

Comments

Holy Fuck!

[d33tah]

Holy fuck! These pirated K-Cups are going to hurt the whole industry!

Re:Holy Fuck!

[ThePhilips]

And the poor customers gets duped into buying a counterfeit pods without even realizing it!

That must be stopped!

Think of the customers!!

Re:Holy Fuck!

[schlachter]

when the little needle in the Keurig device comes down and punctures the spoofed k-cup, it will surely execute an Java injection attack.

Re:Holy Fuck!

[ChrisMaple]

Most pirates are male. From among the females, I'd certainly like to see those with K cups.

Nesspresso!

[TechyImmigrant]

I demand additional ineffective security procedures for my Nespresso machine. I'm completely ineffectively unprotected.

Apparently it's very easy to get around

[Russ1642]

I know someone who keeps a genuine k-cup lid around and just sets it on top of the off-brand cup every time he uses his machine.

Re:Someone has

[TWX]

And here you are, posting on Slashdot...

K-Cups?

[Anonymous Coward]

I can only imagine how expensive that must be. The last pair of double-D's set me back a fortune before it was all said and done. Although, they were nice.

Workaround

[Ol Olsoc]

Easy to follow steps:

1. Go to your favorite sore that carries coffee makers

2. Purchase a drip, french press or percolator, or whatever type I missed as per your wishes.

3. Buy some coffee at the same store. This may come as a shock to many people, but there is a large variety of typs of coffees out there. Different grinds, or grind your own - it is amazing I tell you, must be something new. Keurig is not the only company out there. I'm partial to a brand roasted in Philly, that I purchase from of all places, a diner in Rio Grande, New Jersey. But I digress.

Brew your own fucking coffee the way we used to do it when men were men, and the sheep knew to be respectful. Enjoy it on the patio, yelling at kids to get off the lawn.

This could lead to death

[davidwr]

A malicious attacker could substitute toxic fake coffee or hot chocolate for the real thing.

A malicious attacker could also substitute a coffee or hot chocolate that is tainted with a chemical that creates slight etchings in the surface of the coffee cup or other cup used to hold the end product. For certain types of cups, the result will be a cup that will be more likely to harbor bacterial growth than one with a smooth surface. Assuming a successful attack, the risk of illness or fatality is low for a healthy adult but it might be significant for a person with a suppressed or compromised immune system.

Recommended mitigation:
Keep people who want to kill you away from your coffee maker.

Let's counter-balance that free Keurig ad a little

[ArcadeMan]

Tassimo
Nespresso

It's a Java vunerability

[schlachter]

in the Java run time environment

Re:Someone has

[ganjadude]

I was like getting hit in the face by a boxing glove made of mushrooms.

Sounds like they were some pretty good mushrooms. were you also at a pink floyd concert by chance?

Re:These stupid ass one shot coffee makers

[Jason Levine]

Would that be a Beowulf Keurig Cluster?