The three million toothbrush botnet story isn’t true.
Here’s the original source of the story: https://archive.is/2024.01.30-203406/https://www.luzernerzeitung.ch/wirtschaft/kriminalitaet-die-zahnbuersten-greifen-an-das-sind-die-aktuellen-cybergefahren-und-so-koennen-sie-sich-schuetzen-ld.2569480
It’s simply a made up example. It doesn’t exist. It starts talking about NoName Ddosia, too, which also isn’t toothbrushes.
Now NoName have picked up the fake toothbrush story as propaganda for their members.
Good job, Fortigate.
Kudos to @BleepingComputer for doing actual journalism.
Fortinet also declined to comment to me.
It's a completely made up story, which is now being circulated as Russian propaganda.
https://www.bleepingcomputer.com/news/security/the-unlikely-3-million-electric-toothbrush-ddos-attack/
The newspaper that had the first article about the Fortigate toothbrush botnet have updated the story and doubled down:
“The article originally said that the case "really happened like that."
This information came from the company Fortinet, which had described the case as real in the interview and proofread the article before publication. Fortinet is now correcting this statement and calling it a "hypothetical scenario". https://www.luzernerzeitung.ch/wirtschaft/kriminalitaet-die-zahnbuersten-greifen-an-das-sind-die-aktuellen-cybergefahren-und-so-koennen-sie-sich-schuetzen-ld.2569480
Security firm Malwarebytes has been one of the few companies or individuals that refused to swallow a bogus report about three million smart toothbrushes being used in a DDoS attack. A large number of so-called tech publications simply regurgitated the report which first appeared in the Swiss newspa...
I have been literally biting all my fingers *and* my tongue (for some reason) to stop myself from going into people's posts and replying
IT'S A FAKE STORY YOU MORON. IT'S CLICKBAIT AT BEST
So far I have been strong
@grimmware @GossiTheDog @BleepingComputer
You might think that Fortinet having had backdoors of their own (e.g. https://rhinosecuritylabs.com/enterprise-security/fortinet-backdoor-found-ssh-netscreen/), as well as critical RCE vulns, might affect the stock price too.
Possibly related: I've got a Fortigate 100D sitting here, unused in ages, if anyone wants to cover shipping etc.
@GossiTheDog OH NO! I thought it was so funny. Oh well.
"Sir, we've been hacked!"
"Who? The Russians? The Chinese? Aliens?"
"Three million toothbrushes."
@GossiTheDog oh man I fell for it. Thanks for the fact check.
Interesting though how easily lots of people got fooled on this one. One part of this is how gullible we all are (well, not you I guess), but the other part I think is that we came to *expect* this kind of stuff to happen in a world saturated with IoT devices.
@[email protected] But the article states: "Das Beispiel, das wie ein Hollywood-Szenario daherkommt, hat sich wirklich so zugetragen." which tanslates to "this hollywood-like scenario really happened." 🤔
Saw this first upon popping on this evening, followed by multiple posts about the "toothbrush botnet" - thanks for getting the word out.
I'm totally ok with it. I laughed so hard. Rotnet and DilDoS made my day.
but Fortinet said!!!
Some stories are too good to check. :D
That won't have the impact that's needed to lead to change...
Now, when a million online personal massage devices get turned into a botnet...
That will shake up the industry. 🤪
@neilcar @rogers @monsieuricon @GossiTheDog good points. A bit moot now since the whole story never actually happened.
They'd make a good persistence vector tho; no one's going to suspect them and you'd never run an antivirus on them. Reminds me of back in my Atari ST days, I w̶r̶o̶saw a virus that resided in the keyboard microcontroller. It would survive a reset and reinstall itself on the first keypress / kbd interrupt.
@hyc @rogers @monsieuricon @GossiTheDog In the hypothetical toothbrush case, I think it's much more likely that the well was poisoned -- I would posit an attack against the manufacturer's poorly-secured CI/CD pipeline, perhaps via by an unpatched Jenkins vulnerability, enabling an attacker to ship a firmware update with an embedded backdoor.
This should give us pause when we consider enabling autoupdate for our smart hygiene appliances.
Kevin Beaumont
Christian Kündig
Kilian Evang
ck 👨💻
Sam Varghese
wvu
tinydoctor
FinchHaven sfba
v̾i̾t̾r̾i̾o̾l̾i̾x̾
David Crooks 🏳️🌈
Clem H. Fandango
Nihl L'Amas
grimmware
Tim Lavoie
loucovey
Taggart 
Wouter Hindriks
Lesley Carhart 
Bill
Ben Aveling
Sharkberry
Michał "rysiek" Woźniak · 🇺🇦
Tobias Fiebig
jesterchen42
Play Ball and Fight Fascists
pirate moo 🐮
0ddj0bb
Expertenkommision Cyberunfall
Thom.
Adam Barnett
Billy Smith
nobody
K. Ryabitsev-Prime 🍁
Rogers
Howard Chu @ Symas
prozacchiwawa
Neil Carpenter 
Denys Dmytriyenko