Stop me if this is too much information, but I’ve never sat on a toilet wishing it had Bluetooth. Perhaps I’ve been missing out — it seems a Japanese manufacturer called Lixil has a wirelessly-enabled toilet called the Satis, which comes with its own smartphone app.
This app is partly for recording the details of one’s stools (a new twist on the “quantified self” concept), but it can also be used to flush the toilet, operate the bidet and release deodorizer. Unfortunately, it turns out anyone with the My Satis app can use it to control any Satis toilet.
The flaw was found by security researchers at Trustwave SpiderLabs, who repeatedly and fruitlessly tried to contact Lixil about it before giving up and just going public late last week. According to Trustwave:
“Any person using the ‘My Satis’ application can control any Satis toilet. An attacker could simply download the ‘My Satis’ application and use it to cause the toilet to repeatedly flush, raising the water usage and therefore utility cost to its owner.
“Attackers could cause the unit to unexpectedly open/close the lid, activate bidet or air-dry functions, causing discomfort or distress to user.”
I’d be lying if I said this imagery wasn’t funny – a situation that isn’t helped by the foolishness of the flaw. It’s very simple: Lixil has hardcoded the app’s Bluetooth PIN to “0000”, and the user can’t change this.
Of course, it’s not like someone will be exploiting this vulnerability to prank someone a continent away — Bluetooth is a pretty short-range wireless technology. However, it’s the kind of thing that should be borne in mind by manufacturers who are starting to jazz up previously low-tech appliances with new-fangled connectivity.
Because when it comes to security, as Trustwave SpiderLabs and others have warned, the home is the last place you want to be caught with your pants down.