Your questions, answered by Cybernews: Can your vape be hacked?

Screening Windows, playing Doom, hosting a website, or orchestrating a cyberattack. What else can be done with your vape? Each week, our team selects one pressing and common reader issue and deconstructs it to help you stay safe online.

Vaping isn’t just a health gamble anymore. What began as simple nicotine dispensers now come with screens, Bluetooth syncing, apps that track your habits, and the ability to answer phone calls from the same device that heats chemicals inches from your face.

And whenever a gadget gets smart, someone on the internet tries to break it. Even the simplest disposable vapes with LCD screens showing battery levels could be potentially hackable.

While enthusiasts tear down circuit boards and hackers probe firmware for fun, the question persists – what could be done with your vape?

Can a vape be exploited in a cyber attack?

From a cybersecurity perspective, any gadget is a potential tool for attack, though that alone does not make every device inherently dangerous or practical for exploitation.

The Cybernews research team notes that some disposable vapes blur the line between throwaway electronics and microcomputers.

“Quite a few disposable vapes could be used the same way as Raspberry Pi’s are used for simple automation or hosting simple applications,” they explained.

“Essentially, everything that could be done with a microcomputer, could be done to a certain extent with some of the disposable vapes that have appeared on the market.”

Vapes could also be used in social engineering attacks. In theory, a modified vape could function as a USB Rubber-Ducky device and deliver a malicious payload.

“Ask someone to charge your vape from their phone or computer and execute malicious payloads,” said researchers.

Beyond social engineering, the researchers describe how such devices could be repurposed as covert computing devices. With sufficient modification, these devices can be equipped with additional sensors or communication modules, such as external WiFi or Bluetooth chips, effectively transforming a vape into a pocket-sized scanning tool.

Vapes could be theoretically exploited for a practice known as wardriving. This entails moving through physical locations while passively mapping and indexing nearby WiFi networks, including their names, signal strength, and security settings.

Traditionally done with laptops or smartphones, wardriving could theoretically be performed by a modified vape small enough to go unnoticed. Similarly, added Bluetooth hardware could automate the detection of vulnerable nearby devices. Also, as the size of the vape format is also quite forgiving, it might allow to include large batteries, additional devices or something more sinister like explosives that could be remotely detonated.

However, our team is careful to stress proportionality. Researchers remind that such scenarios require significant technical skill and customization.

“Using a random vape you found in such ways requires quite a lot of time, expertise in reverse engineering, and hardware hacking. A lot of the mentioned things could be done more easily with other hardware,” they said

What else can you do on a vape? Like, play Doom?

Electronics enthusiast have been going crazy with modifying vapes. Hobbyist Jason Gin as a playful proof of concept replaced the vape’s default iconson a 80×160 pixel display with a Windows 95 theme.

Another electronics hobbyist, Bogdan Ionescu, demonstrated that the tiny microcontroller inside a disposable vape can be repurposed as a fully functioning web server – a project he calls VapeServer, where he used the vape’s “guts” to host a basic website.

Initial performance was extremely slow, but after optimization, the system achieved about 20ms ping times and page loads in roughly 160ms.

A hardware hacker, Aaron Christophel, tried to run the classic game Doom on the vape, turning a $30 vape into one of the world’s smallest displays for the 1993 shooter. He enabled the tiny 1.5-inch screen to act as a secondary monitor, streaming Doom gameplay at around six frames per second.

According to the hobbyist, so far, it is impossible to run Doom natively on a vape, because the vape comes with 64KB of RAM. The initial DOS version of Doom was aimed at a system with about 4 MB of RAM and a 386 CPU.

Is it worth it hacking your vape? At least it does not end up in a landfill

Redditors have been discussing way more innocent hacks for a simple disposable vape with an LCD screen.

One user wanted to jailbreak their vape so they could upload custom backgrounds and animations. In most models, the USB port is power only, with no data lines connected, meaning there’s no easy plug-and-play way to inject new graphics.

However, according to Redditors, it is technically possible for users with more advanced microelectronics skills.

“Is it worth it? Depends on how curious you are about reverse engineering and tinkering,” said one commentator.

Others pointed out that disposable vapes add to the e-waste problem, and repurposing them is meaningful. Americans discard nearly 500,000 vapes daily. The new toxic habit is becoming a real e-waste problem, with hazardous metals, plastics, and lithium batteries ending up in landfills.

“Personally, I hope they ban them or mandate that if you're buying them, they have a return fee attached, which you can get back if you return it for recycling,” raged one Redditor.

Others who’ve claimed to have cracked open modern vapes argued that the hardware is shockingly overbuilt for something designed to be tossed away. One user summarized it:

“They’re surprisingly packed with goodies. ARM processor and a rechargeable lithium. [..] It looks like they took super cheap phones and repurposed them to show pretty pictures so that you get just a wee bit more dopamine from your hit.”

Unlock more exclusive Cybernews content on YouTube.