Hacking a smart toothbrush #Hacking #ReverseEngineering

After buying a new Philips Sonicare toothbrush, Cyrill Künzi was surprised to see that it reacts to the insertion of a brush head by blinking an LED. A quick online search reveals that the head communicates with the toothbrush handle to remind you when it’s time to buy a new one.

Looking at the base of the head shows that it contains an antenna and a tiny black box that is presumably an IC. The next hint can be found in the manual where it says that: “Radio Equipment in this product operates at 13.56 MHz”, which would indicate that it is an NFC tag. And indeed when holding the brush head to my phone it opens a link to a product page: https://www.usa.philips.com/c-m-pe/toothbrush-heads.

Cyrill dives deep to decode the NRF tag, find it’s password to unlock writing to the data & more. Read the rest here.