Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to get root access to your Sleep Number bed

dillan.org

Post reply on HN
Print view View original

71–80 of 254 posts

Re: How to get root access to your Sleep Number bed

#71

Post by fragmede »

peteforde wrote: post #28

Funny part to me is that I fully assumed that this was a post about hacking Eight Sleep beds by someone who didn't want to explicitly name the company, presumably for vague legal reasons. Then I got to a picture of an apparently real "Number Sleep Hub" and my mind was blown. WTF are we in a timeline so weird that there are two companies making water cooled beds, one is called Eight Sleep and the other is Sleep Number…

It turns out naming things is an unsolved problem outside of computer science as well.

Re: How to get root access to your Sleep Number bed

#73

Post by itake »

thfuran wrote: post #32
itake wrote: post #10

Earlier quoted context omitted.

what would be a better way to design this that is cheap and updatable? Specialized hardware is riskier to build, b/c bugs would require a complete reprint.

Why would I want so much software in my bed that even makes sense to discuss updating it?

Updating the domain name the server talks to, updating the security system (like supporting new versions of TLS, updating certificates, etc).

TBH, I wouldn't trust a custom hardware chip that can decrypt the traffic and have it last for the life of the product.

Re: How to get root access to your Sleep Number bed

#74

Post by itake »

dmitrygr wrote: post #11
itake wrote: post #10

Earlier quoted context omitted.

what would be a better way to design this that is cheap and updatable? Specialized hardware is riskier to build, b/c bugs would require a complete reprint.

NOTHING in a bed needs to be updatable. Nothing. It needs a PIC12F509 to run a motor when you press a button and check for a jam.

How do you ensure the network traffic is encrypted with a PIC12F509?

Re: How to get root access to your Sleep Number bed

#75

Post by hpen »

jojobas wrote: post #26
hpen wrote: post #15

Earlier quoted context omitted.

[flagged]

Embedded linux is everywhere. Making the initial connection (connect to BED23234 wifi and do xyz on a web page) requires more than a microcontroller. There's no point trying to save a few bucks on such a ridiculously expensive item.

Embedded linux is everywhere. But arguing that's a reason to use it, or not a reason to use a microcontroller / SOC is wild. Each has tradeoffs.

Re: How to get root access to your Sleep Number bed

#76

Post by itake »

hpen wrote: post #15
itake wrote: post #9

Earlier quoted context omitted.

how else would you record and transmit measurements to a server? lower-level hardware and software is expensive to develop on and potentially be difficult to update.

[flagged]

I actually have an undergrad electrical engineering degree and a 3month internship creating embedded hardware for the military.

Even back then (2008-201?), it was common for companies to use Windows CE on IOT devices

Re: How to get root access to your Sleep Number bed

#77

Post by dmitrygr »

itake wrote: post #74
dmitrygr wrote: post #11

Earlier quoted context omitted.

NOTHING in a bed needs to be updatable. Nothing. It needs a PIC12F509 to run a motor when you press a button and check for a jam.

How do you ensure the network traffic is encrypted with a PIC12F509?

Correct. Beds should have no network or traffic.

Re: How to get root access to your Sleep Number bed

#80

Post by Larrikin »

hackernewds wrote: post #17
NewsaHackO wrote: post #13

Earlier quoted context omitted.

Yea, that part is insane. At this point it is safe to say that any non open source device that has access to you home network and the Internet can function as a backdoor. Not to be a conspiracy theorist, but I guarantee the CIA has a list of common devices with this feature that they can use to get local access in most houses.

This is what makes me suspicious about Chinese home products like govee and how cheap they are. You're required to hard code in your SSID and Wi-Fi password. And they consistently beg for your location, despite having no need for it.

Up until very recently all products wanting to use Bluetooth LE required the location permission because BLE beacons and similar can and we're used for location triangulation. It was a marketed feature of beacons that they could track your position down to the aisle in a store and potentially advertise to you if you walked past specific stores. There's finally a separate permission for it but it can still be used to determine your location.
Post reply on HN