Hacking washing machines

Hacking washing machines

Speakers: Severin von Wnuck-Lipinski; Hajo Noerenberg

Conference: 39C3

YouTube: https://www.youtube.com/watch?v=Q1S-PVo3GlA

Overview

In an engaging and highly technical presentation at 39C3, Severin von Wnuck-Lipinski and Hajo Noerenberg unveiled their extensive research into the often-overlooked security landscape of modern household appliances. Moving beyond the common perception of these devices as mere mechanical tools, the speakers demonstrated that washing machines, dishwashers, ovens, and even wine cabinets are complex, networked systems ripe for reverse engineering and security analysis. Their talk, "Hacking washing machines," served as a pioneering exploration into the proprietary protocols and embedded systems governing millions of devices found in homes worldwide.

The motivation for this research stemmed from personal experiences – a broken Miele washing machine for Severin and a curiosity about the internal communication of BSH appliances for Hajo. What began as an effort to repair or understand led to the discovery of deep-seated diagnostic capabilities, easily bypassed security mechanisms, and the potential for comprehensive home automation integration. The talk highlighted the critical importance of investigating these ubiquitous devices, not only for potential security vulnerabilities but also for empowering consumers with greater control and understanding of their own technology, challenging the prevailing black-box approach of manufacturers.

Crucially, the speakers prefaced their technical deep dive with stern warnings about the inherent dangers of working with household appliances. These machines contain high voltages, often without adequate isolation, and interact with water, heat, and moving parts. Tampering with their firmware can lead to physical damage, flooding, or rendering the device unusable, potentially causing significant domestic friction. Despite these risks, their meticulous and methodical approach yielded groundbreaking insights, demonstrating that even sophisticated consumer electronics can be deconstructed and repurposed by determined researchers.

Background

▶ Watch: Introduction to appliance hacking and crucial safety warnings (0:00)

The journey into the hidden world of household appliance electronics began with a fundamental observation: while millions of these devices are sold annually and are integral to daily life, public security research into their internal workings is surprisingly scarce. This void of information provided a fertile ground for Severin von Wnuck-Lipinski and Hajo Noerenberg to embark on their respective investigations, driven by practical necessity and intellectual curiosity.

Severin's initial foray was prompted by a personal dilemma: his parents' 20-year-old Miele washing machine ceased functioning correctly, specifically failing to complete the final spin cycle. Online research suggested a potential water level sensor calibration issue. However, this calibration could not be performed through the machine's integrated service menu, requiring a proprietary tool known as the Miele diagnostic utility (MDU). This tool, accessible only to licensed service technicians, became the initial target of Severin's reverse engineering efforts. The MDU's capabilities, glimpsed through a forum screenshot, revealed extensive control over sensor values, operational states, relay states, and even the ability to modify built-in washing programs—a tantalizing hint at the underlying diagnostic protocol.

Concurrently, Hajo Noerenberg focused his attention on appliances from BSH Hausgeräte GmbH, one of the world's largest manufacturers, known through brands like Bosch, Siemens, Gaggenau, and Neff. His research was initiated by discovering a patent that alluded to a proprietary internal bus system called DBUS or DBUS 2. Like Miele's MDU, the DBUS was a closed, undocumented system, posing a significant challenge to understanding how internal modules within a BSH appliance communicated. The lack of public documentation for these critical internal communication protocols underscored the "black box" nature of these devices, making them ideal candidates for security and functionality exploration.

Prior work, though not directly related, provided crucial inspiration and initial clues. Severin mentioned the prior reverse engineering of Miele@home, the official remote appliance control solution, by a researcher named Mishozer. This project revealed a simple five-byte frame UART protocol, operating at 2400 baud with no parity. This discovery, despite being for a different Miele system, suggested that older Miele diagnostic protocols might share similar characteristics, providing a valuable starting point for Severin's investigation into the optical interface.

Key Findings

▶ Watch: Proprietary Miele Diagnostic Utility (MDU) introduced (4:40)

The research presented by Severin von Wnuck-Lipinski and Hajo Noerenberg yielded a treasure trove of discoveries, fundamentally altering the understanding of household appliance security and functionality. Their findings can be broadly categorized by manufacturer.

Miele Appliances (Severin's Research):

• Ubiquitous Optical Interface: Severin identified a bidirectional optical interface present on nearly all Miele appliances manufactured since 1996, including dishwashers, dryers, stoves, and even wine cabinets. This interface, used for customer service, development, and end-of-line testing, became the primary attack vector.
• Proprietary Protocol Decryption: Through meticulous experimentation, Severin successfully reverse-engineered Miele's diagnostic protocol. It utilizes simple five-byte frames transmitted over UART at 2400 baud with even parity, a crucial detail initially missed.
• Diagnostic Keys and Timing Attacks: The protocol requires specific diagnostic keys to unlock advanced diagnostic commands. Severin developed an ingenious timing attack by observing the microcontroller's sync pin (indicating instruction fetches). This method allowed him to brute-force the 8-bit parameters of the keys within approximately 512 iterations, revealing that these keys are model-specific.
• Bypassing ROM Readout Protection: Severin discovered that Miele's firmware images often incorporate ROM readout protection. He devised two methods to bypass this:

1. Halting firmware execution, writing a custom dump subroutine to an unused RAM section, and then jumping to it to output memory contents via UART.
2. Identifying and setting a specific "protection disabled flag" (the first bit) that completely deactivates the readout protection.

• Full Debug Capabilities: Once unlocked, the diagnostic protocol provides comprehensive control, including read/write access to EPROM and memory, the ability to jump to arbitrary subroutines, halt device execution, and even increase the UART baud rate, essentially offering full debug capabilities.
• Open-Source Tooling: Severin released FreeMDU, an open-source diagnostic tool suite comprising a protocol library, a terminal UI application, and experimental smart home integration for Miele appliances, providing functionality comparable to the official MDU.

BSH Appliances (Hajo's Research):

• DBUS Protocol Unveiled: Hajo successfully reverse-engineered the proprietary DBUS (or DBUS 2) bus system used by BSH appliances. He identified its physical characteristics (rust connectors, 3-4 pins) and electrical properties (9V in washing machines, 13.5V in dishwashers/dryers, 5V data signal).
• Multi-Master Serial Bus: The DBUS operates as a multi-master serial bus at 9600 baud using standard UART data framing. Each frame consists of a length byte, an address byte (target device + subsystem), a variable number of data bytes, and a two-byte checksum.
• Command Word Structure: Hajo identified that the first two bytes of the message payload constitute a command word, which dictates the action the target device should perform.
• Powerful Subsystem Zero: A critical discovery was subsystem zero, which behaves differently from others. It contains powerful commands (F000, F001, F200, F201) that allow direct read and write access to all memory locations on any module connected to the DBUS, regardless of any MCU Readout Protection (RDP).
• Firmware Dumping via STLink: On some BSH power boards, Hajo found an accessible STLink connector, enabling direct firmware dumping and code stepping using OpenOCD without RDP.
• Hidden Graphics in Firmware: Visual inspection of dumped firmware using tools like Bixel view revealed not only fonts but also hidden Siemens and Gaggenau logos, and other "funny pictures" embedded within the binaries, suggesting unused or internal testing graphics.
• Home Connect Module Integration: Hajo reverse-engineered the interaction between the BSH Home Connect communication module and the appliance's control module via the DBUS, identifying how the COM module requests parameter tables and individual values.
• Open-Source DBUS Stack: Hajo developed Open DBUS stack, which handles the entire handshake with the Home Connect module, allowing an ESP32 to impersonate a dishwasher and connect to the BSH cloud.
• Cross-Vendor Integration Proof-of-Concept: Leveraging both their research, the speakers demonstrated a novel "Advanced Miele BSH Compatibility Layer (AMC)" (generated by AI), enabling a Miele washing machine to be controlled and monitored via the BSH Home Connect app, showcasing the potential for cross-vendor interoperability once proprietary protocols are understood.

Technical Deep Dive

▶ Watch: Miele's optical interface for diagnostics and calibration (6:00)

The technical depth of the talk was bifurcated, reflecting the distinct approaches taken to reverse engineer Miele and BSH appliances. Both speakers provided intricate details on hardware interaction, protocol analysis, and security bypasses.

Miele Optical Interface and Protocol

Severin's research on Miele devices began with the optical interface, a small, often discreet, bidirectional optical port found on the front panels of Miele appliances. This interface acts as the gateway for diagnostic communication. To safely interact with it, Severin procured a control board from an early 2000s Miele washing machine, whose power electronics were conveniently separate, making it safer to handle. The microcontroller on this board was a Miele-branded chip, identified as a Mitsubishi derivative with an instruction set similar to the 6502. Initial attempts to dump the firmware were thwarted by the presence of a mass ROM, which requires physical deconstruction to access.

Without firmware access, Severin focused on the optical interface's UART communication. Drawing inspiration from Mishozer's Miele@home research, which used 2400 baud, Severin initially tried sending the known five-byte frame structure (command, two parameters, length, checksum) but received no response. After experimenting with UART settings, he discovered that the diagnostic protocol required even parity, a critical detail. With correct settings, the board responded, confirming the protocol structure.

The first command identified was 0x11, which queries the software ID. A subsequent command, 0x20, was observed to "unlock interface," but required specific parameters—the diagnostic key. To discover this key without firmware, Severin employed a timing attack. The Mitsubishi microcontroller featured a sync pin, which goes high whenever the CPU fetches an instruction from its internal ROM. By monitoring this pin with an oscilloscope, Severin could observe minute differences in execution time when a correct parameter was supplied versus an incorrect one. Since the 8-bit parameters are checked sequentially, guessing the first correct byte would alter the subroutine's execution path and thus its timing signature. A Python script systematically iterated through all 256 possible values for each parameter, measuring the sync trace length to identify the correct values, requiring at most 512 iterations for both 8-bit parameters. Once the diagnostic key was found, a second security level was discovered, unlockable by another key, granting full debug capabilities.

The unlocked interface provided commands to read from EPROM and memory. However, newer washing machines exhibited ROM readout protection, where the reading process would halt at the firmware section's starting address. Severin bypassed this in two ways:

1. Custom Dump Subroutine: By halting the firmware execution, writing a small custom dump subroutine into an unused section of RAM, and then instructing the CPU to jump to this subroutine, the memory contents could be streamed out via UART.
2. Protection Disabled Flag: A simpler bypass was discovered in the firmware: a "protection disabled flag" (specifically, setting the first bit of this flag) could be set via a diagnostic command, entirely deactivating the ROM readout protection. This allowed a straightforward memory dump.

With full control, Severin developed FreeMDU, an open-source tool built around an ESP32 microcontroller and an OSRAM optical transceiver, costing less than €10. This tool could find model-specific diagnostic keys via brute-force (taking about 30 minutes) and dump firmware, offering a full suite of diagnostic and control functions via a terminal UI or Home Assistant integration.

BSH DBUS and Protocol

Hajo's investigation into BSH appliances centered on the proprietary DBUS system. Physically identifying DBUS connections was challenging due to a lack of labels. He learned to look for rust connectors with three or four pins, particularly those with identical coding lugs side-by-side on the mainboard, suggesting a bus where connection order doesn't strictly matter. The DBUS wiring typically includes Ground, Data, and Bus Voltage, but the order can be reversed between power boards (Ground, Data, Bus Voltage) and other components like sensors (Bus Voltage, Data, Ground). The bus voltage is 9V in washing machines and 13.5V in dishwashers and dryers, with the data line carrying a 5V signal.

The DBUS operates as a multi-master serial bus at 9600 baud, using standard UART framing. Each frame follows a structure: a length byte, an address byte (upper nibble for target device, lower for subsystem), variable data bytes, and a two-byte checksum. The first two bytes of the data payload form a command word, defining the action. For instance, 0x04 might mean "set temperature," with subsequent arguments specifying the temperature value. Successful frame reception is acknowledged by a single byte containing the destination address in the upper nibble and 0xA (for acknowledgment) in the lower nibble.

Crucially, Hajo discovered subsystem zero. This subsystem behaved uniquely, with commands (F000, F001 for 16-bit addresses; F200, F201 for 32-bit addresses) that were never observed on the live DBUS. Reverse engineering the handler functions for these commands revealed that they allowed direct read and write access to all memory locations on the module directly over the DBUS, effectively bypassing any MCU RDP. This meant that the firmware of any component on the DBUS could be dumped.

Further firmware analysis was aided by the presence of an STLink connector on some BSH power boards, which, combined with the absence of RDP on the MCU, allowed for straightforward firmware dumping and code stepping using OpenOCD. Analyzing the dumped firmware revealed tables that precisely matched observed DBUS commands, mapping them to internal firmware addresses and handler functions. Tools like Bixel view were used for visual inspection of the binaries, revealing not just program fonts but also hidden graphical elements like Siemens and Gaggenau logos and other quirky images.

For home automation, Hajo built an ESP32-based hardware interface, initially using a simple DCDC converter, then evolving to include an open drain level shifter for proper busing. He developed an ESP Home extension for easy integration into Home Assistant, allowing users to define sensors that react to specific DBUS commands and addresses. Finally, to interact with BSH's cloud service, Home Connect, Hajo developed the Open DBUS stack. This stack handles the complex handshake with the Home Connect communication module, allowing an ESP32 to impersonate a BSH appliance, connect to the cloud, and provide remote control and status updates.

Demo / Proof of Concept

▶ Watch: Examining Miele control board and microcontroller architecture (8:00)

The talk culminated in several compelling demonstrations and proofs of concept, showcasing the practical applications of their reverse engineering efforts. These demonstrations spanned from open-source diagnostic tools for Miele to comprehensive home automation for BSH, culminating in a striking cross-vendor integration.

Miele FreeMDU Demonstration

Severin demonstrated the capabilities of FreeMDU using his custom ESP32 optical communication adapter connected to a Miele washing machine. The terminal UI application of FreeMDU provided a comprehensive overview of the appliance's internal state. This included real-time sensor states (e.g., water level, temperature, motor speed), detailed failure information, and the current operating state (e.g., program phase). Beyond mere monitoring, FreeMDU enabled users to trigger actions on the device. Severin showed how one could start various washing programs or set program options. A crucial cautionary note was issued here: the machine does not perform any validation on these options, meaning illogical or potentially damaging combinations (like enabling "water plus" during a "drain" program) are possible.

Further extending the utility, Severin showcased the Home Assistant integration of FreeMDU. With the ESP32 adapter supporting Home Assistant's auto-discovery protocol, the washing machine seamlessly appeared in the smart home dashboard. Users gained access to all operational states and could trigger actions directly from their home automation system, moving beyond the manufacturer's proprietary apps.

BSH Home Automation and Home Connect Integration

Hajo presented his ESP Home extension for BSH appliances, demonstrating how the reverse-engineered DBUS protocol could be leveraged for advanced home automation. By connecting an ESP32 to the DBUS, users could define custom sensors within Home Assistant that react to specific destination addresses and commands on the bus. The demonstration showed how values like the x-axis reading of the unbalanced sensor or the exact drum rotation speed could be pulled in real-time and displayed in Home Assistant, providing diagnostic details normally inaccessible to users. This empowers users to monitor their appliances with unprecedented granularity, potentially detecting issues before they manifest as failures.

The most ambitious proof-of-concept involved the BSH Home Connect cloud service. Hajo's Open DBUS stack successfully handled the complex handshake with the Home Connect communication module. By impersonating a dishwasher via the DBUS, the ESP32 allowed the COM module to connect to the BSH cloud, believing it was communicating with a legitimate BSH appliance. This demonstrated the feasibility of integrating custom hardware into the Home Connect ecosystem without official support.

The Miele-BSH Corporation (Proof-of-Concept)

The crowning achievement of the talk was the "Advanced Miele BSH Compatibility Layer (AMC)" – a humorous yet technically profound demonstration of cross-vendor interoperability. This proof-of-concept combined Severin's FreeMDU protocol library, the AI-generated AMC, Hajo's Open DBUS stack, and a BSH Home Connect communication module. The result was a Miele washing machine appearing and being controllable within the official BSH Home Connect app.

While the app exhibited some limitations (e.g., crashing if "Miele" was sent as the vendor string, or issues with model numbers preventing manual loading), the core functionality was undeniable: a Miele machine's serial number was displayed, and a washing program could be initiated via the BSH app. This "new corporation" of Miele and BSH, albeit an invented one, powerfully illustrated that proprietary barriers can be overcome through reverse engineering, paving the way for a future where smart home devices from different manufacturers could potentially interoperate seamlessly, given sufficient technical understanding.

Defensive Implications

▶ Watch: Difficulty accessing firmware due to Mass ROM (8:50)

The detailed technical findings from hacking Miele and BSH appliances offer crucial defensive implications for both manufacturers and consumers. The vulnerabilities and design choices uncovered highlight areas where security can be significantly enhanced.

For Manufacturers (Miele, BSH, and other appliance makers):

• Implement Robust Authentication and Key Management: The reliance on static, easily discoverable, or model-specific diagnostic keys (e.g., 0x1234, 0x5678 for a BSH dishwasher) or simple challenge-response with static keys (Miele's newer protocol) is a critical weakness. Manufacturers should transition to strong cryptographic authentication protocols, employing dynamic session keys, robust key exchange mechanisms, and secure key storage that is resistant to timing attacks or direct memory reads.
• Strengthen ROM Readout Protection (RDP): The ease with which RDP was bypassed on Miele devices (via a simple flag or custom RAM subroutine) and the complete absence of RDP on some BSH MCUs via STLink connectors are significant security oversights. RDP mechanisms must be properly implemented and enforced at the hardware level, preventing unauthorized firmware extraction and analysis. This includes ensuring that diagnostic commands do not inadvertently provide RDP bypass capabilities.
• Validate Diagnostic Protocol Inputs: The observation that Miele machines perform no validation on program options sent via the diagnostic interface (allowing illogical combinations like "drain program" with "water plus") points to a broader lack of input validation. All commands and parameters sent over diagnostic or internal buses should be rigorously validated to prevent unintended or dangerous operational states, which could lead to physical damage, safety hazards, or denial of service.
• Secure Physical Access Points: While consumer appliances are inherently accessible, manufacturers should consider physical security measures for diagnostic ports. For instance, requiring specialized hardware that is more difficult to replicate than a €10 ESP32 adapter, or physically isolating diagnostic pins from critical control circuitry.
• Conduct Comprehensive Security Audits: The discovery of powerful memory read/write commands via "subsystem zero" on BSH DBUS components underscores the need for thorough security audits of all internal protocols and firmware. Capabilities intended for debugging or manufacturing should be disabled or heavily restricted in production units.
• Adopt Secure Software Development Lifecycle (SSDLC): Integrating security considerations from the design phase, including threat modeling for internal communication buses and diagnostic interfaces, can prevent many of the vulnerabilities identified. This includes regular security testing and penetration testing of embedded firmware.
• Provide Secure Update Mechanisms: As vulnerabilities are inevitably discovered, manufacturers must have robust, secure over-the-air (OTA) update mechanisms to patch firmware remotely and reliably, ensuring the long-term security of their deployed devices.

For Consumers:

• Be Aware of "Smart" Appliance Risks: Understand that "smart" features can introduce new attack surfaces. While convenient, the connectivity of these devices means they are miniature computers in your home, with potential vulnerabilities.
• Network Segmentation for IoT Devices: Isolate smart appliances on a separate VLAN or dedicated IoT network. This limits potential lateral movement within your home network if an appliance is compromised, preventing attackers from reaching more sensitive devices like computers or phones.
• Physical Security Considerations (where practical): While opening a washing machine is not an everyday task, be mindful of who has physical access to your appliances, especially in shared living spaces or rental properties.
• Utilize Open-Source Tools Responsibly: Tools like FreeMDU and Open DBUS stack offer incredible opportunities for home automation and monitoring. However, users should exercise extreme caution when modifying appliance behavior, as unintended consequences (like flooding or overheating) are possible. Always understand the implications of any command sent.
• Demand Transparency and Security from Manufacturers: As consumers, advocating for more transparent protocols, better security practices, and clearer documentation can drive manufacturers to improve the security posture of future appliances.

Key Takeaways

• Household appliances are a significant, underexplored attack surface. Millions of these devices are deployed globally with minimal public security research, leaving a vast landscape of potential vulnerabilities.
• Manufacturers often rely on outdated and insecure diagnostic protocols. Both Miele and BSH utilized simple, easily reverse-engineered protocols with weak or easily bypassed authentication mechanisms, such as static keys or timing-attack vulnerable authentication.
• Physical access often leads to full control and firmware extraction. The talk demonstrated that with physical access to a device, it's possible to bypass ROM readout protections, dump firmware, and gain full debug capabilities, revealing internal logic and potential vulnerabilities.
• Proprietary internal buses can be reverse-engineered for custom home automation. The DBUS system in BSH appliances, initially a black box, was successfully reverse-engineered, enabling granular monitoring and control via open-source home automation platforms like Home Assistant.
• Lack of input validation and robust RDP are common vulnerabilities. The ability to send illogical commands or easily disable firmware protection highlights fundamental security flaws in the design and implementation of these embedded systems.
• Cross-vendor integration, while a proof-of-concept, showcases interoperability potential (and risks). The "Miele-BSH corporation" demo proved that understanding underlying protocols can enable devices from different manufacturers to communicate, hinting at a future of greater smart home interoperability but also underscoring the universal nature of the discovered vulnerabilities.

About the Speaker(s)

Severin von Wnuck-Lipinski is a researcher driven by practical challenges. His journey into the world of appliance hacking began with a real-world problem: a broken Miele washing machine belonging to his parents. This personal motivation led him to dedicate significant time to reverse engineering Miele's proprietary diagnostic protocols and developing the open-source FreeMDU tool. His methodical approach to deciphering the optical interface, implementing timing attacks, and bypassing ROM readout protection showcased his deep expertise in embedded systems and protocol analysis.

Hajo Noerenberg is a fellow researcher who focused his efforts on BSH Group appliances. His research was initially inspired by a patent describing the internal DBUS system, prompting him to unravel its complexities. Despite humbly stating he is "not an electrical engineer," Hajo successfully designed and built multiple hardware iterations to interface with the DBUS, demonstrating remarkable ingenuity. His work culminated in the creation of the Open DBUS stack and extensive integration with Home Assistant. Hajo approaches this complex research as a hobby, doing it "for fun in my spare time," emphasizing his passion for understanding and empowering users with control over their devices.