Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I found a backdoor into my bed

trufflesecurity.com

Post reply on HN
Print view View original

181–190 of 403 posts

Re: I found a backdoor into my bed

#181

Post by nicoburns »

asdff wrote: post #166
EvanAnderson wrote: post #3

The state of the product's security wasn't unexpected. I was, however, shocked by this part: > I was willing to overlook: > The bed costs $2,000 > It won’t function if the internet goes down > Basic features are behind an additional $19/mo subscription > The bed’s only controls are via mobile app Nothing about this bed should depend on off-site servers. Nothing about the product should necessitate a subscription fee.…

>The market is clearly too stupid to vote against the rent seeking tech industry. It makes me so sad. It is a $2000 dollar internet connected bed. The market in this case is probably people who could wipe their ass with that $20 every day and not miss it. I don't think they are stupid. This class of Americans has always been about paying for ongoing service instead of being pragmatic or doing things themselves. "Let…

One might argue that the market itself becomes "stupid" (stops accurately indicating value) when people have so much money that they stop caring about how they spend it.

Re: I found a backdoor into my bed

#182

Post by lilyball »

Nothing here is particularly surprising. The worries about engineers ssh'ing into the machine to see if anyone is sleeping seems rather overblown though. The product itself doubles as a sleep tracker and all data goes through their servers (as is sadly the norm for smart home appliances these days) so they have that data anyway. I have to take it on faith that they anonymize and aggregate the data before doing any analysis on it, but the very nature of the product means they have the data.

Re: I found a backdoor into my bed

#183

Post by geodel »

balls187 wrote: post #13
dralley wrote: post #11

Earlier quoted context omitted.

The market deserves some blame here.

My partner has difficulty sleep unless it is the perfect environment (black out curtains, noise cancellation, sound bath, temperature), and is more prone to the effects of a single bad nights sleep. For people like her, $20/mo + $2000 fee is a small price to pay for a solution to a very difficult problem. I would of course, attempt to veto unnecessary IoT devices and subscriptions for usage, but this would be a fight…

I think there is some naming convention gap here. I would call it Sleep Equipment as we have exercise equipments. Then folks will find pricing more reasonable. There is further opportunity to differentiate market with Sleep, Sleep Pro and Sleep Enterprise products.

The pro and enterprise version would allow local server setup for critical sleep equipment functioning and can manage all beds in a household or hotel etc . It can update the version of software or data models when its online and new features are available on cloud server.

I surmise at 300 dollar/month for pro version could be really attractive proposition. Of course local server setup and maintenance can be charged separately.

Re: I found a backdoor into my bed

#185

Post by nicoburns »

moolcool wrote: post #31
EvanAnderson wrote: post #3

The state of the product's security wasn't unexpected. I was, however, shocked by this part: > I was willing to overlook: > The bed costs $2,000 > It won’t function if the internet goes down > Basic features are behind an additional $19/mo subscription > The bed’s only controls are via mobile app Nothing about this bed should depend on off-site servers. Nothing about the product should necessitate a subscription fee.…

I wonder if there'd be a cottage industry for new control boards which de-shittify IOT devices but keep their functionality. Like buy the bed, and then buy a little pre-programmed ESP32 logic board to replace the factory board.

I think this would need to be enabled by regulation that forced the original manufacturers to make their products open. Hopefully we'll get that eventually.

Re: I found a backdoor into my bed

#186

Post by uoaei »

nicoburns wrote: post #181
asdff wrote: post #166

Earlier quoted context omitted.

>The market is clearly too stupid to vote against the rent seeking tech industry. It makes me so sad. It is a $2000 dollar internet connected bed. The market in this case is probably people who could wipe their ass with that $20 every day and not miss it. I don't think they are stupid. This class of Americans has always been about paying for ongoing service instead of being pragmatic or doing things themselves. "Let…

One might argue that the market itself becomes "stupid" (stops accurately indicating value) when people have so much money that they stop caring about how they spend it.

Exactly, it indicates profoundly inefficient dynamics. That money could be put to use far more productively.

Re: I found a backdoor into my bed

#187

Post by perching_aix »

avalys wrote: post #172
perching_aix wrote: post #171

Earlier quoted context omitted.

> He has no evidence for this whatsoever and not really any good reason to assume it either. I'm not sure what kind of evidence or reason you're looking for, I think their assumption is pretty sensible. > This isn't how SSH works Maybe I'm just naive, but the wording of it to me seems nontechnical enough that I think the author is skipping over things on purpose. For example, how exactly that "far way" host he thinks…

Please see my reply to another person in this same thread. He didn't even verify that the bed is running an SSH server in the first place!

I saw it. It's not necessary if the process that maintains the reverse connection can just start it as needed.

That said, some actual investigation of that supposed binary would have been a strong support for this whole thing, and indeed an evidence for this theory, so I will give you that.

Re: I found a backdoor into my bed

#190

Post by BobaFloutist »

hinkley wrote: post #55
xg15 wrote: post #32

Earlier quoted context omitted.

In addition to everything else, also love how a bed with the express purpose to increase sleep quality requires you to open your phone every time you want to adjust a setting.

I’m still fairly upset that ambient devices never really took off. Nanoleaf at least made a remote like this. It’s a dodecahedron with an accelerometer, so you can program each face with a different setting. The simplest being to program opposing faces for two different light levels. You want to take a nap, turn the controller upside down.

That sounds cool, but I'm a little resistant to being asked to remember to charge my lightswitch.
Post reply on HN