Yesterday, friend-of-the-site Oliver Y. linked me to a ridiculous story of a toothbrush-based botnet. Imagine getting hacked by an army of toothbrushes! Just the thought of it is enough to make me want to fill my pockets with lead and walk into the ocean.
And yet funny though it was, the whole thing rang false to me. I’m fairly certain this story is at the very least misunderstood, and more likely, flat out false. I’ve seen Bluetooth toothbrushes, but never one with the actual wifi access that would be needed to take part in a distributed denial-of-service attack. And even giving your smart toothbrush Bluetooth access seems like a waste of time and energy. I own a toothbrush that could talk to my phone, but I sure as hell don’t actually let it do so. I don’t need an electronic coach for any of my brushing, thanks all the same. I’m skeptical that millions of people have configured this nonsense feature.
ZDNet published their own version of the story with the headline “3 million smart toothbrushes were just used in a DDoS attack. Really”, but it’s a good bet that it’s actually “not really”. There are scant few details in either of these posts, but further digging led me to a German-language source, which translated thusly:
She’s in the bathroom at home, but she’s part of a large-scale cyber attack. The electric toothbrush is programmed with Java, and criminals have unnoticed installed malware on it – like on 3 million other toothbrushes. One command is enough and the remote-controlled toothbrushes simultaneously access the website of a Swiss company. The site collapses and is paralyzed for four hours. Millions of dollars in damage is caused.
This example, which seems like a Hollywood scenario, actually happened. It shows how versatile digital attacks have become.
While that does seem to be saying this did actually happen, it provides no further details, and nothing else I’ve found online verifies this claim. Further, I’m still stuck on the unlikelihood of an army of rogue toothbrushes. I just don’t buy it.
Ultimately, I suspect this post has it right:
This news article claims this happened, but my guess is that what actually happened is this:
Journalists talks with guy from fortinet, fortinet guy explains how a bot net of 3 million devices took down a Swiss companies site, Journalists asks what devices, fortinet guy talks about different things (like smart home devices / iot) and mentions that even a smart toothbrush could be part of such a bot net.
And the rest is history.
My belief that this story is probably false led me to consider scrapping this whole post, but a wary semi-debunking seemed like it might be useful. Also, quite frankly, I’m too pleased with that headline to give up on it.
Update (February 10, 2024): Sure enough, there were issues here. From Wired:
Fortinet belatedly sought to correct the record, writing in public statements that “it appears that due to translations the narrative on this topic has been stretched to the point where hypothetical and actual scenarios are blurred.” But the Aargauer Zeitung pointed the finger back at Fortinet, noting in a follow-up story that Fortinet provided exact details of the dental doomsday it described as real, and that the company even reviewed the text of the article prior to publication.