Hacking Washing Machines [video](media.ccc.de) |
Hacking Washing Machines [video](media.ccc.de) |
Now I have to worry about passing drones using blinkenlights to Stuxnet my wool wash and shrink my merino socks? Brilliant. Bloody brilliant.
It’s like the most banal version of Battlestar Galactica ever but instead of an alien intelligence leveraging computer integration to attack mankind from within, it’s a guy in a t-shirt in a sweaty bunker filling my dishwasher to the brim with cold water then laughing at me via my Ring camera as he watches me flood my kitchen.
[Very cool talk, thanks for sharing :) ]
A few other interesting tasks I was involved back then were:
- smashing an oven's door until the hinges would give up - testing new heating elements in the open (basically, building a gigantic grill) - appliance transport packaging tests - cooking and baking on a daily basis to make sure food turns out as expected
Overall, home appliances are a great product as an engineer to work on. It is a product you usually use multiple times a day. And if you love cooking yourself, even better :-)
The optical communication for the Miele was pretty interesting too. I'm assuming it's to prevent moisture from corroding a port of some kind. Does anyone know of other devices this is used in or other benefits to this?
The primary value discussed in the talk was electrical isolation since there's mains voltage in the appliance and the potential for shorts or inadequate isolation would require some kind of isolation, so a path that optically isolates the communication makes quite a bit of sense.
I'm also curious if other devices have gone this route.
We have a Miele washing machine and a Miele dryer. Solid machines all around even after years of use.
IRDA was very popular at one point and still lives on in applications like these. It's an IR serial port hung off a UART. It's stupid simple requiring no cables, pairing, or complex protocol stacks. Some smart phones have IR blasters built in so its a total win for ease of deployment in cases like these.
As an example, imagine a microprocessor-controlled washing
machine programmed in Forth. The ultimate command in your
example is named WASHER. Here is the definition of WASHER,
as written in Forth:
: WASHER WASH SPIN RINSE SPIN ;
It has been working for 25 years with no servicing, except when it "broke" once about 5 years ago. So I just opened it, stared at it for a while, and after considering the symptoms (no click in the door locking mechanism but power indicator light turning on), I realized the issue will be with something very early on in the fixed washing cycle, before the timing motor gets activated, and there will be no serious electrical damage elsewhere (fuse intact). So I looked at the door locking mechanism (bi-metalic thing) and noticed that the cable connector leading to it was slightly shifted. Re-seated the connector, and the machine started working again.
While it was open, I didn't notice anything horrible (corrosion, leaks, nothing). Probably the next thing that will "break" will be when the motor's carbon brushes will "run out". :)
You can understand and diagnose these things even without knowing too much. That's how obvious, simple, and accessible the electro-mechanical design is.
The WiFi implementation was interesting to me, I am glad that it is reasonably safe. I understand much of the skepticism around these kinds of features, but I also see the value in many settings. As long as they remain optional, I think the benefits outweigh the drawbacks. Kudos for BSH having good developer documentation and a local mode. I feel like a local mode should be mandatory, for safety and support reasons
Latching relays/(technically solenoid) could be driven on/off fast, the downside is in a power cut or an emergency, the relay wouldn't release unless specifically driven so.
So the third option is a momentary solenoid, which would need to be powered the whole time the door is shut, and they require a surprisingly significant amount of power. Typically 10-20w. Negligible when it compares to the KW+ heating elements, but they do add up for the energy ratings..
Fwiw, I currently have a haier, which does have one of the second options, and opens immediately after a wash and it's amazing. Can't go back.
But, wax motors continue to be used because they're just the right tool for the job.
"I'm sorry Dave but I'm afraid I can't do that"
Of course I would never, ever give devices like this access to the 'net, not even for a few seconds. What 'smart' devices I have around usually run firmware which I installed on them, replacing whatever leaky spyware they came with from the factory. The only exception to this rule is the Fronius inverter which runs its original firmware but just like all other 'smart' things it lives in its own enclave and never got a single bit from or to the 'net. All communications goes through proxies which are under my control, there are no automatic firmware upgrades, no information leaks, no nothing - we live on a farm in the Swedish countryside so there is chance for any 'smart' device to surreptitiously hop onto an open WiFi-network either. Maybe I'll have a look at adding some ESP32-powered wifi functionality to the washer and dishwasher so I can integrate them into the (OpenHAB-powered) control system I use for controlling all things electronic here, something to do for a snowy day?
In the meantime, I'll leave this here:
The usual solution here is an optical coupling of some kind - optocouplers (a box with a LED, photodiode, and air gap between them) are very common for this purpose, and are an inexpensive and effective option for digital signaling across an isolation boundary.
In this case they’ve basically built a custom optocoupler out of discrete components, which is a bit unusual, but makes sense when you consider the risk of corrosion due to water ingress at the diagnostic ports, and the need to access it while - for example - a dishwasher cycle is running.
Perhaps that doesn't apply to you and how your home is set up. Fair enough. But that doesn't mean the use case doesn't exist.
1. Hold a button while booting (pretty normal)
2. This reconfigures the circuit path of one of the LEDs so it is reverse-biased to VCC via its resistor and switches one of the microcontroller GPIOs to ADC input
3. You go to a website that plays a strobe pattern (encoding the firmware)
4. You hold that website in front of the LED till other LEDs blink, signifying a successful update
They could have done this using a photodiode, but no, they had to abuse an LED. Not many people are aware that LEDs can in a certain configuration be used to measure light.
[1] https://github.com/kabelincho/LG-Smart-Diagnostics-modem
Do you mean by mimicking the noises themselves?
All the same diagnostics you can do at the machine, the phone home service allowed a remote engineer to diagnose as well. Things like drum rpm, tilt/knock sensors, uneven balance detection. Instead of paying a human $250 to come out and press buttons, they can do it remotely.
I understand in the pessimistic age of John Deere, all remote diagnostics are bad, but that is not the case here. I was able to do all of the diagnosis myself to determine it was a bad stator and then replace it myself.
Decoding it without help would be difficult for the average consumer, but it's not an impossible task.