Post #3495748

2026-06-29 22:01 UTC

I found a device/bandwidth breakdown in some obscure page of the router's admin interface the dishwasher's used 700+GB in the last howeverlong, my laptop using 43GB in the same time period my partner got this dishwasher a few years ago after reading many reviews; I've never liked it much but I liked it even less after discovering you had to use the app – via the internet – to do a rinse cycle or a self-clean I'm not sure how it could have become compromised; we keep all our stuff up-to-date, I don't let untrusted stuff on the network, and the only android device we have is an MP3 player / e-reader for the kid for which you can only install apps via sideloading APKs via miniSD Then again, it's a dishwasher company writing software in the age of vibecoding, so who knows, maybe it self-compromised

Replies (5)

@jernej__s@infosec.exchange 2026-06-30 18:31

@mattly@hachyderm.io Bosch? I know my sister has a Series 4 Bosch, and some programs are only available through the app; my cousin has a slightly older Series 4 Bosch, with no WiFi and can activate those programs through the button that was repurposed for WiFi on the newer model.

Open ##3495782
@technomancy@hey.hagelb.org 2026-06-29 22:13

@mattly@hachyderm.io yeah it's distressingly possible that your dishwasher company is a bright data customer and is pocketing a cut of the proceeds they get from deliberately deploying malware into your house, even without any vibecoding to blame

Open ##3496040
@Fooker@infosec.exchange 2026-06-30 20:32

@mattly@hachyderm.io orher than the obvious "why in the hell do you have a dishwasher connected to the internet?!", i'm curious about you phrasing at "we only have one android device". Do you consider them less reliable from a security stand point than a fucking dishwasher that needs the internet to work? (Not trying to be snarky, just.. you know, dishwasher, internet.. as a venn diagram that should look like two veeery seperate circles. But you mention android as if it's obvious it should be the bad guy)

Open ##3497881
@iggy_frankovic@infosec.exchange 2026-07-02 23:21

@mattly@hachyderm.io @buherator@infosec.place Bosch?

Open ##3544996
@bontchev@infosec.exchange 2026-07-03 06:58

@mattly@hachyderm.io Can't prove without logs to examine but I doubt that it was compromised. More likely some kind of bug - that's why the update fixed it.

Open ##3551267