<<< Date Index >>>     <<< Thread Index >>>

CSW Security Advisory 0002: Oral B SmartMonitor Information Disclosure Vulnerability and DoS



Craig Wright Security Advisory 0002
http://gse-compliance.blogspot.com 
Jun 19, 2008

I. BACKGROUND

The Oral B Triumph Toothbrush with SmartGuide?
ProfessionalCare? 9900 is designed to enhance your brushing experience with 
?while-you-brush? feedback. SmartGuide is designed to ensure that you always 
have the best brushing experience. 

http://www.oralb.com/us/products/power/triumphsmartguide/ 

II. DESCRIPTION

Remote exploitation of an information disclosure vulnerability in Oral B?s 
SmartGuide management system allows attackers to obtain sensitive information.

This vulnerability exists due to a lack of authentication between the 
toothbrush and the monitoring device. The simple association key is easily 
compromised allowing the toothbrush and monitoring device to be spoofed using 
by a malicious attacker.

There is also a possible wireless denial of service where a malicious attacker 
could stop the radio feedback and monitoring.

The trashbin feature of the SmartMonitor device does not overwrite deleted data.

III. ANALYSIS

Exploitation allows an attacker to gain sensitive information from the 
toothbrush. No authentication is required to reach the affected application. 
The attacker only needs to be able to monitor the wireless transmission.

The attacker can determine the users brushing habits. It is possible to report 
on the location of the mouth that is being brushed and the amount of time spent 
on each of four defined ?quantrants?. 

An attacker could also conduct a serious DoS attack. Flooding the wireless 
communications causes the unit to stop responding. This can result in the 
following actions:
A.      A continued DoS could cause the bristle monitor to not send an end of 
life signal to the SmartMonitor system leaving the user to continue using an 
old toothbrush head which could eventually lead to dental failure. The failure 
to monitor the most effective head life could result in bristle failure.
B.      Dental statistics could be erased from the monitor unit. This would 
leave the user unable to determine and report on their brushing habits. This 
could lead to user confusion and over or under brushing leading to tooth wear.
C.      Fake battery life transmissions can be sent making the user believe 
that the battery life is in fact longer than is truly stored. This could lead 
to a catastrophic brushing failure where the toothbrush runs out of power in 
mid-clean. A continued long term attack could lead to the creation of cavities 
in the user?s teeth.  

A forensic analysis of the SmartMonitor unit can be conducted to recover 
deleted brushing sessions. A user who was attempting to cover a period of 
lapsed dental care could be investigated and the deleted data recovered. In 
some cases it is feasible that this could result in a reduction of user 
privileges and possible punitive action (especially where the analysis is 
conducted by the parent administrative body).

IV. DETECTION

The DoS attack is readily detectable as the toothbrush fails to communicate to 
the monitoring unit.

Monitoring and interception remains undetectable with no known means to monitor 
this insidious threat to user brushing privacy.

V. WORKAROUND

The vendor has a deactivation process that will allow the toothbrush to operate 
manually with the radio disabled.

VI. VENDOR RESPONSE

I was unable to get an adequate result from the vendor and the receptionist did 
not forward the calls after the first few. A direct call to the sales channel 
resulted in the comment, ?who the hell would want to monitor a toothbrush?.

VII. CVE INFORMATION

The Common Vulnerabilities and Exposures (CVE) project has not assigned a name 
to this issue as yet. 

VIII. DISCLOSURE TIMELINE

19/06/2008  Initial vendor notification
19/06/2008  Initial vendor response
19/06/2008  Coordinated public disclosure

IX. CREDIT

Permission is granted for the redistribution of this alert electronically

Disclaimer: The information in the advisory is believed to be accurate at the 
time of publishing based on currently available information. Use of the 
information constitutes acceptance for use in an AS IS condition.

There are no warranties with regard to this information. Neither the author nor 
the publisher accepts any liability for any direct, indirect, or consequential 
loss or damage arising from use of, or reliance on, this information.