Follow Slashdot blog updates by subscribing to our blog RSS feed

 



Forgot your password?
typodupeerror
Check out the new SourceForge HTML5 internet speed test! No Flash necessary and runs on all devices. ×
DRM

Keurig 2.0 Genuine K-Cup Spoofing Vulnerability 270

An anonymous reader writes A security researcher has released a humorous vulnerability description for the Keurig 2.0 coffee maker, which includes DRM designed to only brew Keurig brand coffe pods (K-Cups): "Keurig 2.0 Coffee Maker contains a vulnerability in which the authenticity of coffee pods, known as K-Cups, uses weak verification methods, which are subject to a spoofing attack through re-use of a previously verified K-Cup." The vulnerability description even includes mitigating controls, such as keeping the Keurig in a locked cabinet when not in use. Also at Hackaday.
This discussion has been archived. No new comments can be posted.

Keurig 2.0 Genuine K-Cup Spoofing Vulnerability

Comments Filter:
  • Holy Fuck! (Score:5, Funny)

    by d33tah ( 2722297 ) on Thursday December 11, 2014 @02:54PM (#48575363)
    Holy fuck! These pirated K-Cups are going to hurt the whole industry!
  • Nesspresso! (Score:5, Funny)

    by TechyImmigrant ( 175943 ) on Thursday December 11, 2014 @02:55PM (#48575379) Homepage Journal

    I demand additional ineffective security procedures for my Nespresso machine. I'm completely ineffectively unprotected.

  • by Russ1642 ( 1087959 ) on Thursday December 11, 2014 @02:57PM (#48575393)

    I know someone who keeps a genuine k-cup lid around and just sets it on top of the off-brand cup every time he uses his machine.

  • by pla ( 258480 ) on Thursday December 11, 2014 @02:57PM (#48575401) Journal
    Why in the hell would anybody buy a coffee maker that uses DRM to prevent using "non-genuine" coffee?
    • Because K-Cups have a great range of coffee, and are available almost anywhere?

      • You are confusing K-Cups with these K-Cup 2.0 pods. K-Cups are what have a great range and are available anywhere - because they have no DRM and all patents were worked around. K-Cup 2.0 pods have a very horrible range and limited distribution. I feel sorry for anyone suckered into buying one of these newer brewers.

        • I have the Vue system. This is apparently an ugly redheaded stepchild (like Windows ME, or Windows XP x64 Edition) that came between the "original" Keurig, and Keurig "2.0". It lacks any form of DRM, and there are $10 plastic adapters on eBay that allow you to brew any original K-Cup pack using the Vue. I tried it and it works fine.

          The features of the machine are much better than the original Keurig: larger water tank, touchscreen with customizable temperature and water amount, it heats up and brews faster,

          • Yeah, the only thing that got me off Win2k was DRM.

            The games I wanted to play had DRM that the crypto API in Win2k didn't support.

            "Upgraded" to Vista. Was I ever bitten.

      • by Creepy ( 93888 )

        That doesn't equate to great tasting coffees, though they are better than most (if not all) of the canned stuff.

        And I'm far less of a snob with coffee than with beer - I will actually drink Keurig or canned coffee but I need to add cream. For black I prefer beans roasted 5 days or less before use and burr ground, with grind type as per the style of coffee (Turkish, espresso, french press, drip). Yes, home roasted. Unlike beer, home roasting has saved me a fortune after the initial expense, too ($~130 for 20

      • So before Keurig came along, coffee was limited to only a handful of flavors and was difficult to find? And Keurig solved this problem, but no other coffee maker has, so the best solution is to buy a consumer-screwing machine?

    • To get the Keurig Genuine Advantage, obviously.
    • by TWX ( 665546 )
      Because the ability to make a single serving of exactly the coffee one wants and to then have someone else do the exact same thing for their particular tastes is worth something.

      US Airways private lounges have these things. Friends of mine have one. Honestly, if there wasn't DRM, I'd be tempted to get one for work, so that I don't have to brew a lot of coffee when I only want one cup.
      • Because the ability to make a single serving of exactly the coffee one wants and to then have someone else do the exact same thing for their particular tastes is worth something.

        US Airways private lounges have these things. Friends of mine have one. Honestly, if there wasn't DRM, I'd be tempted to get one for work, so that I don't have to brew a lot of coffee when I only want one cup.

        There are many other brands of brewers that make single serving coffee and none of them force you to use any particular brand of cup.

        • by gstoddart ( 321705 ) on Thursday December 11, 2014 @03:43PM (#48575847) Homepage

          There are many other brands of brewers that make single serving coffee and none of them force you to use any particular brand of cup.

          So, on the off beat chance you don't know this ...

          Most of those single serving cups are, in fact, the k-cup form factor. The patents for those expired several years ago, and everybody could make compatible stuff. Because, really, it's a little plastic tub with coffee in it and it isn't rocket science. You can buy them anywhere, and find lots of makers which support them.

          Now ... this is the new hotness. The K-cup 2.0, with DRM.

          So, all of those brands of brewers and cups you could buy? You still can. Nothing about those has changed. Your older Keurig machine? Nothing has changed with that either.

          But, if you end up buying a newer Keurig machine ... suddenly you get DRM, specifically because it's the razor blade business model, and Keurig has decided you must buy from them.

          • from your description it sounds like Keurig has always been DRM'd. their previous form was the patent, but since that expired they had to go with an electronic form.

          • Because, really, it's a little plastic tub with coffee in it and it isn't rocket science.

            I'd argue that a 'k-cup' would be hard to patent due to having an obvious nature. The trick would be that the machine is patented, which is why 'everybody' could make k-cup compatible tubs, but not the machines. Well, a google search shows those patents have likely expired as well, I'm seeing lots of compatible machines.

            Really, you'd just have to change the machine enough to avoid Keurig's patents. How? Depends on how the patents were written.

          • Razor-blade model? You think those $100+ coffeemakers Keurig sells cost even $25 to make?

            It's just greed. Really. Honestly.

          • by AmiMoJo ( 196126 ) *

            There needs to be a warning on the box of devices that come with anti-consumer DRM installed. Like the warnings on boxes of cigarettes. Something unmissable. It's only fair to make sure consumers aware of what they are buying and that it is unlikely to work properly.

      • by rsborg ( 111459 )

        Because the ability to make a single serving of exactly the coffee one wants and to then have someone else do the exact same thing for their particular tastes is worth something.

        US Airways private lounges have these things. Friends of mine have one. Honestly, if there wasn't DRM, I'd be tempted to get one for work, so that I don't have to brew a lot of coffee when I only want one cup.

        Go cold brew - the coffee lasts weeks in the fridge, and doesn't cause me to get jittery nearly as much. Lastly, I don't have to cold-brew myself - it's easily available in large quantities at a store (TJs) so, like UHT milk, I can buy weeks of supply at a time and even buy online.

    • by harrkev ( 623093 )

      My wife loves the convenience of instant coffee. I wanted to stick with a regular drip maker, but she did not like the mess involved in cleaning it up nor how long it took to make a pot. I don't like the expense and the waste of K-Cups, but the wife always wins in these sort of disagreements.

      I must admit that the new Keurig makers are nicer than the old ones as they seem to have changed the pumping mechanism. That was always a weak spot with the old ones, especially if you had non-optimal water. Well wa

      • Have you complained to Keurig directly about the "genuine K-Cups" that will not function and asked for replacements? The only way to prevent this sort of crap is to raise a stink about it. Also consider returning the coffee maker and gving it a negative review on Amazon. Seriously, why are you putting up with this quietly?

    • Nobody wants DRM. The companies impose it on us to prevent unauthorized use.

      I think for a coffee maker. The fact that they are trying to say which coffee you can and can't use is really stupid. Unless they show that ripoff k-cups somehow harm the system.

      I know with Solid Ink Printers. You really need to use the branded ink. The cheap third party stuff has a slightly differing heating and cooling rate. Where over time they gum up the internals and you have a printer with solid ink stalagmites and stalac

      • by sconeu ( 64226 )

        Unless they show that ripoff k-cups somehow harm the system.

        So what if it harms the f***ing system? I BOUGHT it. It's MINE. If I want to harm the system, that's my choice.

        This is a "Fords will only use Ford Brand gas" thing. I wonder if they can be sued under Magnusson-Moss?

    • Yeah, that's as bad as my Keurig toaster. I found out it was a problem when they stopped selling the individual bread cartridges.

  • K-Cups? (Score:5, Funny)

    by Anonymous Coward on Thursday December 11, 2014 @03:07PM (#48575515)
    I can only imagine how expensive that must be. The last pair of double-D's set me back a fortune before it was all said and done. Although, they were nice.
  • This smacks of IBM and the PS/2. Long after they lost control of the market they created, they attempted to force their own propeitary expansion bus and other architecture on everyone. The end result is that the market took from them the few bits they liked and shoved them aside like yesterday's trash.

    With so many alternatives out there, why on earth would anyone buy this idiotic machine that attempts to force you to use their cups yet fails miserably at doing do?

  • by eepok ( 545733 ) on Thursday December 11, 2014 @03:11PM (#48575563) Homepage

    Keurig coffee, with all their DRM, just adds to our waste-plastic problem and costs about twice as much as coffee you grind at home. (http://goo.gl/NiVJ8D)

    Get yourself a stainless steel cup, throw some coffee in there, and use the pilfered K-Cup tag to make it all work together.

  • by Sir_Eptishous ( 873977 ) on Thursday December 11, 2014 @03:11PM (#48575567) Homepage
    Internet of Things.

    Where all manner of previously easy to use appliances and household goods come with phone-home DRM for "added value".
  • I now forgive you in perpetuity for Bennett Haselton and Dicevertisements...

    ...until Keurig breaks my coffee again.

  • Sounds like the HP and IBM law suits over printer cartridge lock-in.

    This is *exactly* the kind of thing that the DMCA was made to prevent! Tape is a circumvention device and should be banned! (Since there was recently an article here about how the DMCA is being abused, so I'm itching for them to issue a DMCA takedown against this article so I can add it to the list of reasons to repeal the DMCA).

  • Workaround (Score:5, Funny)

    by Ol Olsoc ( 1175323 ) on Thursday December 11, 2014 @03:21PM (#48575669)
    Easy to follow steps:

    1. Go to your favorite sore that carries coffee makers

    2. Purchase a drip, french press or percolator, or whatever type I missed as per your wishes.

    3. Buy some coffee at the same store. This may come as a shock to many people, but there is a large variety of typs of coffees out there. Different grinds, or grind your own - it is amazing I tell you, must be something new. Keurig is not the only company out there. I'm partial to a brand roasted in Philly, that I purchase from of all places, a diner in Rio Grande, New Jersey. But I digress.

    Brew your own fucking coffee the way we used to do it when men were men, and the sheep knew to be respectful. Enjoy it on the patio, yelling at kids to get off the lawn.

    • by Sneftel ( 15416 )

      The "way we used to do it when men were men" was to roast one serving worth of beans in a skillet, grind them with a mortar and pestle, steep the grounds in water, and then strain the coffee through muslin or cheesecloth. Also you have to heat the water over a wood-burning stove. Anything less means I get to look down on you.

  • by davidwr ( 791652 ) on Thursday December 11, 2014 @03:24PM (#48575699) Homepage Journal

    A malicious attacker could substitute toxic fake coffee or hot chocolate for the real thing.

    A malicious attacker could also substitute a coffee or hot chocolate that is tainted with a chemical that creates slight etchings in the surface of the coffee cup or other cup used to hold the end product. For certain types of cups, the result will be a cup that will be more likely to harbor bacterial growth than one with a smooth surface. Assuming a successful attack, the risk of illness or fatality is low for a healthy adult but it might be significant for a person with a suppressed or compromised immune system.

    Recommended mitigation:
    Keep people who want to kill you away from your coffee maker.

  • Ever have a group of people over who would like some coffee? So now instead of starting a pot, then going back when it's finished, and pouring it for people, if you need ten cups of coffee, you gotta do it ten times over.

    How

    Fucking

    Handy.

    And so cool that the last people get their cup long after the first are done, or more likely if the guests have manners, the first will wait ahile their coffee gets cold.

    In a world where people become lazier ever day, it's hard to imagine how such a waste of tim

    • If you have so many friends over, You're doing it wrong.

      The obvious solution is to have as many Keurig coffee makers as you have visitors.

    • I'm not a Keurig fan by any stretch. I use a french press at home. But you seem to lack any sort of creative imagination. Here's the alternate story.

      Ever have a group of people over who would like some coffee? Sow now instead of each person getting to brew the coffee variety of flavor or decaf level that they would like in an individual cup, you have to brew many full or partial full pots of coffee so people can be happy. Or you just say screw you to your guests and make them drink the fully caffeinated sup

  • In all seriousness, research the cost differences between traditional coffee makers and coffee vs the Keurig.
  • by ArcadeMan ( 2766669 ) on Thursday December 11, 2014 @03:54PM (#48575965)

    Tassimo [tassimo.com]
    Nespresso [nespresso.com]

  • by Tokolosh ( 1256448 ) on Thursday December 11, 2014 @04:28PM (#48576275)

    For infringing DMCA, wire fraud, computer fraud and abuse, circumvention and dissemination of DRM, racketeering, leading to losses of [pinkie] One Billion Dollars [/pinkie] to Keurig.

    Stand by for completely over-the-top reaction from the Establishment.

  • by Anonymous Coward on Thursday December 11, 2014 @04:33PM (#48576335)

    The way demonstrated in the video is a pretty ugly way to fix the problem, you have to constantly put your fake lid on top of the cup you make. Towards the back left side of the piece that lowers down there's some kind of small optical sensor that looks for the keurig border that's only on keurig cups -- if you peel the label off one you can cut out a small piece of just the border and tape it directly under the sensor -- you just have to make sure it's lined up the way it expects and you'll never have to futz with an extra lid again. Some quick scissor work and a piece of scotch tape and it's been going strong for probably around 2 months now.

  • by Luciano Moretti ( 2887109 ) on Thursday December 11, 2014 @04:50PM (#48576521)

    Freedom Clip: Clips onto your Keurig over the DRM sensor hole so you don't have to mess with extra foil.

    https://www.gourmet-coffee.com... [gourmet-coffee.com]

  • by OrangeTide ( 124937 ) on Thursday December 11, 2014 @05:01PM (#48576637) Homepage Journal

    I've had better coffee from a coffee percolator than from a K-Cup. It's simpler too, if you have one with a mesh screen you don't need filters and easily rinses out if you don't leave the coffee in it all day. Else you can scrub it out with a long handled brush when it starts smelling like old coffee. (for me the percolator coffee seems to do the best job at high altitude, start boiling at about 92C for me)

    Since K-Cup's can't make espresso (not enough enough pressure), no need to compare it to a proper espresso machine. It's simply an elaborate drip coffee maker. A $30 Mr. Coffee from Costco will also make a fine drip coffee. You can use expensive unbleached compostable paper filters if you want, they're still a few percent of what each K-Cup costs.

    My compost pile loves used coffee grounds.

Trying to be happy is like trying to build a machine for which the only specification is that it should run noiselessly.

Working...