[HN Gopher] Hacking Washing Machines [video]
___________________________________________________________________
Hacking Washing Machines [video]
Author : clausecker
Score : 202 points
Date : 2025-12-30 01:40 UTC (21 hours ago)
(HTM) web link (media.ccc.de)
(TXT) w3m dump (media.ccc.de)
| landr0id wrote:
| Pretty cool for BSH and Miele to hop on a call with the
| researchers just to make sure there were no issues they were
| unaware of. Sounded like it was productive and positive for
| everyone involved. Hopefully they don't start doubling down on
| hardware security though :p
|
| The optical communication for the Miele was pretty interesting
| too. I'm assuming it's to prevent moisture from corroding a port
| of some kind. Does anyone know of other devices this is used in
| or other benefits to this?
| opello wrote:
| > I'm assuming it's to prevent moisture from corroding a port
| of some kind.
|
| The primary value discussed in the talk was electrical
| isolation since there's mains voltage in the appliance and the
| potential for shorts or inadequate isolation would require some
| kind of isolation, so a path that optically isolates the
| communication makes quite a bit of sense.
|
| I'm also curious if other devices have gone this route.
| bri3d wrote:
| LG appliances at least used to use acoustic signaling for
| diagnostics: hold a phone up and the washer makes some modem-
| esque (I think it's 4-tone / 4-FSK) noises and the app or
| technician can diagnose issues. It was originally engineered
| to even work over voice codecs, so a customer without a
| smartphone could relay the diagnostic session to a
| technician.
| opello wrote:
| That's pretty cool. I found a write-up[1] on it but
| unfortunately didn't come across any examples of the
| communication.
|
| [1] https://github.com/kabelincho/LG-Smart-Diagnostics-
| modem
| bri3d wrote:
| There are lots of examples on YouTube, this one seems
| succinct: https://youtube.com/shorts/3Eb315vL9uw . They
| picked good tones to make it satisfying IMO. I don't know
| of anyone who's reversed the bitstream in public, though,
| but it doesn't seem like it should be very hard.
| opello wrote:
| That's a great example, thanks! I was looking for "LG
| Smart Diagnostics" and "audio" and then "LG Acoustic
| Diagnostics" and found TVs calibrating their audio
| playback but not this. Trying "LG Audible Diagnosis"
| found a bunch like yours.
| imglorp wrote:
| That's some advanced gatekeeping right there. Where other
| appliances might have a blink code or several digit error
| display (Miele) to look up in a manual, the phone method
| tires you to the manufacturer.
| noAnswer wrote:
| The support hotline will ask you to hold your phone
| towards the device. It is less error-prone (than a human)
| and contains more info than a blink code. I find it
| really clever.
| imglorp wrote:
| Sure it's clever. But it also means you can't repair the
| appliance without the manufacturer's server to decode it
| for you.
| grepfru_it wrote:
| Owner of an LG washer that failed here.
|
| All the same diagnostics you can do at the machine, the
| phone home service allowed a remote engineer to diagnose
| as well. Things like drum rpm, tilt/knock sensors, uneven
| balance detection. Instead of paying a human $250 to come
| out and press buttons, they can do it remotely.
|
| I understand in the pessimistic age of John Deere, all
| remote diagnostics are bad, but that is not the case
| here. I was able to do all of the diagnosis myself to
| determine it was a bad stator and then replace it myself.
| thesuitonym wrote:
| It doesn't require a server, it just requires knowing
| what the codes mean, same as blinking lights.
|
| Decoding it without help would be difficult for the
| average consumer, but it's not an impossible task.
| landr0id wrote:
| >so a customer without a smartphone could relay the
| diagnostic session to a technician
|
| Do you mean by mimicking the noises themselves?
| wpm wrote:
| No you see you just need to buy specially marked boxes of
| Cap'n Crunch that have a plastic whistle in them that
| plays the tones for you.
| userbinator wrote:
| I wonder how many HN readers still get that reference
| (and 2600, etc.)
| hunter2_ wrote:
| We make use of a service already existing without paying
| for what could be dirt-cheap if it wasn't run by
| profiteering gluttons...
| Y_Y wrote:
| I'm merely middle aged, but I've read the hacker lore.
|
| https://en.wikipedia.org/wiki/Blue_box
| notpushkin wrote:
| By holding their phone up to the machine.
| atoav wrote:
| The absolutely "leetest" thing I have ever seen was a
| device where the firmware update was to be done by:
|
| 1. Hold a button while booting (pretty normal)
|
| 2. This reconfigures the circuit path of one of the LEDs so
| it is reverse-biased to VCC via its resistor and switches
| one of the microcontroller GPIOs to ADC input
|
| 3. You go to a website that plays a strobe pattern
| (encoding the firmware)
|
| 4. You hold that website in front of the LED till other
| LEDs blink, signifying a successful update
|
| They could have done this using a photodiode, but no, they
| had to abuse an LED. Not many people are aware that LEDs
| can in a certain configuration be used to measure light.
| nicolaslem wrote:
| Another example of firmware update reusing something that
| is already there: some electric guitar effects from TC
| Electronics can be reprogrammed by bringing a phone close
| to the guitar pickups. The phone app encodes the data as
| sound that is picked up by the guitar pickups and sent
| down the chain to the effect.
| mjochim wrote:
| Electric meters often blink a signal LED for every X kWh, so
| other devices can read the signal. I'm not sure if this is
| used for bidirectional communications, though.
| bigfatkitten wrote:
| No, but they also have a separate infrared interface for
| this.
|
| https://en.wikipedia.org/wiki/IEC_62056
| NegativeLatency wrote:
| Smart meters have a whole protocol
| eru wrote:
| Alternatively, I guess you could also use really thin cables
| to carry the low voltage paths; and that act as fuses, if
| ever a lot of current at high voltage was flowing across
| them? But probably not very reliable both in regular
| operation and as fuses.
|
| We have a Miele washing machine and a Miele dryer. Solid
| machines all around even after years of use.
| bdonlan wrote:
| Fusible traces aren't uncommon - but they would effectively
| destroy the device if current limits are exceeded, and they
| certainly would be if the power supply is non-isolated, so
| it wouldn't actually be a solution to the firmware update
| problem.
|
| The usual solution here is an optical coupling of some kind
| - optocouplers (a box with a LED, photodiode, and air gap
| between them) are very common for this purpose, and are an
| inexpensive and effective option for digital signaling
| across an isolation boundary.
|
| In this case they've basically built a custom optocoupler
| out of discrete components, which is a bit unusual, but
| makes sense when you consider the risk of corrosion due to
| water ingress at the diagnostic ports, and the need to
| access it while - for example - a dishwasher cycle is
| running.
| MisterTea wrote:
| > The optical communication for the Miele was pretty
| interesting too. I'm assuming it's to prevent moisture from
| corroding a port of some kind.
|
| IRDA was very popular at one point and still lives on in
| applications like these. It's an IR serial port hung off a
| UART. It's stupid simple requiring no cables, pairing, or
| complex protocol stacks. Some smart phones have IR blasters
| built in so its a total win for ease of deployment in cases
| like these.
| AdieuToLogic wrote:
| Whenever someone brings up washing machines and software, I am
| always reminded of Forth[0]: As an example,
| imagine a microprocessor-controlled washing machine
| programmed in Forth. The ultimate command in your example
| is named WASHER. Here is the definition of WASHER, as
| written in Forth: : WASHER WASH SPIN RINSE SPIN ;
|
| 0 - https://www.forth.com/starting-forth/1-forth-stacks-
| dictiona...
| kh2engab wrote:
| When I read 'Hacking washing machines' the first thing that came
| to mind was how to open that damn thing once the program had
| finished.
| mikeayles wrote:
| Most washing machines use a wax motor to lock the door, it
| heats up wax to cause it to expand when it melts, which drives
| a pin. They're fairly failsafe as if you kill power, they will
| open no matter what.
|
| Latching relays/(technically solenoid) could be driven on/off
| fast, the downside is in a power cut or an emergency, the relay
| wouldn't release unless specifically driven so.
|
| So the third option is a momentary solenoid, which would need
| to be powered the whole time the door is shut, and they require
| a surprisingly significant amount of power. Typically 10-20w.
| Negligible when it compares to the KW+ heating elements, but
| they do add up for the energy ratings..
|
| Fwiw, I currently have a haier, which does have one of the
| second options, and opens immediately after a wash and it's
| amazing. Can't go back.
|
| But, wax motors continue to be used because they're just the
| right tool for the job.
| bob1029 wrote:
| You can still buy machines without the lid lock. They use an
| alternative design that can stop motion quickly enough to
| meet safety standards. I can open the lid on my washer in the
| middle of a heavy spin cycle at max RPM if I want to, but it
| will brake aggressively and come to a halt within 1-2
| seconds. Being able to add laundry mid-cycle without asking
| permission from the computer is really nice.
| DemocracyFTW2 wrote:
| > how to open that damn thing
|
| "I'm sorry Dave but I'm afraid I can't do that"
| gorgoiler wrote:
| We already know that hackers from NSA / FSB / PLA are working day
| and night on nation-state level attacks. They divert toilet
| tissue deliveries and hack traffic signals to raise my blood
| pressure to a tipping point where, presumably, I am supposed to
| demand local regime change?
|
| Now I have to worry about passing drones using blinkenlights to
| Stuxnet my wool wash and shrink my merino socks? Brilliant.
| Bloody brilliant.
|
| It's like the most banal version of Battlestar Galactica ever but
| instead of an alien intelligence leveraging computer integration
| to attack mankind from within, it's a guy in a t-shirt in a
| sweaty bunker filling my dishwasher to the brim with cold water
| then laughing at me via my Ring camera as he watches me flood my
| kitchen.
|
| _[Very cool talk, thanks for sharing :) ]_
| letmetweakit wrote:
| I'm "fearful" of a future where every random appliance needs to
| be connected to the internet in order to function at all. I hope
| some legislation gets passed (in the EU in my case) that forces
| manufacturers to ensure the machine works offline and connecting
| it is purely an opt-in feature.
| euroderf wrote:
| This might also need some kind of certification. Some sort of
| independent industry-financed lab atmosphere. I think UL
| (Underwriters Laboratories) worked that way.
| moooo99 wrote:
| Very interesting talk! I think it is quite cool that Miele and
| BSH reached out when they saw the event announcements to make
| sure there are not any issues they're not aware of. Seems like a
| productive experience for all involved!
|
| The WiFi implementation was interesting to me, I am glad that it
| is reasonably safe. I understand much of the skepticism around
| these kinds of features, but I also see the value in many
| settings. As long as they remain optional, I think the benefits
| outweigh the drawbacks. Kudos for BSH having good developer
| documentation and a local mode. I feel like a local mode should
| be mandatory, for safety and support reasons
| nephihaha wrote:
| What is the point in the WiFi? All I am interested in is
| something that washes my clothes. Not something with endless
| updates and glitches that ger fixed in post.
| barrkel wrote:
| It'll tell you when your clothes have finished washing so you
| can transfer them to the dryer and/or start a new load.
| nephihaha wrote:
| I can do that without WiFi. So what is the point other than
| data harvesting?
| bigstrat2003 wrote:
| Depending on your house setup you might not be able to. My
| washer and dryer are in my basement, and I can't hear them
| at all (neither when they are running, nor the sound they
| make when they finish). Moreover, the timer listed on the
| machine when you start the cycle is not accurate
| (particularly for the dryer, which is frequently off by 30+
| minutes). This means that I have no idea when my clothes
| are done except by going to the basement to check. That's
| not the end of the world, but it would be genuinely nice to
| be able to get them on my wireless network and have them
| send me a notification.
|
| Perhaps that doesn't apply to you and how your home is set
| up. Fair enough. But that doesn't mean the use case doesn't
| exist.
| stevenjgarner wrote:
| As we enter a world of robotics, some users may also find it
| useful to have their robots directly access their "appliances",
| including with "retro" appliances that do not adhere to some
| future interoperability standard. I remember way back when I
| had a Heathkit HERO-1, it had a built-in solderless breadboard
| on the robot's head. I remember the total thrill of programming
| it that and the Radio Frequency (RF) Remote Control to turn off
| my bedroom light. Kind of a "hello" program moment for me.
| megous wrote:
| Makes me appreciate our landlord's electro-mechanical "music-box"
| washing machine.
|
| It has been working for 25 years with no servicing, except when
| it "broke" once about 5 years ago. So I just opened it, stared at
| it for a while, and after considering the symptoms (no click in
| the door locking mechanism but power indicator light turning on),
| I realized the issue will be with something very early on in the
| fixed washing cycle, before the timing motor gets activated, and
| there will be no serious electrical damage elsewhere (fuse
| intact). So I looked at the door locking mechanism (bi-metalic
| thing) and noticed that the cable connector leading to it was
| slightly shifted. Re-seated the connector, and the machine
| started working again.
|
| While it was open, I didn't notice anything horrible (corrosion,
| leaks, nothing). Probably the next thing that will "break" will
| be when the motor's carbon brushes will "run out". :)
|
| You can understand and diagnose these things even without knowing
| too much. That's how obvious, simple, and accessible the electro-
| mechanical design is.
| donjoe wrote:
| The video brought me back to my internship in the early 2010s. My
| job was testing the new US ovens (which for us Europeans are
| massive). The bus was amazing. Integrated into a LabView setup,
| you could basically collect any readings from the oven as well as
| remotely control it. Also, it was super easy to confirm "manual"
| actions (e.g. soleniods pushing buttons/motors turning knobs).
|
| A few other interesting tasks I was involved back then were:
|
| - smashing an oven's door until the hinges would give up -
| testing new heating elements in the open (basically, building a
| gigantic grill) - appliance transport packaging tests - cooking
| and baking on a daily basis to make sure food turns out as
| expected
|
| Overall, home appliances are a great product as an engineer to
| work on. It is a product you usually use multiple times a day.
| And if you love cooking yourself, even better :-)
| puskavi wrote:
| Neat, now I can diagnose whats going on with my 20y old Miele
| dishwasher when it does weird things!
| ThomasMidgley wrote:
| We have a Thermomix TM31 which I repaired a few weeks ago. On the
| control board I found an IR module and a LED beside that which
| both are visible from outside (left side of the display), but are
| not labled. Until now I couldn't find any documentation or
| information about this IR interface. It would be nice if someone
| will reverse engineer this. And maybe also an integration into
| the BSH-App. Then you could remotely start the cooking process
| when leaving the office... :-)
___________________________________________________________________
(page generated 2025-12-30 23:01 UTC)