Miele's networked disinfecting hospital dishwasher has a gaping security flaw

Cory Doctorow 4:02 pm Mon Mar 27, 2017

The Miele PG 8528 is a "washer-disinfector" intended for hospitals and other locations with potentially dangerous pathogens on their dirty dishes; it's networked and smart. And dumb.

The PG 8528 is vulnerable to a web server directory traversal attack; connect to it with a browser and you can break out of its web server and attack its whole filesystem, implanting malware that you can use to attack other devices on the network (like this widely used automated drug cabinet with 1600+ known vulnerabilities and no new patches coming).

The PG 8528 isn't supposed to be connected to the public internet, but at least one has been spotted in the wild, because being good at running a hospital doesn't make you good at information security.

Miele was notified of the bug, but, after a cursory followup, dropped it and pretended it didn't matter.

But at some point, at least one of these dishwashers was connected and findable on the internet, according to Dan Tentler, a security researcher who's one of the best at finding internet of things that shouldn't be online.

"This is fucking hilarious. A dishwasher on the internet," Tentler told Motherboard in an online chat, explaining that it's possible he might be able to find more in the future, now that he knows how to look for them.

A Hackable Dishwasher Is Connecting Hospitals to the Internet of Shit
[Lorenzo Franceschi-Bicchierai/Motherboard]

Finally revealed: identity of hacker blamed for stealing from 300+ companies and governments, in 44 countries

Unsealed court documents reveal the identity of Fxmsp, a hacker from Kazakhstan who is blamed for information theft from more than 300 companies and governments, in 44 different countries around… READ THE REST
IRS says it bought in to location database for millions of US cellphones to track tax crime suspects

The United States Internal Revenue Service says it purchased access to a marketing database that offers location data for millions of US cellphones, so the IRS can identify and track… READ THE REST
Google removes 106 malicious Chrome extensions with 32M downloads that collect browsing history and sensitive credentials

Following the discovery and prompting of a security researcher at Awake Security, Google says it has removed 106 malicious Chrome extensions that had 32 million downloads, and which were gathering… READ THE REST
Short Post, just one paragraph

Dessert cheesecake wafer bear claw fruitcake. Fruitcake chupa chups donut candy canes marzipan. Apple pie sweet roll tart chocolate cake macaroon marshmallow carrot cake gummi bears sweet. Pastry sugar plum… READ THE REST
Save 50% on a 1-year subscription to Dashlane's premium password manager

We all know vital information about ourselves and our private digital accounts can be compromised by cybercriminals. However, many would be frightened to know just how compromised they and their… READ THE REST
The Bite Helper removes the itch of a mosquito bite in seconds

While mosquitoes have certainly earned their title as the deadliest animal on earth, their impact on most of our lives is usually a lot less consequential. But even though they… READ THE REST