Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to get root access to your Sleep Number bed

dillan.org

Post reply on HN
Print view View original

11–20 of 254 posts

Re: How to get root access to your Sleep Number bed

#11

Post by dmitrygr »

itake wrote: post #10
dmitrygr wrote: post #2

Why does a bed need to run Linux? Why? Of all the possible timelines, we live in the dumbest. What was wrong with a plain old bed without 1GB of RAM and a full OS running on it?! It is the same everywhere. Finding a washing machine that was not WiFi-connected was a chore and I dread doing it again in ten years. As a person who's broken into O(1000) "smart" devices (for fun and for profit both), I do not want them in…

what would be a better way to design this that is cheap and updatable? Specialized hardware is riskier to build, b/c bugs would require a complete reprint.

NOTHING in a bed needs to be updatable. Nothing. It needs a PIC12F509 to run a motor when you press a button and check for a jam.

Re: How to get root access to your Sleep Number bed

#12

Post by sodality2 »

dmitrygr wrote: post #2

Why does a bed need to run Linux? Why? Of all the possible timelines, we live in the dumbest. What was wrong with a plain old bed without 1GB of RAM and a full OS running on it?! It is the same everywhere. Finding a washing machine that was not WiFi-connected was a chore and I dread doing it again in ten years. As a person who's broken into O(1000) "smart" devices (for fun and for profit both), I do not want them in…

Sounds like the problem isn't Linux, it's insecure development practices. As mentioned in sibling comment, Linux development is far easier to hire for, iterate on, develop updating mechanisms for, etc - specialized embedded development is less popular.

Re: How to get root access to your Sleep Number bed

#13

Post by NewsaHackO »

teddyh wrote: post #4

Buried lede: “What I did find was a "convenient" backdoor that Sleep Number can use to SSH back into the hub (and my internal home network as a result).”

Yea, that part is insane. At this point it is safe to say that any non open source device that has access to you home network and the Internet can function as a backdoor. Not to be a conspiracy theorist, but I guarantee the CIA has a list of common devices with this feature that they can use to get local access in most houses.

Re: How to get root access to your Sleep Number bed

#14

Post by BadHumans »

NewsaHackO wrote: post #13
teddyh wrote: post #4

Buried lede: “What I did find was a "convenient" backdoor that Sleep Number can use to SSH back into the hub (and my internal home network as a result).”

Yea, that part is insane. At this point it is safe to say that any non open source device that has access to you home network and the Internet can function as a backdoor. Not to be a conspiracy theorist, but I guarantee the CIA has a list of common devices with this feature that they can use to get local access in most houses.

Why are you assuming that only non open source devices are vulnerable? We've seen enough open source vulnerabilities in broad daylight to know that open source does not mean secure.

Re: How to get root access to your Sleep Number bed

#15

Post by hpen »

itake wrote: post #9
cs702 wrote: post #5

Wait, this is about an actual bed -- you know, the kind that you sleep on -- that runs an SSH server on Linux ? W. T. F. !?

how else would you record and transmit measurements to a server? lower-level hardware and software is expensive to develop on and potentially be difficult to update.

[flagged]

Re: How to get root access to your Sleep Number bed

#16

Post by pxx »

annoyingnoob wrote: post #8
dmitrygr wrote: post #2

Why does a bed need to run Linux? Why? Of all the possible timelines, we live in the dumbest. What was wrong with a plain old bed without 1GB of RAM and a full OS running on it?! It is the same everywhere. Finding a washing machine that was not WiFi-connected was a chore and I dread doing it again in ten years. As a person who's broken into O(1000) "smart" devices (for fun and for profit both), I do not want them in…

https://imgur.com/6wbgy2L "The most recent piece of technology I own is a printer from 2004 and I keep a loaded gun ready to shoot it if it ever makes an unexpected noise."

[flagged]

Re: How to get root access to your Sleep Number bed

#17

Post by hackernewds »

NewsaHackO wrote: post #13
teddyh wrote: post #4

Buried lede: “What I did find was a "convenient" backdoor that Sleep Number can use to SSH back into the hub (and my internal home network as a result).”

Yea, that part is insane. At this point it is safe to say that any non open source device that has access to you home network and the Internet can function as a backdoor. Not to be a conspiracy theorist, but I guarantee the CIA has a list of common devices with this feature that they can use to get local access in most houses.

This is what makes me suspicious about Chinese home products like govee and how cheap they are.

You're required to hard code in your SSID and Wi-Fi password. And they consistently beg for your location, despite having no need for it.

Re: How to get root access to your Sleep Number bed

#18

Post by hiddencost »

BadHumans wrote: post #14
NewsaHackO wrote: post #13

Earlier quoted context omitted.

Yea, that part is insane. At this point it is safe to say that any non open source device that has access to you home network and the Internet can function as a backdoor. Not to be a conspiracy theorist, but I guarantee the CIA has a list of common devices with this feature that they can use to get local access in most houses.

Why are you assuming that only non open source devices are vulnerable? We've seen enough open source vulnerabilities in broad daylight to know that open source does not mean secure.

Open source is auditable, and tends to get fixed.

Re: How to get root access to your Sleep Number bed

#19

Post by daniel_reetz »

hackernewds wrote: post #17
NewsaHackO wrote: post #13

Earlier quoted context omitted.

Yea, that part is insane. At this point it is safe to say that any non open source device that has access to you home network and the Internet can function as a backdoor. Not to be a conspiracy theorist, but I guarantee the CIA has a list of common devices with this feature that they can use to get local access in most houses.

This is what makes me suspicious about Chinese home products like govee and how cheap they are. You're required to hard code in your SSID and Wi-Fi password. And they consistently beg for your location, despite having no need for it.

Now think about 3D printers like the Bambu. A machine tool that can self-combust.

Re: How to get root access to your Sleep Number bed

#20

Post by hpen »

itake wrote: post #9
cs702 wrote: post #5

Wait, this is about an actual bed -- you know, the kind that you sleep on -- that runs an SSH server on Linux ? W. T. F. !?

how else would you record and transmit measurements to a server? lower-level hardware and software is expensive to develop on and potentially be difficult to update.

How about just don't run SSH?
Post reply on HN