
Security disclosure about a Bluetooth toilet - tosbourn
https://www.trustwave.com/spiderlabs/advisories/TWSL2013-020.txt
======
unimpressive
According to this[0] the flush volume of this toilet is 5 liters. If it takes
two minutes to flush and refill then the amount of water you could waste in an
hour is:

30 * 5 = 150L

If a family is away on vacation, you could theoretically flush for days.

24 * 150 = 3600L per day

In Seattle the water costs about 4.5 cents per cubic foot.[1] (If it costs
4.50 _dollars_ for one CCF (which is 100 cubic feet) then I move the decimal
place over two times.)

According to this[2] "1 Liter = 0.0353146667 Cubic Foot"

If that's the case then at 3600L per day you can flush 127.1328001 Cubic Feet
of water.

127.1328001 * 4.5 = 572.0976005 cents

Round down to 572, divide by one hundred:

You can grief somebody for $5.72 a day in Seattle with this exploit. If you
were to constantly flush all year it would cost you:

$5.72 * 365 = $2087.8

One way you could exploit this is if you obsessively watched out for the
neighbors to see when they came and went and flushed when they aren't home.

[0]: [http://www.inax-
usa.com/download/catalog/pdf/0008-2.pdf](http://www.inax-
usa.com/download/catalog/pdf/0008-2.pdf) (Page 18, flushing volume)

[1]:
[http://www.seattle.gov/util/MyServices/Rates/WaterRates/Resi...](http://www.seattle.gov/util/MyServices/Rates/WaterRates/ResidentialRates/index.htm)

[2]:
[http://www.asknumbers.com/LiterToCubicFeet.aspx](http://www.asknumbers.com/LiterToCubicFeet.aspx)

~~~
gambiting
In some parts of the UK water is unlimited - you only pay a yearly fee for
access, but you can literally use as much as you like - it's not metered. So
flushing your neighbour's toilet would be at most amusing,but not costly.

~~~
ben1040
I live in St Louis, MO, where in many parts of the area the water system is
old enough that they don't even have meters.

The water division charges a flat rate based on the number of rooms and
toilets/showers in the house, as that information is on file with the property
tax assessor's records. If you ever add or remove a room or water fixture, you
have to get a permit, which would get those upgrades reflected on the
assessor's records.

------
supermatt
Although not mentioned in the advisory, this particular model also allows you
to play sounds through the toilets internal speaker.

Any exploit should surely consist of the lid flapping open and closed while
the toilet whispers to you, beckoning you to come closer, and finally
squirting you in the eye with the bidet.

~~~
smacktoward
"Didn't your parents tell you never to listen to toilets?"

------
benjamincburns
I'm going to go ahead and file this away as an example of how needless
complexity can bite you in the ass. In this case, _almost_ literally.

------
donutz
Here's the app that goes along with the toilet:
[https://play.google.com/store/apps/details?id=jp.co.lixil.re...](https://play.google.com/store/apps/details?id=jp.co.lixil.remotesatis201210&hl=en)

At least the poop journal aspects shouldn't be compromised even if your toilet
is :)

------
chris_wot
Toilets are awesome. We rarely talk about them (or sewers), but they are a
VERY important part of disease control. Toilets save lives, we just don't
realise it.

~~~
alphakappa
And electronic bidets are the most awesome of toilets. Once you get used to
them (and they are fairly affordable as long as you don't go for Toto), using
paper feels so... primitive.

~~~
cynwoody
Almost eleven years ago, one Stana Claus contributed† the following factoid to
history:

    
    
        Just so you know, some varieties of corn have a dark reddish cob
        while others have more of a whitish colored cob. When I was but a
        wee child I was told by my beloved grandfather that the proper
        outhouse technique required "two reds and a white". The red cobs
        (apparently more readily available, at least in that locale) were
        used for bulk removal, and the white was used to determine if the
        job was sufficiently done. Surely, my grandfather wouldn't have
        lied to a small impressionable child about such a thing!
    

†[http://boards.straightdope.com/sdmb/showpost.php?p=2363912&p...](http://boards.straightdope.com/sdmb/showpost.php?p=2363912&postcount=13)

------
tinco
.. so you can flush without touching the toilet? .. brilliant :P

~~~
gambiting
But that means you have to touch your phone, probably before washing your
hands first. Less than ideal.

~~~
mavhc
Not with the Moto X, "OK Google Now, flush toilet"

~~~
ics
"Siri, spray shiri," in this case.

