mailing list archives
CSW Security Advisory 0002: Oral B SmartMonitor Information Disclosure Vulnerability and DoS
From: craigswright () acm org
Date: 19 Jun 2008 06:03:58 -0000
Craig Wright Security Advisory 0002
Jun 19, 2008
The Oral B Triumph Toothbrush with SmartGuide
ProfessionalCare 9900 is designed to enhance your brushing experience with while-you-brush feedback. SmartGuide is
designed to ensure that you always have the best brushing experience.
Remote exploitation of an information disclosure vulnerability in Oral Bs SmartGuide management system allows
attackers to obtain sensitive information.
This vulnerability exists due to a lack of authentication between the toothbrush and the monitoring device. The simple
association key is easily compromised allowing the toothbrush and monitoring device to be spoofed using by a malicious
There is also a possible wireless denial of service where a malicious attacker could stop the radio feedback and
The trashbin feature of the SmartMonitor device does not overwrite deleted data.
Exploitation allows an attacker to gain sensitive information from the toothbrush. No authentication is required to
reach the affected application. The attacker only needs to be able to monitor the wireless transmission.
The attacker can determine the users brushing habits. It is possible to report on the location of the mouth that is
being brushed and the amount of time spent on each of four defined quantrants.
An attacker could also conduct a serious DoS attack. Flooding the wireless communications causes the unit to stop
responding. This can result in the following actions:
A. A continued DoS could cause the bristle monitor to not send an end of life signal to the SmartMonitor system
leaving the user to continue using an old toothbrush head which could eventually lead to dental failure. The failure to
monitor the most effective head life could result in bristle failure.
B. Dental statistics could be erased from the monitor unit. This would leave the user unable to determine and
report on their brushing habits. This could lead to user confusion and over or under brushing leading to tooth wear.
C. Fake battery life transmissions can be sent making the user believe that the battery life is in fact longer
than is truly stored. This could lead to a catastrophic brushing failure where the toothbrush runs out of power in
mid-clean. A continued long term attack could lead to the creation of cavities in the users teeth.
A forensic analysis of the SmartMonitor unit can be conducted to recover deleted brushing sessions. A user who was
attempting to cover a period of lapsed dental care could be investigated and the deleted data recovered. In some cases
it is feasible that this could result in a reduction of user privileges and possible punitive action (especially where
the analysis is conducted by the parent administrative body).
The DoS attack is readily detectable as the toothbrush fails to communicate to the monitoring unit.
Monitoring and interception remains undetectable with no known means to monitor this insidious threat to user brushing
The vendor has a deactivation process that will allow the toothbrush to operate manually with the radio disabled.
VI. VENDOR RESPONSE
I was unable to get an adequate result from the vendor and the receptionist did not forward the calls after the first
few. A direct call to the sales channel resulted in the comment, who the hell would want to monitor a toothbrush.
VII. CVE INFORMATION
The Common Vulnerabilities and Exposures (CVE) project has not assigned a name to this issue as yet.
VIII. DISCLOSURE TIMELINE
19/06/2008 Initial vendor notification
19/06/2008 Initial vendor response
19/06/2008 Coordinated public disclosure
Permission is granted for the redistribution of this alert electronically
Disclaimer: The information in the advisory is believed to be accurate at the time of publishing based on currently
available information. Use of the information constitutes acceptance for use in an AS IS condition.
There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for
any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information.
- CSW Security Advisory 0002: Oral B SmartMonitor Information Disclosure Vulnerability and DoS craigswright (Jun 19)