<story><title>The fresh smell of ransomed coffee</title><url>https://decoded.avast.io/martinhron/the-fresh-smell-of-ransomed-coffee/</url></story><parent_chain><item><author>tgsovlerkhgsel</author><text>The (editorialized) current HN title (&amp;quot;Coffee makers are demanding ransom&amp;quot;) implies that this is an in-the-wild attack.&lt;p&gt;It&amp;#x27;s just another PoC showing that IoT devices tend to have bad security.&lt;p&gt;In-the-wild ransomware would be interesting news because the same fragmentation that makes it unprofitable to secure devices (too few devices sold of each vendor&amp;#x2F;model for the vendor to invest serious money in security) makes it unprofitable to attack most devices.&lt;p&gt;Ransomware is particularly pointless for non-critical devices like a coffee maker. I could see it working e.g. with something controlling heating that isn&amp;#x27;t easily bypassable (pay us now, or by the time you get a tech out your pipes will be frozen and your house ruined), or something that can otherwise cause harm before the user can disable it (which is likely rare).&lt;p&gt;With a coffee maker, you can easily unplug the device (preventing it from doing further harm&amp;#x2F;threatening to burn your house down), put it in a box, and ship it to the vendor to fix it.</text></item></parent_chain><comment><author>dang</author><text>We changed the title to a substring of the title (&amp;quot;Coffee makers are demanding a ransom&amp;quot;) to make it less baity but I see how that could be misleading. I&amp;#x27;ve attempted to disambiguate it above.&lt;p&gt;Edit: perhaps a better solution is to change to the original source, pointed out by commenters in this thread. We&amp;#x27;ve changed to that from &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;arstechnica.com&amp;#x2F;information-technology&amp;#x2F;2020&amp;#x2F;09&amp;#x2F;how-a-hacker-turned-a-250-coffee-maker-into-ransom-machine&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;arstechnica.com&amp;#x2F;information-technology&amp;#x2F;2020&amp;#x2F;09&amp;#x2F;how-a...&lt;/a&gt;.</text></comment>
<story><title>The fresh smell of ransomed coffee</title><url>https://decoded.avast.io/martinhron/the-fresh-smell-of-ransomed-coffee/</url></story><parent_chain><item><author>tgsovlerkhgsel</author><text>The (editorialized) current HN title (&amp;quot;Coffee makers are demanding ransom&amp;quot;) implies that this is an in-the-wild attack.&lt;p&gt;It&amp;#x27;s just another PoC showing that IoT devices tend to have bad security.&lt;p&gt;In-the-wild ransomware would be interesting news because the same fragmentation that makes it unprofitable to secure devices (too few devices sold of each vendor&amp;#x2F;model for the vendor to invest serious money in security) makes it unprofitable to attack most devices.&lt;p&gt;Ransomware is particularly pointless for non-critical devices like a coffee maker. I could see it working e.g. with something controlling heating that isn&amp;#x27;t easily bypassable (pay us now, or by the time you get a tech out your pipes will be frozen and your house ruined), or something that can otherwise cause harm before the user can disable it (which is likely rare).&lt;p&gt;With a coffee maker, you can easily unplug the device (preventing it from doing further harm&amp;#x2F;threatening to burn your house down), put it in a box, and ship it to the vendor to fix it.</text></item></parent_chain><comment><author>m463</author><text>I thought it might be about Keurig, whose coffeemakers don&amp;#x27;t brew unauthorized coffee.</text></comment>