How to hack your … espresso machine

Digital rights management has been used to prevent everything from iTunes music being played on non-Apple devices to no-name cartridges working in your printer. Now plucky hackers have even managed to crack the DRM system on ... espresso - the Keurig 2.0 pod-based espresso machines, to be precise.

Pod-based coffee systems work on a razor-blade model: sell the machine itself at a low price, or even a loss, and reap the profits on expensive, branded coffee pods. But just like with actual razors, consumers soon realised they could save money by buying no-brand coffee - or simply refilling used pods. And so, to keep the margins up, coffee manufacturers turned to DRM systems to stop customers being naughty.

In a triumph for fans of cheap coffee, there is not a great deal of crossover between making delicious caffeinated drinks and complex security protocols, so the coffee DRM is a bit crap. As the how-to video at KeurigHack.com shows, the protection can be circumvented simply by cutting the lid off a pre-used pod and taping it to the sensor on the machine.

As Kenneth Buckler’s tongue-in-cheek disclosure of the machine’s “vulnerability” on the Seclists security mailing list explains, “Keurig 2.0 Coffee Maker contains a vulnerability in which the authenticity of coffee pods, known as K-Cups, uses weak verification methods, which are subject to a spoofing attack through re-use of a previously verified K-Cup.

“Since no fix is currently available, owners of Keurig 2.0 systems may wish to take additional steps to secure the device, such as keeping the device in a locked cabinet, or using a cable lock to prevent the device from being plugged in when not being used by an authorised user.”

Yet easily bypassing the machine’s restrictions may not be the end of the story. Where DRM differs from previous attempts by manufacturers to control how their products are used is the legal protections against attempts to bypass it. In the pre-digital world, there were only patents stopping competitors from selling compatible items, and patents expire.

Today, laws such as the US digital millennium copyright act make bypassing DRM mechanisms an offence, even if what they are preventing you from doing – such as watching movies on another company’s tablet, or selling coffee pods that work in another manufacturer’s machines – is perfectly legal.

But do perk up: we won’t tell the coffee police if you won’t.