Kevin Beaumont
Kudos to @BleepingComputer for doing actual journalism.
Fortinet also declined to comment to me.
It's a completely made up story, which is now being circulated as Russian propaganda.
https://www.bleepingcomputer.com/news/security/the-unlikely-3-million-electric-toothbrush-ddos-attack/
PhreakByte
@Jer @GossiTheDog yeah, well, there is this (re WiFi) https://www.amazon.com/Oral-B-Replenishment-Electric-Toothbrush-Brushing/dp/B0831JZBL4
Jer
"completely made up" makes me wonder if this is some AI journalism that escaped into the wild without fact checking. But Stefan Züger does seem to be a real person so maybe not?
(Thanks for being on top of this - honestly when I saw the story I wondered what toothbrush company was putting wifi into their toothbrushes instead of bluetooth. And why would they do that? Should have realized it was nonsense.)
Kevin Beaumont
Fortigate have issued me a statement. The toothbrush story is completely made up.
Kevin Beaumont
I’d like to thank all the Mastodon reply guys in the thread who decided the story was real, btw, based on vibes.
tinydoctor
@GossiTheDog You’re welcome.
Kensan
@GossiTheDog “due to translations”? The original reporting in German makes that claim already. ¯\_(ツ)_/¯ https://mastodon.social/@Kensan/111888828676462440
Kensan
@GossiTheDog The article(s) have been maming the rounds through Swiss media the past week where everyone copied everbody else. It looked like it was good engagement until its reach got too wide. ¯\_(ツ)_/¯
Kevin Beaumont
Probably the best reply on one of the stories so far.
Kevin Beaumont
It’s now made it to YouTubers 🤣 who are doing better journalism and threat intel than.. journalists and threat intel. https://youtu.be/sVpe0ZEZ1Ho
Edgar Whelp
@GossiTheDog can you comment on the “$25M transferred because of deepfake” story from earlier this week? Because that just screams out as being bullshit.
Kevin Beaumont
The newspaper that had the first article have updated the story and doubled down:
“The article originally said that the case "really happened like that."
This information came from the company Fortinet, which had described the case as real in the interview and proofread the article before publication. Fortinet is now correcting this statement and calling it a "hypothetical scenario". https://www.luzernerzeitung.ch/wirtschaft/kriminalitaet-die-zahnbuersten-greifen-an-das-sind-die-aktuellen-cybergefahren-und-so-koennen-sie-sich-schuetzen-ld.2569480
Kevin Beaumont
It gets worse - the original publication has published more details about what happened, unpaywalled. https://www.luzernerzeitung.ch/wirtschaft/cyberangriff-die-gehackten-zahnbuersten-gehen-medial-um-die-welt-und-loesen-fragen-aus-wie-es-dazu-kam-ld.2577182
Kevin Beaumont
During the whole toothbrush botnet thing, people said ‘yes, the story is fake but it COULD happen’.
Almost every smart toothbrush uses Bluetooth so no, it could not.
Somebody pointed me towards one on Amazon which says it uses wi-fi, so I ordered it and investigated.
The toothbrush only has Bluetooth. The charger uses wi-fi - but has no open TCP or UDP ports. Traffic is outbound only, TLS 1.3.
So no, it was just total nonsense.
Ivo Damjanović
@GossiTheDog Wait a minute…
The charger uses Wi-Fi?
Why? Do you need a subscription to be able to charge the damn thing?
Joe Uchill
@GossiTheDog this whole thing started with a reporter misunderstanding that toothbrushes was an ad absurdum example of anything internet connected. It’s sort of like being forced to test if, by giving Grandma wheels, she would become a cart.
Even if there were WiFi toothbrushes, would there be so many of them using connectivity to create a massive botnet? Probably not.
GNU social JP is a social network, courtesy of GNU social JP管理人. It runs on GNU social, version 2.0.2-dev, available under the GNU Affero General Public License.
All GNU social JP content and data are available under the Creative Commons Attribution 3.0 license.