Hardware Hacker Breaks the DRM On a Mini Dishwasher

Developer dekuNukem has detailed a methodology for refilling the DRM-protected detergent cassettes for a $486 portable dishwasher called Bob. Gizmodo reports: Bob is basically a small dishwasher that sits on your counter. It holds half a dozen dishes and some silverware, and you add water to the system by hand. It looks like a great alternative to a larger installed dishwasher or something nice for an apartment dweller. But it has a secret bit of DRM built in that keeps you wedded to the company's products. The Bob uses cassettes, called Rock and Pop (LOL!), that contain concentrated detergent and rinse liquids. The cassettes are similar to inkjet cartridges in that they store a small amount of information on a built-in chip -- in this case, a simple I2C EEPROM that can store a small amount of information. This chip stores the number of washes and will "cancel" a cassette when it's technically empty. The machine will then order new cassettes automatically. To Bob's credit, you can use your own detergent, but it isn't easy. And the cassettes aren't cheap.

"With shipping and VAT added, it costs a whopping $60 for 90 washes! That is 48p (67c) per wash. It might not sound like much, but it quickly adds up," wrote dekuNukem. "Over a year of daily washes, it would have cost $242 in Bob cassettes alone! Imagine paying that much recurring cost for a dishwasher!"

Using an EEPROM reader, they were able to pull the data from the cassette and even modify it, resulting in a simple system to reset the cartridges back to their original wash counts or, in one case, forcing the cassette to run about 70 more washes than originally advertised. Once dekuNukem figured out the coding mechanism, they had to figure out a way to refill the cassettes. They searched the internet for concentrated detergent offerings and found one that matched the website description exactly. "Refilling it yourself is more than 60 times cheaper, resulting in a massive 98% cost saving compared to buying new!" they wrote. The plans are available on dekuNukem's Github. You can also purchase the Cassette Rewinder, a pre-soldered board that will automatically reset the cassette EEPROM, for $29.99.

Read more of this story at Slashdot.

nmap -sV --script vuln -p- <target-network>

tail -f /var/log/suricata/fast.log | grep <cve>

Check Vendor Security Advisory Bulletin

title: Detect Exploitation - Hardware Hacker Breaks the DRM On a Mini Dishwasher
id: af534e8b-271c-45fb-a2fb-b5571ecac64e
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-25
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access

rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-25"
        description = "YARA Signature for "
    strings:
        $str = "Hardware Hacker Breaks the DRM" ascii wide
    condition:
        any of them
}

index=security sourcetype IN ("cisco:asa", "pan:traffic", "zeek_conn", "suricata", "WinEventLog:Security")
("Hardware Hacker Breaks the DRM On a Mini")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, dest_ip, dest_host, signature
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count

message: "*Hardware Hacker Breaks the DRM On a Mini*"

CommonSecurityLog
| where Message has "Hardware Hacker Breaks the DRM On a Mini"
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort, Activity
| extend DetectionRule = "iShareStuff-CTI-Compiled"
| sort by EventCount desc