I tried to fact check it also. They talk about a "java-based" os that could have been the cause.

I know java me was a thing and there are micro jvm that can run on microcontrollers but still, it does not add up.

I think a DDoS attack happened (happens all the time) and security "experts" mentioned that these things could come from anywhere, even toothbrush, and the details got lost in translation / used for click bait.

>A bunch of BLE chips are also WiFi capable, so not ruling out that someone compromised the firmware to enable WiFi functionality

The ESP32 is now used as a general-purposed chip even in applications where an 8-bit MCU would have been enough. A remotely exploitable vulnerability in the ESP32/SDK could have large-scale consequences.

The only way to load firmware to consumer esp platforms is usually via mobile apps… so, someone with privileged access to consumer’s apps, or the supply chain, used that access to load bespoke firmware to toothbrushes.. highly doubtful.

Leaves open the question of how they joined the network - WiFi passwords and such. Maybe stolen from the phones/laptops and then sent to the device as part of the exploit?

I could imagine there’s a lot of toothbrushes near unsecured wifi hotspots. (Hotels, in backpacks of travellers in a cafe, a demo unit in a store) Could be as simple as polling continuously till one allows the device to phone home.

This does seem to be a debunked story though.

It's not something that actually happened. It's just some bullshit that's gone viral.

https://cyberplace.social/@GossiTheDog/111886558855943676

That toot references https://archive.is/2024.01.30-203406/https://www.luzernerzei... which attributes the story to Stefan Züger from the Swiss branch of Fortinet and claims it to be an actual event.

I don't see a mention of "NoName Ddosia".

Re "Noname Ddosia": It's from the context, if you know your recent infosec history:

"Jüngst wurden damit auch Server von Schweizer Regierungsstellen während des Weltwirtschaftsforums angegriffen – als Retourkutsche für die Teilnahme des ukrainischen Präsidenten Wolodimir Selenski. Eine russlandnahe Gruppierung bekannte sich zum Angriff."

(translation: "Servers of Swiss government offices were recently attacked during the World Economic Forum - as a retaliation for the participation of Ukrainian President Volodymyr Zelensky. A group close to Russia claimed responsibility for the attack.")

Background: https://www.ncsc.admin.ch/ncsc/en/home/aktuell/im-fokus/2023...

But it's not clear to me that's right, isn't WEF in the summer?

Ah, they've been ongoing, here's the earlier one: https://www.ncsc.admin.ch/ncsc/en/home/aktuell/im-fokus/2023...

WEF is in winter

Usually in January, 2021 was in August and 2022 in May.

I can't read dutch, but machine translated to english the "original source" as referenced in your link says this:

> The example that comes like a Hollywood scenario has really happened that way.

Here's a better translation:

> This example, which seems like a Hollywood scenario, actually happened.

The best translation, however, is from Fortinet's clarifying statement.

https://mastodon.social/@jasonkoebler/111892744775689047

"It appears that due to translations the narrative on this topic has been stretched to the point where hypothetical and actual scenarios are blurred"

> I can't read dutch, but...

It's not Dutch, it's German, so trying to translate it as if it were Dutch would give strange results (although Google Translate tried to do it anyway, and came fairly close, due to the languages being somewhat related).

The original sentence: "Das Beispiel, das wie ein Hollywood-Szenario daherkommt, hat sich wirklich so zugetragen."

Translating from German, Google Translate gave me:

"This example, which seems like a Hollywood scenario, actually happened."

Translating, as if it were Dutch, Google Translate gave me:

"The play, the one who comes to a Hollywood theater, is such a work in itself."

>It's not Dutch, it's German, so trying to translate it as if it were Dutch would give strange results

Anecdote: One of my coworkers once thought that Dutch means German. I guess it was because the words "dutch" and "deutsch" look so similar.

It's possible that terms such as "Pennsylvania Dutch", which refers to the German-Paletine originating Amish and other groups within the US state of Pennsylvania, might account for some of this confusion. The "Dutch" in that case are actually "Deutsch", that is, of German origin.

That said, the Dutch language is among the Germanic languages, and is closely-related to German itself (similarly, the Dutch-derived Afrikaans, with which Dutch is largely mutually intelligible). To someone reasonably fluent in German, Dutch looks like a somewhat garbled variant. Similarly Danish, though the spoken form varies considerably from the orthography, and Norwegian, also closely related. Contemporary German shares many words and a fair bit of grammar with English as well, making blingualism in both relatively easy, compared with, say, more distant languages such as English-Arabic or English-Mandarin.

You're right, and I should've realized that, but I just used the browser translation and must've misread deutsch for dutch.

Regardless, the translation is close enough to yours (albeit grammatically awkward).

> but I wonder how they were able to connect to WiFi to trigger a botnet in the first place.

Wardriving for oral health?