Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I found a backdoor into my bed

trufflesecurity.com

Post reply on HN
Print view View original

371–380 of 403 posts

Re: I found a backdoor into my bed

#371

Post by rolph »

mihaaly wrote: post #344
OptionOfT wrote: post #342

I got one of those indoor gardening systems. We thought we had an issue with them. Contacted support. Support checked and it was fine. Just needed time to adjust. They mentioned they checked the cameras (!). Later on I got a second used one and while cleaning it, noticed that the internals are just a raspberry pi. Took my micro HDMI and keyboard, and... this thing just runs Raspberry Pi OS. No updates. And ... VNC. P…

I'd love to have a robot vacuum but all I checked last time had wifi connectivity and advanced sensors to build accurate map of our home uploaded to an app of my phone with who knows what capabilities. Some even had camera. All they missed some mic to listen in on us, however since some are connected to Alexa that is a wish fulfilled for many. - Alexa, wipe up that spill in the bedroom. - Sorry, that requires deep cl…

how many of these end up being used for dirty purposes rather than cleaning purposes. not just accidental bathroom pix, but blatant porn.

Re: I found a backdoor into my bed

#372

Post by rolph »

catlikesshrimp wrote: post #254
jimt1234 wrote: post #223

> For someone who suffers from insomnia this seemed worth a shot. I can relate, having suffered the same for most of my life. One thing that really helped me was a simple white noise machine, typically used to help babies sleep. Good: I sleep great with it. Also, it's not connected to the internet and doesn't require an app. Bad: I basically can't sleep without it. I have to travel with it (camping!). I even purchase…

I approached this the brutish way: I downloaded hours of white noise as a sound file (mp3) and just use VLC to play it. Any smartphone - no internet. I used wireless headphones back then. My choice of "white noise" was popcorn in a microwave (because the neighborhood was that noisy)

you may find these interesting:

https://www.analog.com/en/resources/design-notes/building-a-...

https://circuitdigest.com/electronic-circuits/simple-white-n...

https://circuit-ideas.com/simple-white-noise-generator-circu...

Re: I found a backdoor into my bed

#373

Post by aranelsurion »

> Imagine your ex works for Eight Sleep. Or imagine they want to know when you’re not home.

I think what is often missed in "company gathers data it doesn't need" scenarios is not that someone inside Eight Sleep abuses the data, or the company itself does it, but them gathering this data for years and then losing it to some 14yo hacker who promptly posts it and suddenly all your data is public.

The inside job may sound a little far fetched, but the latter is only a matter of time.

Once it happens multiple times with different services, everyone gets access to everything about you.

Re: I found a backdoor into my bed

#374

Post by DonHopkins »

TheSpiceIsLife wrote: post #149
mrWiz wrote: post #115

Earlier quoted context omitted.

I've got a cube that's hooked into my Home Assistant setup that works similarly. Flipping the cube upside down turns my bedside light on or off, rotating it clockwise increases the brightness, and counterclockwise decreases it.

And if a guest comes round and messes it, the lights dim, blood runs down the walls, nails come out of your head, and the furniture starts moving.

NO NO NO NO NO! Not the wed wun. Don't EVER push the wed wun!

https://www.youtube.com/watch?v=q_IE_0-Xlis

Re: I found a backdoor into my bed

#375

Post by HNdev1995 »

nadis wrote: post #2

"When I say backdoor, what am I referring to? Sure, Eight Sleep needs a way to push updates, provide service, and offer support. That’s expected. What goes too far in my opinion, is allowing all of Eight Sleep’s engineers to remotely SSH into every customer’s bed and run arbitrary code that bypasses all forms of formal code review process. And yes, I found evidence that this is exactly what’s happening." ^ wow, this…

I agree with you but please explain how this is any different than when an app on your phone gets updated

Re: I found a backdoor into my bed

#376

Post by mihaaly »

Epa095 wrote: post #355
mihaaly wrote: post #344

Earlier quoted context omitted.

I'd love to have a robot vacuum but all I checked last time had wifi connectivity and advanced sensors to build accurate map of our home uploaded to an app of my phone with who knows what capabilities. Some even had camera. All they missed some mic to listen in on us, however since some are connected to Alexa that is a wish fulfilled for many. - Alexa, wipe up that spill in the bedroom. - Sorry, that requires deep cl…

FYI there is https://github.com/Hypfer/Valetudo which acts as a replacement of the cloud service. I'd you buy one of the supported devices you root it to point to the Valetudo server (which you run yourselves). You can then put the robot on its own WiFi without Internet access if you want to be even more secure.

Thanks for the tip.

But I am just a user and this is just a vacuum. I rather focus on other than jumping hoops for the products of the indecent manufactureres. While saving a lot of money as bonus. I think I will cope without it.

Re: I found a backdoor into my bed

#377

Post by physicles »

HNdev1995 wrote: post #375
nadis wrote: post #2

"When I say backdoor, what am I referring to? Sure, Eight Sleep needs a way to push updates, provide service, and offer support. That’s expected. What goes too far in my opinion, is allowing all of Eight Sleep’s engineers to remotely SSH into every customer’s bed and run arbitrary code that bypasses all forms of formal code review process. And yes, I found evidence that this is exactly what’s happening." ^ wow, this…

I agree with you but please explain how this is any different than when an app on your phone gets updated

It’s completely different.

Could a rogue engineer inject whatever code they want into an app update? Possibly yes, but 1) that code will get shipped to every phone at the same time, 2) that code has to do its thing without anyone noticing, which is tricky at scale (this is how malware gets discovered), and 3) there’s an audit trail so that engineer will be exposed to legal risk.

The difference here is that with Eight Sleep, an engineer can remotely access the customer device in real time and poke around the network the bed is connected to, and there may be no audit logs. They can exfiltrate sensitive data with much less effort and less legal risk than with an app update.

Re: I found a backdoor into my bed

#378

Post by genewitch »

Epa095 wrote: post #355
mihaaly wrote: post #344

Earlier quoted context omitted.

I'd love to have a robot vacuum but all I checked last time had wifi connectivity and advanced sensors to build accurate map of our home uploaded to an app of my phone with who knows what capabilities. Some even had camera. All they missed some mic to listen in on us, however since some are connected to Alexa that is a wish fulfilled for many. - Alexa, wipe up that spill in the bedroom. - Sorry, that requires deep cl…

FYI there is https://github.com/Hypfer/Valetudo which acts as a replacement of the cloud service. I'd you buy one of the supported devices you root it to point to the Valetudo server (which you run yourselves). You can then put the robot on its own WiFi without Internet access if you want to be even more secure.

no need to root it if you have a decent "router" stack. fortigates can re-route even hard-coded IPs to internal services ;-)

i am sure others can too, i just know we had to use the fortigate to fix a hard-coded IP that was breaking something. i think it was a fog device, even.

Re: I found a backdoor into my bed

#379

Post by genewitch »

jimt1234 wrote: post #223

> For someone who suffers from insomnia this seemed worth a shot. I can relate, having suffered the same for most of my life. One thing that really helped me was a simple white noise machine, typically used to help babies sleep. Good: I sleep great with it. Also, it's not connected to the internet and doesn't require an app. Bad: I basically can't sleep without it. I have to travel with it (camping!). I even purchase…

i did some research, not much, before buying a noise generator for my kid. Basically long term exposure to any level of "noise" may be "harmful". I don't recall the mechanics of how, though. I think something like Believe me, sometimes tinnitus means i don't care if i damage it more, i just need outside to be slightly louder than inside my head.

Re: I found a backdoor into my bed

#380

Post by genewitch »

malfist wrote: post #359
10729287 wrote: post #324

Earlier quoted context omitted.

I find it pretty useful at work when I want to focus and can't with music.

Be careful with that. Research shows that long term extended white noise listening damages hearing and can reduce your ability to process sounds. Don't get into the habit of using it all the time

i'm glad i wasn't the only one to mention this

https://news.ycombinator.com/item?id=43146228

Post reply on HN