Security researcher hacks coffee maker to show IoT devices’ vulnerabilities
Avast researcher turned a harmless coffee maker into a nefarious ransom-demanding machine
Avast security researcher Martin Hron released a video of him brewing a new kind of trouble in a Smarter coffee maker: A ransom message.
“When turned on for the first time, the coffee maker works in a local mode and it creates its own Wi-Fi network that the hopeful coffee drinker first connects to in order to set up the device,” explains Hron in a blog post. The problem is, there’s hardly any encryption, authorization or authentication. Anyone who can access the network can control the coffee maker by simply changing the device’s IP address.
When Hron learned of this vulnerability, he decided to experiment. He hijacked the Smarter coffee maker via Wi-Fi, changed the machine’s firmware and turned it into a ransom machine.
“We created ransomware that when triggered renders the coffee maker unusable and asks for ransom, while at the same time turning on the hotbed, water dispensing heating element, permanently and spinning up the grinder, forever, displaying the ransom message and beeping,” Hron wrote.
The experiment shines a new spotlight on public Wi-Fi networks, which may make some question the credibility of IoT devices.
Keep in mind that Smarter no longer supports the coffee maker in the experiment. In a bid to move to a safer and more secure platform, the company upgraded its devices’ security in 2017. Newer versions of the Smarter iKettle don’t share this vulnerability.
Sign up today and you will receive a free copy of our Future Focus 2025 report - the leading guidance on AI, cybersecurity and other IT challenges as per 700+ senior executives
-
Researchers claim Salt Typhoon masterminds learned their trade at Cisco Network AcademyNews The Salt Typhoon hacker group has targeted telecoms operators and US National Guard networks in recent years
-
HPE says unified channel strategy won't force Juniper partners to generalizeNews Does the company embrace specialists or want a full portfolio push? The answer, it seems, is both
-
15-year-old revealed as key player in Scattered LAPSUS$ HuntersNews 'Rey' says he's trying to leave Scattered LAPSUS$ Hunters and is prepared to cooperate with law enforcement
-
The Scattered Lapsus$ Hunters group is targeting Zendesk customers – here’s what you need to knowNews The group appears to be infecting support and help-desk personnel with remote access trojans and other forms of malware
-
Impact of Asahi cyber attack laid bare as company confirms 1.5 million customers exposedNews No ransom has been paid, said president and group CEO Atsushi Katsuki, and the company is restoring its systems
-
The US, UK, and Australia just imposed sanctions on a Russian cyber crime group – 'we are exposing their dark networks and going after those responsible'News Media Land offers 'bulletproof' hosting services used for ransomware and DDoS attacks around the world
-
A notorious ransomware group is spreading fake Microsoft Teams ads to snare victimsNews The Rhysida ransomware group is leveraging Trusted Signing from Microsoft to lend plausibility to its activities
-
Volkswagen confirms security ‘incident’ amid ransomware breach claimsNews Volkswagen has confirmed a security "incident" has occurred, but insists no IT systems have been compromised.
-
The number of ransomware groups rockets as new, smaller players emergeNews The good news is that the number of victims remains steady
-
Teens arrested over nursery chain Kido hacknews The ransom attack caused widespread shock when the hackers published children's personal data