Security (b)log - English edition: October 2026

2026-10-30

Vacuum cleaners and toothbrushes

Image: allthegearnoskill

Just under two months ago I heard two news items on the same day, and both caught my attention. One was about a robot vacuum cleaner, the other about an electric toothbrush. Let’s look for the similarities.

A robot vacuum cleaner has eyes, because otherwise it would keep bumping its nose. Some models use cameras for this (others use, for example, a laser or ultrasound to detect obstacles and to build a picture of their surroundings). A family in Taiwan had one of those vacuum cleaners with optical cameras. When the husband, who was away, wanted to surprise his wife by chatting with her through the vacuum cleaner, he saw on the camera footage that his wife was naked and with another man. He filed a lawsuit for adultery and was awarded damages, but then had to go to prison himself. His (ex?) wife had filed a counterclaim for invasion of privacy. Taiwan takes illegal recordings very seriously.

Then that toothbrush. Dyson has brought a model with cameras to market. You wonder why? To analyse your teeth. The device can also fire a jet of liquid at the spaces between your teeth, and it finds those spaces by looking. That’s where – how could it be otherwise these days – AI comes in.

I then wonder what those cameras do the rest of the time. Look around your bathroom a bit? No, says the manufacturer: when you aren’t brushing, the camera is off. Moreover, the camera has a macro lens, designed to focus at very short distances. That’s quite obvious alright. However, there is also a second lens to widen the field of view. But that one won’t have much depth of field either (a measure of how ‘deep’ the area is that you see in focus), although it is greater with a wide-angle lens than with a macro lens. The resolution, by the way, is only 100,000 pixels – my average phone is fifty times better. And Dyson promises that the photos are not stored anywhere and not shared.

So much for the theory. Then I went looking for camera footage. And I found it: an Instagrammer called ‘allthegearnoskill’ took her toothbrush outside and shot pictures with it. They are heavily distorted photos, and the light and colours are odd too, but you can recognise a thing or two in them, such as buildings and landscapes. These are probably screenshots of footage streamed to the phone – after all, the toothbrush doesn’t store anything itself.

Two very different devices, and yet with something in common. The German word Zweckentfremdung comes to mind; you could translate it as ‘purpose alienation’ – the thing is used for something quite different from what it was intended for. A vacuum cleaner as a private detective, a toothbrush as a camera.

But there is more going on. These devices also have an app. And are therefore connected to the outside world. Remember what I wrote about that in the last blog? Those devices are vulnerable. If you can get at them with your app, then in theory someone else can too. Handy for burglars: a vacuum cleaner that maps the house for them and shows what is there to take. And that toothbrush is perhaps a fun toy for bathroom peeping toms.

It is somewhat reassuring that such devices at least have basic security: you need an account with a password. After that it all gets a bit vaguer. Multi-factor authentication would be desirable, but is by no means always documented. Access to the camera and any communication functions should be shielded separately. And as an aside: why would you ever want to make video calls via your vacuum cleaner? Speaking of Zweckentfremdung!

And in the big bad world…

2026-10-18

Robots and Supermarkets

Original image: Wikipedia

First Law: a robot may not injure a human being or, through inaction, allow a human being to come to harm. Second Law: a robot must obey the orders given to it by human beings, except where such orders would conflict with the First Law. Third Law: a robot must protect its own existence, as long as such protection does not conflict with the First or Second Law.

These are the three laws of robotics, drawn up in 1942 by the American science fiction author Isaac Asimov. The idea was that these laws had to be hardwired into every robot, to prevent (ever more intelligent) robots from turning against humans.

Then, in 2004, the film I, Robot came out, starring Will Smith (with toe-curling product placement for sneakers and a car brand, but that's beside the point). In this film (spoiler alert), a certain type of robot turns against humans in 2035. At the end of the film the cat comes out of the bag: the supercomputer that communicates with all these robots has interpreted the laws of robotics a little differently. Humans are ruining themselves and the Earth through crime and pollution, so the robots must protect humans from themselves by subjugating them. The crux, of course, lies in this part of the First Law: “through inaction, allow a human being to come to harm”. Decades later, by the way, Asimov also formulated the Zeroth Law, which ranks above the other three and legitimises the uprising even more clearly: a robot may not harm humanity, or, by inaction, allow humanity to come to harm.

Fast forward to 2026, to the night of 11 to 12 October. The temperature in the refrigeration systems of hundreds of French supermarkets climbed to fifty degrees centigrade – above zero, mind you (122 °F). This lasted about six hours. No alarm went off anywhere. Well, a fire alarm probably did start beeping here and there eventually, because some refrigeration units caught fire or melted away.

That makes you wonder: why can a refrigeration unit get that hot in the first place? Were the laws of robotics perhaps broken here, to protect humans – and the French in particular – from frozen meals? Fortunately, no, the explanation is simpler. In a refrigeration system, ice forms on the evaporator. That is why such a system regularly switches to defrost mode for a few minutes. So not to defrost the whole unit, but only the evaporator. Apparently, hackers managed to switch on this mode and lock it in place.

Why can the refrigeration system of a supermarket be reached via the internet? For the same reason that the installer of your solar panels can probably also look in remotely: because it's convenient. And to make things really easy, a backdoor was built in: you could log in with ‘admin’ and the current date. On top of that, some of the affected controllers were outdated models without recent security updates, and others were more modern controllers running outdated software.

Smart systems are vulnerable by definition, Mikko Hyppönen said ten years ago already (“If it's smart, it's vulnerable”). And if smart systems are treated dumbly, I would add, you're asking for trouble. That this happens is not all that strange, by the way. In IT (information technology) we have by now taken the need for security to heart, but the world of OT (operational technology) is still lagging well behind. No wonder – have you ever stopped to think, in the supermarket, that the refrigerator you take your ready-made lasagne from is computer-controlled and connected to the internet? Without that awareness, it's hardly surprising that security for that kind of system gets so little attention. As long as customers don't ask for it, manufacturers have little incentive to invest in it.

Perhaps the problem with Asimov's laws lies in the generality of the term ‘human’. It makes no distinction between honest and dishonest people, so robots have to listen to everyone. If the refrigeration unit had realised it was dealing with someone malicious, it could have defended itself.

And in the big bad world…

2026-10-02

Ants and lemons

Image: Unsplash

Like soldiers on a mission, they marched across the kitchen counter of that holiday home in Croatia. Ants. They were also roaming elsewhere in the house. The owner had, very helpfully, left out a spray bottle of organic pesticide. But I didn't necessarily want the critters dead; I just wanted them to stay away.

I don't remember how or why, but I got the idea to rub the counter with half a lemon. And it worked! The other half, which I placed along their path, worked just as well as a magic shield.

At home we have ant trouble too. Fortunately not indoors, but they are undermining our garden patio. After discovering this new wonder remedy, I sent an order home from Croatia to stock up on lemons in advance – they happened to be on sale. Once home, I ran to the garden to see how much lemon juice I'd need. Not an ant in sight. Not a single one. Rather deflated, over the following weeks we worked our way through the lemons bit by bit in our daily dose of orange juice.

This whole story resurfaced recently when someone from Groningen, in an Italian restaurant in London, asked me what the word for ‘ant’ is in Limburgish (a dialect from the southernmost province). We were there with a group of fellow attendees from a security conference, and ‘naturally’ my table companions decided I should go and capture those ants in a blog post.

They thought they were helping me along with the term intrusion detection, but in hindsight their Guinness levels may have been running a bit high at that point. What I'd actually needed wasn't intrusion detection at all, but intrusion prevention. The detection had been done with our own eyes; the prevention, with lemons.

So, what do intrusion detection and intrusion prevention systems (IDS/IPS) actually do? The names give it away: one only flags things, the other also steps in. Say someone tries to log in with your user ID ten times in quick succession (a hypothetical example, since in most systems you wouldn't even get that many attempts). An IDS flags this and puts up a red flag on a screen, hoping someone from security notices it. An IPS goes a step further: because that many failed login attempts isn't normal, it assumes a break-in attempt and blocks your account. Great, you think, just give me an IPS then, I don't need an IDS anymore.

As always, though, it's more nuanced than that. Intervening comes at a price. What if it was actually you logging in, but you'd accidentally hit the caps lock key, so upper and lower case ended up reversed in the password field? An IPS would then lock out the legitimate user, while an IDS alert would instead get someone to call you and ask if something's wrong. By that time you'd probably have spotted the caps lock light, smacked yourself on the forehead, and picked up right where you left off.

You'd also want a system like this to monitor whether large amounts of data are being copied (hello, Odido). But that doesn't have to be malicious – maybe an administrator is copying data as part of a legitimate job. You wouldn't want the whole thing shut down without question. But then again, maybe you would want exactly that if such a bulk action happens at three in the morning under the account of some random person (which does raise the question of whether that should even be possible in the first place, but that's a different story).

In short, you want a combination of IDS and IPS. The market has picked up on that too, since the line between IDS and IPS is blurring; modern products come with both IDS and IPS capabilities. But if you ever come across the abbreviations, at least now you know what's behind them.

And oh yes, that (South) Limburgish word for ant: it's oamezeek (ˈɔːməˌzeːk).