Did hackers use 3 million electric toothbrushes for DDoS attack? No, it never happened

It is possible to take over smart devices but requires sophisticated technology and resources to carry out such large-scale Distributed Denial of Service (DDoS) attacks on websites.

Last week, a Swiss news agency Aargauer Zeitung reported that hackers took control of more than three million electric smart toothbrushes to wage a Distributed Denial of Service (DDoS) attack on an unnamed Switzerland-based company.

Several major Western media outlets picked it up and made it viral worldwide. However, many failed to cross-verify technology aspects of how can cyber criminals take control of an electric brush that cannot even independently connect to the internet.

The truth is that Aargauer Zeitung's reporter misunderstood the Fortinet researcher's statement on the hypothetical possibility of bad actors taking control of smart brushes with Javascript-based malware code to make them bots and be used for DDoS.

It missed the part about how they turned electric brushes into rogue bots. For that to happen, the threat actors have to even hack the companion smartphone linked to an electric brush to initiate DDoS. This missing link was not reported and yet other other reputed publishers went ahead sharing the story on the web.

For the uninitiated, Distributed Denial of Service (DDoS) is a network attack where threat actors force systems or in this case, botnets to send requests to access a web server. If the latter doesn't have the bandwidth to serve all (in millions) requests, the system will crash and become inaccessible. The attackers' main goal is to make service outage and unaccessible for general subscribers. And, the company will face public humiliation and has the potential to lower its value in the share market too.

In late 2023, Google Cloud suffered one such major DDoS attack. But, managed to recover faster and offer access to its services to the clients. Even others such as Amazon Web Service (AWS), and Cloudflare have faced it in the past.

In response to the viral story, Fortinet issued a clarification to the Bleeping Computer blog that the translation issues caused the narrative on this DDoS attack topic to get stretched to the point where hypothetical and actual scenarios got blurred.

Get the latest news on new launches, gadget reviews, apps, cybersecurity, and more on personal technology only on DH Tech.