There was a time when a coffee vending machine was a relatively straightforward affair, with a basic microcontroller doing not much more than the mechanical sequencer it replaced. A modern machine by contrast has 21st century computing power, with touch screens, a full-fat operating system, and a touch screen interface. At Hackaday Supercon 2023, [Kuba Tyszko] shared his adventures in the world of coffee, after reverse engineering a couple of high-end dispensing machines. Sadly he doesn’t reveal the manufacturer, but we’re sure readers will be able to fill in the gaps.
Under the hood is a PC running a Linux distro from a CF card. Surprisingly the distros in question were Slax and Lubuntu, and could quite easily be investigated. The coffee machine software was a Java app, which seems to us strangely appropriate, and it communicated to the coffee machine hardware via a serial port. It’s a tale of relatively straightforward PC reverse engineering, during which he found that the machine isn’t a coffee spy as its only communication with its mothership is an XML status report.
In a way what seems almost surprising is how relatively straightforward and ordinary this machine is. We’re used to quirky embedded platforms with everything far more locked down than this. Meanwhile if hacking vending machines is your thing, you can find a few previous stories on the topic.
“The coffee machine software was a Java app, which seems to us strangely appropriate” I see what you did here
The most fascinating thing about coffee vending machines is that the brown fluid that comes out can still be legally called “coffee”, even in countries with a rich coffee tradition like Austria or Italy.
There is no reason for these “coffee” vending machines to exist in places were getting actually GOOD coffee is a thing.
My company has a few of these. Are they networked for any reason? If so, I may be making a call to our cyber security department to have some tools installed.
The ones in gas stations with whole-bean hoppers on top have an LTE connection. They download the hopper config and firmware updates, and upload metrics.
If they’re serviced by an outside company, then I wouldn’t be surprised if they have a similar setup. Having a machine make its own service call seems like an ante to play, now.
We have one at work. I took the opportunity when it was open for replenishment to look around a bit. “Yes” to the networking (cellular) and very programmable. Coffee is not bad, it’s a drip/filter arrangement, fresh ground from beans, with a roll of filter medium which does double duty to transport the used grounds to the waste hopper. The only thing unpleasant about it is the powedered “milk”. Ours was made by a Canadian company and there were details including a servide manual on the web. We did not check to see if the service password had been changed from the default.
The ones I played with had wifi and ethernet, I strongly recommend intercepting the packets and taking a peek at what they do. In my case it was simply reporting status, but there IS possibility of expanded service where the machine might contact a remote server reporting on ingredient levels or even more…
“I WANT TEA!”
-Arthur Dent
“touch screens, a full-fat operating system, and a touch screen interface.”
Touch screens *and* a touch screen interface‽ They’ve gone too far.
I’m a bit worried about excess fat in my diet, including my beverages.
Slax Linux
Man that’s a name I haven’t seen in some time. It was like 230MB ISO back when I played around with it in ~2009 or so. It always crashed after like 30 minutes of running for some reason, no idea why.
The link to previous stories on the topic is incorrect.
At minute 4 of the video, the manufacturer is visible:
https://cafection.com/
(well the link to a subdomain therof)
https://cafection.com/our-products/
And here’s the product page, the machine in the talk seems to be the Total 1.
Haha Java I cant. As a coffee aficionado I was able to figure out which brands they were. This is how you mix different interest together