Live data from Hacker News

I found a backdoor into my bed

trufflesecurity.com

331–340 of 403 posts

Re: I found a backdoor into my bed

#331
post #138

Earlier quoted context omitted.

*subjectively. Once you realize just how important quality sleep is, and how much this can help, $20/month bed subscription becomes a laughably small price to pay.

Do you have the same reasoning with cigarettes? $10 every day is a small price to pay to avoid having to stop smoking.

Cigarettes is a consumable resources, as for any resources like that it has fifferen justification as you cant produce it.

The subscription for bed is not, it locks artificially features to pay monthly. Even more, it collecs data to improve the product (which sounds good) - but you need to pay for this. They have an ability to run model locally - they choose to not.

I like Topaz approach: you have an ability over some time (subscription period) to have up to date model that will help you recognise snoring etc, then if you choose not to pay - you stick with this model, but it still works.

Subscription in addition is something that limits an ability to sell it in the future.

Re: I found a backdoor into my bed

#332
post #317

The state of the product's security wasn't unexpected. I was, however, shocked by this part: > I was willing to overlook: > The bed costs $2,000 > It won’t function if the internet goes down > Basic features are behind an additional $19/mo subscription > The bed’s only controls are via mobile app Nothing about this bed should depend on off-site servers. Nothing about the product should necessitate a subscription fee.…

I know someone who signed agreeement about delivering an app and then providing fixes for free. He escaped the country. Market is not stupid, market learned nothing is free.

Why leave the country?

Re: I found a backdoor into my bed

#334
post #320

Actual title: "Removing Jeff Bezos from my bed"

Editing of titles on HN is annoying; I maintain this Tampermonkey script to mark moderated titles and show the original one: https://raw.githubusercontent.com/bambax/hntitles/refs/heads...

[dead]

Re: I found a backdoor into my bed

#335
post #295

Earlier quoted context omitted.

For the price of a white noise machine you can buy a 10A squirrel cage blower, some mdf to make a box out of, a contactor, and a smart plug and have a white noise machine that filters your air, turns on and off from your phone, and also makes white noise. It can also act as a table to put your phone on and a charge point. I had the two problems of poor sleep without white noise and a dog allergy and now I have neithe…

Throw a high-grade air filter over the intake and you’ve got an air purifier, too!

The possibilities are endless. Using some parts of a fridge and a kitchen maker and you can also add an ice cream maker ! Never stop imagining!

Re: I found a backdoor into my bed

#336

The state of the product's security wasn't unexpected. I was, however, shocked by this part: > I was willing to overlook: > The bed costs $2,000 > It won’t function if the internet goes down > Basic features are behind an additional $19/mo subscription > The bed’s only controls are via mobile app Nothing about this bed should depend on off-site servers. Nothing about the product should necessitate a subscription fee.…

> Nothing about this bed should depend on off-site servers. Nothing about the product should necessitate a subscription fee.

I'll play the Devil's Advocate here. If this product isn't controlled by a remote server, it either needs to be controlled by a local bit of hardware (i.e. with its own screen and hardware input devices) or by your phone. Considering the upper-class target market (high-priced luxury product), the "local bit of hardware" option is a bad call. If it's controlled by your phone, then it would presumably happen over Bluetooth, which is both (a) unreliable and (b) would disconnect if you don't have your phone in your bedroom, which if you're willing to spend $2k on a cover for better sleep, you've probably already tried.

The industry went in the direction of direct-to-Internet connections for home devices because, quite frankly, it's the lowest-friction approach for most home users. Everything else is a distraction from a great product experience for 99% of the market.

With all that said... bundling in hard-coded AWS IAM keys (for Kinesis Data Streams) and hard-coded SSH public keys is just bad engineering. You can't revoke an abusive customer without revoking everyone, and you can't fire any employees without updating every customer end device. Sleep Eight needed to set up IAM Roles Anywhere with a private CA where a user's initial setup gets the private CA to issue a cert for the base unit in the user's name, which is then used to get temporary credentials through AWS STS to write to Kinesis. Similar story with SSH, if it's actually genuinely needed for some reason, set up a private CA, in both cases, with certificate revocation lists. They're unlikely to sell enough beds (remember: luxury product) or fire enough employees for CRLs not to scale well on this solution.

Re: I found a backdoor into my bed

#337

Earlier quoted context omitted.

My room mate had one of these and I found out there was a script online someone put together on github I think to control it over a shell. Was hilarious because I kept turning off their light at weird times.

Yikes, does the hub have some kind of unauthenticated http server exposed to the LAN? Yet another reason I run open source software rather than buying the proprietary hubs.

I kind of remember just connecting to the MAC of the lightbulb itself by finding it on my routers table and then plugging in the info to his script. You could change colors too by passing little JSON strings. Maybe things are different now as this was in maybe 2018ish

Re: I found a backdoor into my bed

#339
post #252

I’m missing a step here. I see a var called ssh, and an authorized key, but I don’t see where they’re seeing any method for the device to expose itself outside the NAT that’s in place on basically every consumer LAN. This looks a lot more like the device fetches updates via SSH to a remote update server, and the authorized_keys entry is vestigial.

You're right it would be nice to see some more detail. Perhaps it requires sending a custom update when it reaches out via ssh or it does something wild like opening a reverse shell

Re: I found a backdoor into my bed

#340

> For someone who suffers from insomnia this seemed worth a shot. I can relate, having suffered the same for most of my life. One thing that really helped me was a simple white noise machine, typically used to help babies sleep. Good: I sleep great with it. Also, it's not connected to the internet and doesn't require an app. Bad: I basically can't sleep without it. I have to travel with it (camping!). I even purchase…

If you’d rather not buy another gizmo for a function your phone has likely gobbled up already… iOS, iPadOS, and macOS have a pretty great built-in background-noise generator these days. While lots of actual beaches can go dead silent and then have a loud wave crash in, the waves that It’s available in Settings -> Accessibility -> Audio & Visual -> Background Sounds. You’ll have to download the sounds each once, but a…

[deleted]
Post reply on HN