Earlier quoted context omitted.
[flagged]
[flagged]
[flagged]
How to get root access to your Sleep Number bed
81–90 of 254 posts
Re: How to get root access to your Sleep Number bed
#82Wait, this is about an actual bed -- you know, the kind that you sleep on -- that runs an SSH server on Linux ? W. T. F. !?
You think that's bad, you should see Eight Sleep.
Not only do they run an SSH server on their embedded Linux device but the entire Linux component is unnecessary. All it really does as far as I can tell is act as a bridge between an STM32 and a process long-polling AWS for commands. They could have achieved the same thing with less cost and complexity with an ESP32.
Also bad: they engineered it maliciously, making it completely and unnecessarily dependent on the cloud. All the sensor data is streaming in real time to the cloud and the only way to send it commands is through AWS.
If a Chinese company did this, the company would be cancelled.
In fact I'll be shocked if their product isn't blown out of the water in a couple of years by a Chinese copy that can function entirely offline and despite that massive disadvantage, can implement advanced features that Eight Sleep charges $200/yr for, like an alarm clock.
Thankfully their nonsense resulted in it being pretty easy to hack. There's a GitHub project to replace parts of the firmware.
Re: How to get root access to your Sleep Number bed
#83Earlier quoted context omitted.
[flagged]
I actually have an undergrad electrical engineering degree and a 3month internship creating embedded hardware for the military. Even back then (2008-201?), it was common for companies to use Windows CE on IOT devices
Good for you! I hope your internship was paid! But seriously an internship is a toy job my dude
Re: How to get root access to your Sleep Number bed
#84Earlier quoted context omitted.
I actually have an undergrad electrical engineering degree and a 3month internship creating embedded hardware for the military. Even back then (2008-201?), it was common for companies to use Windows CE on IOT devices
Good for you! I hope your internship was paid! But seriously an internship is a toy job my dude
But really I’m not arguing Linux doesn’t make sense in some embedded applications ( I have an embedded product with Linux in it)
Re: How to get root access to your Sleep Number bed
#85Earlier quoted context omitted.
I don't need my bed to transmit measurements to a server . I need my bed to be comfortable to sleep on. I need exactly zero interactions with a server for that. So, yeah, back to the question. Why does my bed have an SSH server? Because it needs to be able to talk to some machine on the internet. And why does my bed need that? It's a bed. [Edit: Wait a minute. Even if I do want to transmit measurements, why is my bed…
> Why does my bed have an SSH server? because you bought it. sitting across the show room floor or one of the other pics on the sales website were other beds that did not have these features. instead, you let the sales person push you into a sale of a product you weren't happy with or you did not pay attention to the product listing. or your spouse bought it. none of these says anything positive about your situation…
> did not pay attention to the product listing
Since when has a consumer product listing mentioned an SSH server backdoor?
Re: How to get root access to your Sleep Number bed
#86Earlier quoted context omitted.
That's a fair argument, but it doesn't appear that that updates are high on sleep number's priority list: > The hub includes Python 2.7.18. While extremely old (keep in mind the Hub appears to have been last updated in 2018) If we give them the benefit of the doubt, perhaps they intended to to keep it up to date but ultimately compaines need to either be transparent about their remote access and manage it responsibly…
> Python 2.7.18 I am not defending them for not keeping their stuff up-to-date, but it is very common practice for embedded systems to be hopelessly outdated. I've done what OP describes with IPMI/BMC systems for $mainboardmanufacturer1 and $mainboardmanufacturer2 (both really big name brands), and their BMC systems were equally outdated. It was almost comical, but really sad at the same time. Moral of the story is t…
I know I'm preaching to the choir, but I do prefer not having to treat my bed as a hostile device on my network
Re: How to get root access to your Sleep Number bed
#87Funny part to me is that I fully assumed that this was a post about hacking Eight Sleep beds by someone who didn't want to explicitly name the company, presumably for vague legal reasons. Then I got to a picture of an apparently real "Number Sleep Hub" and my mind was blown. WTF are we in a timeline so weird that there are two companies making water cooled beds, one is called Eight Sleep and the other is Sleep Number…
You assume it's a funny coincidence, I'd say Eight Sleep picked a name that as a easy to confuse with Sleep Number as they could without getting immediately sued.
Re: How to get root access to your Sleep Number bed
#88Earlier quoted context omitted.
some of the newer WiFi setups have an IoT subnet that works like a guest network. Worth using if your gear has it.
For those who know their stuff, setting up a dedicated VLAN for IoT and putting devices in it based on MAC addresses (allow or disallow lists) is a solid option as well and fun to learn.
I have a separate IOT vlan, but ensuring things like AirPlay work correctly is really, really, really annoying.
Re: How to get root access to your Sleep Number bed
#89Earlier quoted context omitted.
How do you ensure the network traffic is encrypted with a PIC12F509?
Correct. Beds should have no network or traffic.
how do you analyze your sleeping quality and habits over time? a built in display?
This reminds of the 2005: "phones shouldn't support texting. people should just call" vibes.
Re: How to get root access to your Sleep Number bed
#90Earlier quoted context omitted.
Correct. Beds should have no network or traffic.
how do you analyze your sleeping quality and habits over time? a built in display? This reminds of the 2005: "phones shouldn't support texting. people should just call" vibes.
At most a BLE chip to send data to your phone in a way that doesn’t touch the internet