(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
| Dyson Supersonic Hair Dryer (HD08)
|
|
Security Grade
Calculator v
|
Dyson Supersonic Hair Dryer (HD08)
Release Date: 2021-01-01 • Status: In sale
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
Rare
|
🔗 Proof
|
Hardware disassembly and modification are uncommon. Sealed casing makes tampering difficult and voids the official warranty.
|
| Known vulnerabilities
|
None
|
🔗 Proof
|
No public CVEs specifically targeting the HD08 Supersonic hair dryer have been disclosed.
|
| Prior attacks
|
None
|
🔗 Proof
|
No documented real-world public attacks against this HD08 hair dryer model.
|
| Updatability
|
Rare
|
🔗 Proof
|
Firmware updates can only be delivered through the MyDyson mobile app; updates are infrequent and limited to functional fixes.
|
| Category Score
|
Score: 2 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
Partial
|
🔗 Proof
|
BLE pairing with MyDyson App uses simple device association; it supports device registration to Dyson cloud without strong mutual certificate authentication.
|
| Communications
|
Encrypted with up-to-date encryption
|
🔗 Proof
|
BLE communication between the dryer and MyDyson App uses standard modern BLE encryption for device registration and diagnostic data.
|
| Storage
|
No encryption
|
🔗 Proof
|
The device does not store persistent user data locally. No local encrypted user data storage on the dryer.
|
| Category Score
|
Score: 2 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Basic
|
🔗 Proof
|
Account management is handled in the MyDyson mobile app and Dyson cloud, not on the hair dryer hardware.
|
| Authentication
|
Basic
|
🔗 Proof
|
User login and identity verification happen on the companion app/cloud. The dryer itself has no local login authentication.
|
| Brute-force protection
|
Absent
|
🔗 Proof
|
BLE pairing interface of the dryer has no rate limiting or brute force lockout mechanism.
|
| Event logging
|
Absent
|
🔗 Proof
|
The dryer does not keep local security audit logs or access event logs. Only basic diagnostic data may be sent to cloud via app.
|
| Passwords
|
Default/Common/Easy to guess
|
🔗 Proof
|
The hair dryer hardware itself does not store or require passwords. Credentials belong to the user’s MyDyson cloud account.
|
| Category Score
|
Score: 3 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
Proprietary embedded firmware (Companion App: MyDyson App)
|
| Hardware (CPU / GPU)
|
CPU: Proprietary low-power MCU • GPU: None
|
| Memory & Storage
|
Memory: On-chip MCU RAM (not publicly disclosed) • Storage: On-chip flash for firmware
|
| Power, Battery & Charging
|
Battery: None (mains-powered) • Power: 1600W, AC mains power • Charging: Not applicable, wired power supply
|
| Display & Camera
|
Display: No built-in display • Camera: None
|
| Sound & Connectivity
|
Sound: None • Connectivity: Bluetooth Low Energy (BLE) for MyDyson App pairing & registration
|
| Physical (Dimensions & Mass)
|
Dimensions: 245 × 97 × 78 mm • Mass: 680 g
|
This is a mains-powered connected smart hair dryer running closed proprietary embedded firmware. It supports BLE connection with the official MyDyson App for device registration and rare firmware updates. It has no internal battery, no local display, and no on-device user authentication. Its attack surface is limited to BLE radio. No local user data is persistently stored on the hardware.
