iQ MB - Show and Tell

inding 1: Hard-Coded Bluetooth PIN *****Credit: Daniel Crowley of Trustwave SpiderLabs CVE: CVE-2013-4866 CWE: CWE-259 The "My Satis" Android application has a hard-coded Bluetooth PIN of "0000" as can be seen in the following line of decompiled code from the application: BluetoothDevice localBluetoothDevice = BluetoothManager.getInstance().execPairing(paramString, "0000") As such, any person using the "My Satis" application can control any Satis toilet. An attacker could simply download the "My Satis" application and use it to cause the toilet to repeatedly flush, raising the water usage and therefore utility cost to its owner. Attackers could cause the unit to unexpectedly open/close the lid, activate bidet or air-dry functions, causing discomfort or distress to user.

Anybody remember this? :-)

http://www.youtube.com/watch?v=t-09F87C6Ps YES!!! I was trying to describe this one morning and everyone was looking at me like I was a crazy old man, this blew my miiiind as a little kid at IMAX....

"esigned properly and could result in safety issues." With that in mind, the House that Jobs Built is instituting the USB Power Adapter Takeback Program, which will let folks pick up first-party iPad, iPhone and iPod plugs for $10 (instead of the usual $19) if they return any of their current adapters. Don't plan to stock up on the power-giving cubes though, as the deal is limited to one adapter for each device you own."

Huh. The family insists that the accident happened with a genuine Apple charger. Funny how people are going all crazy about third-party devices. As far as I'm concerned, the whole thing is stupid anyway. Her phone was *plugged into the wall*, and this in a part of the world where the electrical supply is at 220 VAC, and she grabbed it while *getting out of the bath*. Does nobody see how this could go south? :-P