I found a backdoor into my bed • Hacker News Board

Re: I found a backdoor into my bed

#161

Post by lotsofpulp » Fri, Feb 21, 2025, 8:55 PM UTC

rtkwe wrote: post #153

lotsofpulp wrote: post #18

Earlier quoted context omitted.

> TSLA and its board is preferred-stock controlled by Musk. Any source for this? I can’t find anything that says the Musk has enough voting power in Tesla to not need others’ votes: https://www.techopedia.com/largest-tesla-shareholders This is a pretty in depth analysis that shows that Musk needed retail votes for last year’s compensation and re-domiciling votes: https://clsbluesky.law.columbia.edu/2024/07/01/how-tes…

Tesla actually has a 1 share 1 vote right now but it also has super majority voting rules which means Musk's ~22% stake is nearly a veto unless the entire rest of the stockholders vote for a measure he's against. https://www.thestreet.com/investing/stocks/how-elon-musk-con...

That is an Apr 2018 article. Elon has a substantially smaller share now. From first link in above post:

> Elon Musk is the largest individual Tesla shareholder, with 410.79 million shares, representing 12.8% of Tesla ownership as of December 2024.

https://www.secform4.com/insider-trading/1494730.htm

Re: I found a backdoor into my bed

#162

Post by palmotea » Fri, Feb 21, 2025, 8:57 PM UTC

xg15 wrote: post #32

EvanAnderson wrote: post #3

The state of the product's security wasn't unexpected. I was, however, shocked by this part: > I was willing to overlook: > The bed costs $2,000 > It won’t function if the internet goes down > Basic features are behind an additional $19/mo subscription > The bed’s only controls are via mobile app Nothing about this bed should depend on off-site servers. Nothing about the product should necessitate a subscription fee.…

In addition to everything else, also love how a bed with the express purpose to increase sleep quality requires you to open your phone every time you want to adjust a setting.

> In addition to everything else, also love how a bed with the express purpose to increase sleep quality requires you to open your phone every time you want to adjust a setting.

Don't worry, they'll repeat over and over how their product was thoughtfully designed with exquisite craftsmanship by the re-animated corpse of Johnny Ive [1] until people believe it's true.

[1] I know he's not dead.

Also...

> ... Essentially all you need to do is unplug the rubber tubing from the Eight Sleep cover, which is available on eBay for a few hundred bucks, and plug it into a $150 aquarium chiller.

> That’s it. Aquarium chillers are somewhat of a misnomer, as they can also provide heat. They use thermoelectric devices to regulate temperature, either cooling or warming the liquid that flows through them, which is the same technology found in eight sleep.

How much do you want to bet the Eight Sleep is literally an off-the-shelf Chinese Aquarium chiller in a custom case marked up 15x, with a shitily-programmed computer bolted on to enable a $20/month subscription?

Re: I found a backdoor into my bed

#163

Post by avalys » Fri, Feb 21, 2025, 8:59 PM UTC

paldepind2 wrote: post #96

avalys wrote: post #73

This is a bunch of nonsense, assumption and leaping to conclusions without evidence. "In the second screenshot, we have the public key that’s authorized to access the device. The email address attached to the public key, eng@eightsleep.com, to me suggests the private key is likely accessible to the entire engineering team." He has no evidence for this whatsoever and not really any good reason to assume it either. "In…

I don't really understand the take here. The post makes it very clear what is concrete evidence, what is speculation based on that, and the reasoning is much better than what you give it credit for. For instance, what would you suggest the "remote-connectivity-api" SSH endpoint URL and the authorized public SSH key is for if not for remotely SSHing into the bed's computer?

This is a Linux image that is, somehow, remotely flashed onto the bed. He found the SSH key on the filesystem.

1. He didn't even bother to check and see if the bed is running an SSH server - ten seconds with nmap could have told him this!

2. Essentially every one of these beds would be behind a NAT and thus the SSH server which he didn't even bother to look for would not be accessible to the internet or to the nefarious engineers he imagines have access to the key - he ignores this fact.

3. The fact that the firmware includes the URL of a specific external endpoint, suggests that the bed connects _to_ that endpoint, not that this is somehow used to screen incoming requests by reverse DNS lookup or anything like that. The architecture he is supposing exists (all remote access requests must come from a host whose reverse DNS resolves to this host?) makes no sense.

4. The fact that the public key exists on the filesystem means nothing if no SSH server is running, or accessible. It might be used, for instance, as part of the manufacturing test process or a maintenance procedure, and then disabled. The SSH public key on the filesystem isn't necessarily related to the JSON config file for their own application which he found!

5. SSH keys don't have "email addresses" associated with them, they have a plaintext field which is used merely for identification purposes, and this is commonly used for the _user account_ that created the key. But it's not an email address and even if it were, it doesn't mean that that email address, much less every engineer at the company, somehow has access to the key!

The sloppiness and level of jumping to conclusions here, for a supposed security company, is ridiculous.

Re: I found a backdoor into my bed

#164

Post by kevingadd » Fri, Feb 21, 2025, 9:00 PM UTC

JTyQZSnP3cQGa8B wrote: post #140

wedn3sday wrote: post #66

A $20/month bed subscription is objectively hilarious. I cant imagine how this company attracts a non-zero number of clients.

I also wonder what kind of bed costs $2000. Is it a bed made of gold and caviar? This article is confusing.

The baseline for mattresses in the US is upwards of $500 according to Costco. If you want a bigger, higher quality regular mattress you get into the neighborhood of $1000. If you want one made with more exotic materials or you want to throw in something like a boxspring or a frame for a bed that sleeps two, you can approach $2000.

Re: I found a backdoor into my bed

#165

Post by roldie » Fri, Feb 21, 2025, 9:02 PM UTC

electroly wrote: post #86

I'm a two-time Eight Sleep customer and the CEO could post my sleep history specifically with my full name and I'd still use it. It's really comfortable. I think most of the detractors were never remotely in the market for such a product. Everything negative said about the product and the company is true, and they should do better, but it's not enough to scare me away thanks to how good the base product is.

I also have an eight sleep mattress topper. I was unaware of the privacy issues here, but I feel the same as parent that I won't give it up. Having the ability to always have a cool bed has improved my sleep substantially. And the heating is great when you're sick.

Now if a competitor crops up that has better privacy and a better CEO, I'll swap in a heartbeat.

Note: I don't pay for the subscription, just the mattress topper

Re: I found a backdoor into my bed

#166

Post by asdff » Fri, Feb 21, 2025, 9:02 PM UTC

EvanAnderson wrote: post #3

The state of the product's security wasn't unexpected. I was, however, shocked by this part: > I was willing to overlook: > The bed costs $2,000 > It won’t function if the internet goes down > Basic features are behind an additional $19/mo subscription > The bed’s only controls are via mobile app Nothing about this bed should depend on off-site servers. Nothing about the product should necessitate a subscription fee.…

>The market is clearly too stupid to vote against the rent seeking tech industry. It makes me so sad.

It is a $2000 dollar internet connected bed. The market in this case is probably people who could wipe their ass with that $20 every day and not miss it. I don't think they are stupid. This class of Americans has always been about paying for ongoing service instead of being pragmatic or doing things themselves. "Let the help over in bangladesh fiddle with the connectivity and updating the mobile app for me, while I merely rest my head and make plenty of money," they probably figure, at least subconsciously.

Re: I found a backdoor into my bed

#167

Post by LoganDark » Fri, Feb 21, 2025, 9:02 PM UTC

hangonhn wrote: post #28

dsalzman wrote: post #7

Using the aquarium chillers is really smart! Just need someone to mfg the mattress membrane covers.

I didn't realize they've come down so much in price. Another really useful application would be to hook it up to pads used to ice joints post joint surgery. I was sold a $100+ dollar medical device which was basically a water pump in a cooler chest (like one of those Polar ones) that circulated water through some pads. I had to refill it every hour or so with ice. This is right after a knee surgery so caring the cool…

you know those "VR backpacks"? imagine... knee chiller backpack

Re: I found a backdoor into my bed

#168

Post by KPGv2 » Fri, Feb 21, 2025, 9:02 PM UTC

hinkley wrote: post #55

xg15 wrote: post #32

Earlier quoted context omitted.

In addition to everything else, also love how a bed with the express purpose to increase sleep quality requires you to open your phone every time you want to adjust a setting.

I’m still fairly upset that ambient devices never really took off. Nanoleaf at least made a remote like this. It’s a dodecahedron with an accelerometer, so you can program each face with a different setting. The simplest being to program opposing faces for two different light levels. You want to take a nap, turn the controller upside down.

There was a cool device I saw once, used for timing your work. You'd program the faces for different tasks (bug fixes, new features, etc.) and whatever you worked on, you'd have that face up, and when you changed tasks, you'd turn it to something else, and it would track how you spent your time.

Re: I found a backdoor into my bed

#169

Post by DarmokJalad1701 » Fri, Feb 21, 2025, 9:03 PM UTC

I have one of these bed covers. I bought it before the subscription crap started and I am very satisfied with the product. The dual-zone cooling/heating is super good and has been a big improvement to my quality of life/sleep. Especially considering that my wife has different ideas than me about temperature and what constitutes hot/cold. Yes, it would be nice if I had local control but I am willing to ignore that as long as I don't have to pay more.

But I wouldn't recommend anyone buy it now because of the subscription.

It is good to know that there is an option to continue using it if the company decided to no longer grandfather in people who bought before the subscription crap started.

Re: I found a backdoor into my bed

#170

Post by mohaine » Fri, Feb 21, 2025, 9:05 PM UTC

xg15 wrote: post #32

EvanAnderson wrote: post #3

The state of the product's security wasn't unexpected. I was, however, shocked by this part: > I was willing to overlook: > The bed costs $2,000 > It won’t function if the internet goes down > Basic features are behind an additional $19/mo subscription > The bed’s only controls are via mobile app Nothing about this bed should depend on off-site servers. Nothing about the product should necessitate a subscription fee.…

In addition to everything else, also love how a bed with the express purpose to increase sleep quality requires you to open your phone every time you want to adjust a setting.

And not true, at least for the newest version. V4 has touch sensors for adjusting the temps on the side of the mattress.

I do own of these and while I hate the price, the subscription, the fact that it didn't work for an hour last night due to the internet being down (first time ever really) but there really isn't a better option. I love the temp control and would use anyone else if they had a valid competitor, but sadly there isn't one (or at least wasn't when I bought mine). The alternative is to not have temp control which is pretty amazing.