Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I found a backdoor into my bed

trufflesecurity.com

Post reply on HN
Print view View original

351–360 of 403 posts

Re: I found a backdoor into my bed

#351

Post by neop1x »

OptionOfT wrote: post #342

I got one of those indoor gardening systems. We thought we had an issue with them. Contacted support. Support checked and it was fine. Just needed time to adjust. They mentioned they checked the cameras (!). Later on I got a second used one and while cleaning it, noticed that the internals are just a raspberry pi. Took my micro HDMI and keyboard, and... this thing just runs Raspberry Pi OS. No updates. And ... VNC. P…

That's why I have a separate VLAN and wifi AP for devices I don't trust. And where possible, I use them over LAN only and block their access to the internet on the firewall. That's also why I like zigbee devices and why I am not very happy about Matter and "IP everywhere".

Re: I found a backdoor into my bed

#352

Post by OptionOfT »

Eduard wrote: post #350
OptionOfT wrote: post #342

I got one of those indoor gardening systems. We thought we had an issue with them. Contacted support. Support checked and it was fine. Just needed time to adjust. They mentioned they checked the cameras (!). Later on I got a second used one and while cleaning it, noticed that the internals are just a raspberry pi. Took my micro HDMI and keyboard, and... this thing just runs Raspberry Pi OS. No updates. And ... VNC. P…

which brand and model?

I have a Gardyn 3.0 and 4.0.

They run Raspberry Pi OS with some custom code.

They have live access to the cameras.

Re: I found a backdoor into my bed

#353

Post by paldepind2 »

avalys wrote: post #163
paldepind2 wrote: post #96

Earlier quoted context omitted.

I don't really understand the take here. The post makes it very clear what is concrete evidence, what is speculation based on that, and the reasoning is much better than what you give it credit for. For instance, what would you suggest the "remote-connectivity-api" SSH endpoint URL and the authorized public SSH key is for if not for remotely SSHing into the bed's computer?

This is a Linux image that is, somehow, remotely flashed onto the bed. He found the SSH key on the filesystem. 1. He didn't even bother to check and see if the bed is running an SSH server - ten seconds with nmap could have told him this! 2. Essentially every one of these beds would be behind a NAT and thus the SSH server which he didn't even bother to look for would not be accessible to the internet or to the nefari…

Thanks for expanding! I think your original comment would have made more sense with some of these arguments included. Point 1 is especially prudent. It really would have been trivial to see if the bed is actually running an SSH server on some port.

Re: I found a backdoor into my bed

#354

Post by robertclaus »

Cat food dispensers are an interesting product where this trend hasn't quite landed - it's still easy to get a new model without WiFi for roughly the same price. I wonder if the possibility of your pet not getting fed is a line consumers won't cross for convenience features.

Re: I found a backdoor into my bed

#355

Post by Epa095 »

mihaaly wrote: post #344
OptionOfT wrote: post #342

I got one of those indoor gardening systems. We thought we had an issue with them. Contacted support. Support checked and it was fine. Just needed time to adjust. They mentioned they checked the cameras (!). Later on I got a second used one and while cleaning it, noticed that the internals are just a raspberry pi. Took my micro HDMI and keyboard, and... this thing just runs Raspberry Pi OS. No updates. And ... VNC. P…

I'd love to have a robot vacuum but all I checked last time had wifi connectivity and advanced sensors to build accurate map of our home uploaded to an app of my phone with who knows what capabilities. Some even had camera. All they missed some mic to listen in on us, however since some are connected to Alexa that is a wish fulfilled for many. - Alexa, wipe up that spill in the bedroom. - Sorry, that requires deep cl…

FYI there is https://github.com/Hypfer/Valetudo which acts as a replacement of the cloud service. I'd you buy one of the supported devices you root it to point to the Valetudo server (which you run yourselves). You can then put the robot on its own WiFi without Internet access if you want to be even more secure.

Re: I found a backdoor into my bed

#357

Post by malfist »

OptionOfT wrote: post #342

I got one of those indoor gardening systems. We thought we had an issue with them. Contacted support. Support checked and it was fine. Just needed time to adjust. They mentioned they checked the cameras (!). Later on I got a second used one and while cleaning it, noticed that the internals are just a raspberry pi. Took my micro HDMI and keyboard, and... this thing just runs Raspberry Pi OS. No updates. And ... VNC. P…

Which indoor garden? Was thinking about some but want to make sure to avoid this company

Re: I found a backdoor into my bed

#358

Post by sailfast »

Total aside: it’s illegal for any company to provide goods or services for free to the government, so the Pod CEO would be breaking the law sending DOGE employees bed pods. It’s basically seen as a bribe - which is true! These beds are $2000 each but it’s pretty cheap for favorable regulatory treatment after a small donation. :/

Re: I found a backdoor into my bed

#359

Post by malfist »

10729287 wrote: post #324
croisillon wrote: post #267

Earlier quoted context omitted.

just tried it, that's cool, but in what circumstances "should" i use it?

I find it pretty useful at work when I want to focus and can't with music.

Be careful with that. Research shows that long term extended white noise listening damages hearing and can reduce your ability to process sounds. Don't get into the habit of using it all the time

Re: I found a backdoor into my bed

#360

Post by akerl_ »

circular_logic wrote: post #339
akerl_ wrote: post #252

I’m missing a step here. I see a var called ssh, and an authorized key, but I don’t see where they’re seeing any method for the device to expose itself outside the NAT that’s in place on basically every consumer LAN. This looks a lot more like the device fetches updates via SSH to a remote update server, and the authorized_keys entry is vestigial.

You're right it would be nice to see some more detail. Perhaps it requires sending a custom update when it reaches out via ssh or it does something wild like opening a reverse shell

Evidence of it opening a reverse shell would be wild, and should be possible to spot, if it’s happening, by monitoring what network traffic to that domain looks like.

Beyond that, companies being able to push changes via custom firmware is sort of the normal state of consumer IoT devices. And it doesn’t really imply the kind of broad “the whole engineering team can access my LAN” that the OP is speculating about.

Now, from a design standpoint, using SSH to pull firmware updates would be a bit of a wonky choice. But the world is full of wonky choices.

Post reply on HN