15 ms·
How to get root access to your Sleep Number bed
- teddyh 2y agoBuried lede: “What I did find was a "convenient" backdoor that Sleep Number can use to SSH back into the hub (and my internal home network as a result).”
- op00to 2y agoThis was the most interesting point for me, and I assume most of my IOT type shit has this functionality.
- repler 2y agosome of the newer WiFi setups have an IoT subnet that works like a guest network. Worth using if your gear has it.
- loufe 2y agoFor those who know their stuff, setting up a dedicated VLAN for IoT and putting devices in it based on MAC addresses (allow or disallow lists) is a solid option as well and fun to learn.
- op00to 2y agoI have a separate IOT vlan, but ensuring things like AirPlay work correctly is really, really, really annoying.
- fragmede 2y agoif my iot bed can talk to my iot camera, that's still not great. better than it talking to my NAS or laptop I suppose though
- alwa 2y agoSometimes this type of guest network can provide device isolation: devices can talk to the open internet, but not to anything else on the LAN.
- philsnow 2y agoI don't even want these devices making outgoing connections to the internet. I have my router drop all outgoing connection attempts from my IOT vlan. I can connect to the cameras etc on there from other VLANs but that's the only way packets get out.
- fargle 2y agoyou absolutely need to do this. we call it the "internet of shit VLAN".
- shiroiushi 2y agoThis takes on extra meaning when you consider my internet-connected automatic cat litter box.
- NewsaHackO 2y agoYea, that part is insane. At this point it is safe to say that any non open source device that has access to you home network and the Internet can function as a backdoor. Not to be a conspiracy theorist, but I guarantee the CIA has a list of common devices with this feature that they can use to get local access in most houses.
- BadHumans 2y agoWhy are you assuming that only non open source devices are vulnerable? We've seen enough open source vulnerabilities in broad daylight to know that open source does not mean secure.
- hiddencost 2y agoOpen source is auditable, and tends to get fixed.
- BadHumans 2y agoI don't think you can say it tends to get fixed because you don't know the ratio between the number of vulnerabilities and the ones that get fixed. Closed source can also be audited. Auditing code for companies is an entire business model.
- prettyStandard 2y agoYou have it backwards. They're assuming non-open source is backdoor'ed. Not that open source isn't backdoor'ed.
- therein 2y agoI created 3 new firewall rules after reading this comment.
- binwiederhier 2y agoDevil's advocate. As someone who has developed a Linux based appliance with over 100k live units across the globe, it seems insane to NOT have access to the thing you're selling and that you have to maintain. If your thing breaks or gets bricked by an update, you will call support and expect them to fix it. You don't want to send in your device or have a support technician come to your house to fix it. So yes, to the conspiracy theorists it may look like a secret backdoor -- it sorta is. But in many cases I bet it's just a safety net for developers and support to fix things. I speak for myself and my own experience working for $oldjob. Other companies or countries may of course use this differently. And of course companies get sold and such so you'll never know.
- 01HNNWZ0MV43FF 2y agoThe problem is it's gonna be a golden key system where everyone who's worked there for the last ten years has a copy
- binwiederhier 2y agoThat is correct. But it is possible to design a system with short lived auth tokens/keys and frequent key rotation. I designed such a system at $oldjob for remote access (see [1]). Obviously there is always a risk, and there are always syseng/ops people with access. That is correct. [1] https://blog.heckel.io/2019/11/19/providing-remote-access-to-devices-via-ssh-tunnels/ https://blog.heckel.io/2019/11/19/providing-remote-access-to...
- number6 2y agoNice write up and a lot of gotchas you encountered
- flaminHotSpeedo 2y agoThat's a fair argument, but it doesn't appear that that updates are high on sleep number's priority list: > The hub includes Python 2.7.18. While extremely old (keep in mind the Hub appears to have been last updated in 2018) If we give them the benefit of the doubt, perhaps they intended to to keep it up to date but ultimately compaines need to either be transparent about their remote access and manage it responsibly, which includes keeping the system patched, or give up access
- deleted 2y ago[deleted]
- lmm 2y agoIn my book if your setup grants access to anyone on your network then it was already insecure. Your wifi is too big a perimeter to defend; lock down the stuff you care about instead.
- cs702 2y agoWait, this is about an actual bed -- you know, the kind that you sleep on -- that runs an SSH server on Linux? W. T. F. !?
- itake 2y agohow else would you record and transmit measurements to a server? lower-level hardware and software is expensive to develop on and potentially be difficult to update.
- hpen 2y ago[flagged]
- jojobas 2y agoEmbedded linux is everywhere. Making the initial connection (connect to BED23234 wifi and do xyz on a web page) requires more than a microcontroller. There's no point trying to save a few bucks on such a ridiculously expensive item.
- hpen 2y agoEmbedded linux is everywhere. But arguing that's a reason to use it, or not a reason to use a microcontroller / SOC is wild. Each has tradeoffs.
- Animats 2y agoOK, not buying Sleep Number. I slept on inflatable mattresses for years, until the company making them started outsourcing to China and the seams on the internal baffles broke on two mattresses.
- peteforde 2y agoFunny part to me is that I fully assumed that this was a post about hacking Eight Sleep beds by someone who didn't want to explicitly name the company, presumably for vague legal reasons. Then I got to a picture of an apparently real "Number Sleep Hub" and my mind was blown. WTF are we in a timeline so weird that there are two companies making water cooled beds, one is called Eight Sleep and the other is Sleep Number? It's like the RNG for this instance had a bad seed.
- fragmede 2y agoIt turns out naming things is an unsolved problem outside of computer science as well.
- v101 2y agoAlso in computer science, if one looks at all stupid product / framework / language names.
- yencabulator 2y agoYou assume it's a funny coincidence, I'd say Eight Sleep picked a name that as a easy to confuse with Sleep Number as they could without getting immediately sued.
- Aardwolf 2y agoI had never heard of either so thought the title was a metaphor for "how to get root access to your brain to improve sleep quality" I sure hope these beds have tactile controls you can feel and use in the dark, and don't require pulling out a smartphone in front of your face while trying to sleep to adjust them, because bed/matress manufacturers for sure must know what is good and bad for sleep quality
- miah_ 2y agoThe older models had a corded control with a red led display that didn't destroy your eyes at 3am.
- 2y ago
- KennyBlanken 2y ago> r: Following this guide will require modifying internal files on your Sleep Number hub. This will void your warranty People, stop spreading this BS. Just like those stickers that say "warranty void if removed" are not legally enforceable, nothing "automatically" invalidates your product's warranty except misuse or poor maintenance. If your Smart Bed stops working, you having poked around in the controller does not relieve the manufacturer from their warranty obligations (including implied warranty.) The onus is on them to prove that you damaged it, subjected it to "unreasonable" use, or did not properly maintain it. You fry the bed's brain trying to hook up a JTAG when you accidentally bridge 5V to a 3.3V logic circuit? That's on you. The controller fails because the power supply blows? The fact that you installed a JTAG header, googly eyes, and painted it pink is irrelevant. They need to fix your shit. Even if you modify the firmware, it's on them to prove your modifications caused the failure. Would you expect to have your laptop's warranty invalidated because you use it to game (which generates lot of heat)? Of course not. How about if you install Firefox? Or install Linux? Again, of course not. So why do you think the rules change just because a device is "dumber"?
- gcr 2y agoThere's a difference between law on paper and law in practice. If the manufacturer refuses to honor the warranty, there's very little customers can do.
- userbinator 2y agohttps://en.wikipedia.org/wiki/Magnuson%E2%80%93Moss_Warranty_Act https://en.wikipedia.org/wiki/Magnuson%E2%80%93Moss_Warranty...
- lacksconfidence 2y agoThat's wonderful, but it doesn't change the lived experience of warranty's.
- lmm 2y agoSmall claims court is cheap and easy, and often the only way to get them to honour the warranty even if you haven't messed with anything.
- surfingdino 2y agoCool, but I liked this bed-related hack better https://techcrunch.com/2009/12/12/newlywed-sex-tweets/ https://techcrunch.com/2009/12/12/newlywed-sex-tweets/
- whatsakandr 2y agoI'm interested if anyone has pulled the same thing with eight sleep. Not having access to control my bed's temperature because my internet is out bothers me deeply.
- dyauspitr 2y agoWhat fresh hell is that. Why does it need to reach out to the internet?
- pfych 2y agoTo ensure you've paid your monthly subscription fee (Not joking - the mattress cover has a subscription)
- dailykoder 2y agoWhat. The. Fuck. Why would anyone buy such thing then? I really don't get it.
- blitzar 2y agoThe intersection of lots of money and moron is where most product-market fit exists. It also happens to be a large addressable market.
- dyauspitr 2y agoWhat sort of person is buying this? Do they give away the mattress for some really cheap price initially?
- gimmeThaBeet 2y agoNo it's actually 2-3k+ usd. I had done some cursory considering of it over the past few months because it seems like a potentially reasonable solution to a real problem I struggle with. But yeah part of it is like, it's really weird. If you asked me how much consistently better sleep would be worth, the answer is how much do you want? But phrase that as "Bed as a service" and my reflex is "you're kidding, righr?"
- grotorea 2y agoAnyone else getting cloudfare blocked on TFA?
- deleted 2y ago[deleted]
- grishka 2y agoI am getting blocked. What is "TFA"?
- alister 2y agoI tried 2 different IP addresses from Brazil and they got blocked. I tried an IP address from the USA and another from Canada, and both worked correctly. The message you get when you're blocked is: Sorry, you have been blocked You are unable to access dillan.org Performance & security by Cloudflare Why have I been blocked? This website is using a security service to protect itself from online attacks. The action you just performed triggered the security solution. There are several actions that could trigger this block including submitting a certain word or phrase, a SQL command or malformed data. which is false since I wasn't doing any of the things they list. I wonder why they think that Brazil and other countries shouldn't be reading this site? Is the owner of the site able to geo-target which countries he wants his site to be shown in via Cloudflare?
- grotorea 2y agoBlocking countries seems to be possible. No idea why do that on a personal blog, maybe a DDoS?
- blopker 2y agoThere's a similar method to get into an Eight Sleep Pod 3 [0]. This requires less extra hardware though since some models come with a MicroSD card that you can modify. The method used in TFA might be a good way to get root on Pods without the card. That being said, I just learned that while Eight Sleep does sign their firmware updates, they also send you the private key used to sign the update in the same package. [0]: https://github.com/bobobo1618/ninesleep https://github.com/bobobo1618/ninesleep
- ShakataGaNai 2y agoIronically this makes me more likely to buy one. If I can make the smart thing local and/or home assistant controlled, and kill their internet connectivity... I'm thinking that isn't so bad. Don't get me wrong $2-4k is steep, but if it's a one-time for a decade or so, that's reasonable. But $4k plus you want $25/mo? Just fluff right off.
- Animats 2y agoNext, ransomware. "Pay us $1000 or you won't be able to sleep in your bed for the next month".
- m463 2y agoWouldn't subscriptions be next?
- zdragnar 2y agoSame thing, really
- wil421 2y agoPay us $50 a month and we’ll keep the other hackers at bay. Is there a ransomware protection racket yet?
- mattigames 2y agoYeah, they have existed for a long time, the are called anti-viruses.
- deleted 2y ago[deleted]
- dailykoder 2y agoI don't have to do any hacks to use my Lidl mattress. It just works. Am I doing something wrong here?
- blitzar 2y agoHave you considered a mattress topper?
- protocolture 2y ago>The hub communicates with the Sleep Number servers by opening an SSH tunnel and providing a reverse tunnel back to the hub that their developers can use to connect to the hub and do maintenance when needed. Kinda interested just to see what the parameters of this are like. Is it using PubkeyAuth or just password? Is it tunnelling home via ip or dns? If everything is just right, I can imagine the setup for the most hilarious DNS hijack in human history. In the immortal words of Homer Simpson. Bed goes up. Bed goes down.
- kotaKat 2y agoTired: SIM swapping attacks against cryptobros. Wired: Since Sleep Number beds get tied to orders, break into Sleep Number, find your target, SSH into their bed, and pivot into their home network to steal their crypto wallets. After all, everyone always hides their money under their mattress ;)
- internet101010 2y agoI am not a crypto bro but was the victim of a sim swap attack recently. It was really annoying but at the same time kind of funny because they literally only went after the 2FA app (Authy) once they stole my number, which thankfully didn't have anything meaningful attached to it.
- prmoustache 2y ago>The hub communicates with the Sleep Number servers by opening an SSH tunnel and providing a reverse tunnel back to the hub that their developers can use to connect to the hub and do maintenance when needed. Shouldn't bed owners sue them if they haven't been warned of that fact prior to purchase? Getting illegitimate access to your network and backdooring it is criminal offense right?
- mtoner23 2y agoI'm sure there was a T&C that included all this and you waive rights to complain about this or join a class action about it.
- alduin32 2y agoWith climate change and our general impact on environment worsening each year, our relationship with technology is starting to be like a big elephant in the room. Do people really think a sustainable and equitable society is possible while having microprocessors and telecommunication devices in beds ? This kind of luxury will always be reserved to the wealthiest in society, and its availability dependent on the relentless exploitation of land and human beings.
- pavel_lishin 2y agoWhy does it sound like you're proposing that nobody should have fancy things, instead of proposing that everyone should have access to fancy things?
- ikr678 2y agoIf everyone has fancy things then there will be even less environment to go around.
- coldpie 2y agoI empathize with what you're saying, but "we shouldn't have things people want" is a solution to climate change in the same way that "we shouldn't have gravity" is a solution to air travel. It's not gonna work. Find another approach.
- I_o_IllI__o_I 2y ago[dead]
- CyberDildonics 2y ago> Do people really think a sustainable and equitable society is possible while having microprocessors and telecommunication devices in beds ? You realize the cost of the chips in the bed are a lot less than the cost to even ship a mattress right?
- 2y ago
- miah_ 2y agoPretty wild. I used to have one of these beds, but it was before everything got "smart". It had two corded controller's hooked up to the pump. The controller displays the number and had up/down arrow buttons to adjust. No internet required. No Linux powered microcontroller required. My bed couldn't get hacked. I slept in comfort.
- asciii 2y agoThis is the kind of bed I would buy. Imagine having to buy a bed with access for Wi-Fi. That’s crazy because that’s more hardware needed than just plugging the freaking thing in the wall.
- robin_reala 2y agoWhat I’m trying to teach myself to do whenever I think “this is ridiculous overcomplexity” is to imagine whose life it might make simpler. Let’s assume I have some sort of motor disability: it could be anything from Parkinsons to quadraplegia. Having a bridge out to a common controller that maybe works on speech or some other standardised input method that works for your disability is a massive benefit. And avoids having to deal with the complexities of each individual products’ inability to meet your own accessibility needs in different ways. So much smart home stuff is basically pointless to those of us fortunate enough to have currently able bodies, and a lifesaver to the rest.
- sadops 2y agoHave you considered talking to people instead of imagining their response? Because regular people seem kind of fed up, and we're still over here cramming insecure computers into everything.
- shepherdjerred 2y agoThose outside of tech could not care less about anything discussed on this forum. They may care in a passive sense -- the same way that most people care about social causes. They (myself included) agree that some situation is bad, but they don't inconvenience themselves improve the situation. As an example, many people have some story about creepily being shown ads after talking about something with a friend. It's concerning to them, but no action is taken.
- linker3000 2y agoBest add 'solder' to your shopping list unless you already have some, or the new iron you buy comes with a starter amount.
- fckgw 2y agoIf you click the actual link in the article you can see it's a kit that comes with solder and a bunch of other stuff
- classified 2y agoI have an analog bed. No root access necessary for sleeping.
- colechristensen 2y agoHere are some facts for you * sleep number beds have sensors in them that detect heart rate * they do this by detecting pressure differences in the air mattress * these are effectively microphones, right? and quite sensitive
- emilamlom 2y agoDo they really detect heart rate through pressure sensors? That seems like it'd have so much noise the data would be unusable. Edit: Looks like they couple it with some fancy statistical analysis to get accurate enough data. Interesting
- colechristensen 2y agoThey acquired Bam Labs' tech to do this. https://www.crunchbase.com/organization/bam-labs https://www.crunchbase.com/organization/bam-labs
- thunkshift1 2y agoThats a brand new sentence
- perryizgr8 2y agoThis bed has 1 GB of RAM. I used to play FIFA and Max Payne on a PC that had only 256 MB.
- banish-m4 2y agoIf you want to peek into consumer or any electronics.. probe with a signal analyzer for the usual suspects: RS-232 (TTL-levels, CMOS-levels, and serial-levels), JTAG, SPI, and I2C. First, probe header pins and test points (rows of pads not meant for components) before probing around other components. PSA: If you're designing a PCB for hand-testing, save money by eliminating connectors with tag connect plug of nails. They're also compatible with automated board testing.
- dmitrygr 2y agoWhy does a bed need to run Linux? Why? Of all the possible timelines, we live in the dumbest. What was wrong with a plain old bed without 1GB of RAM and a full OS running on it?! It is the same everywhere. Finding a washing machine that was not WiFi-connected was a chore and I dread doing it again in ten years. As a person who's broken into O(1000) "smart" devices (for fun and for profit both), I do not want them in my house, and avoiding them is getting harder due to insanity like this linux-running bed! Please make it stop!
- n8henrie 2y agoI feel the same way -- the silver lining is that it's helped push me to buying older / used / more maintainable stuff for a fraction of the price, all the while learning a little here and there about minor repairs for older electronics. This is a big win for the pocketbook and gratifying to keep something out of the landfill. Reduce / reuse / recycle -- in order of importance.
- miah_ 2y agoI like: reduce, re-use, repair, recycle. I agree with fixing older stuff. I buy used frequently. Estate sales are my lifeblood. If you can't fix it you don't own it.
- reidjs 2y agoAt least it doesn't run windows
- dylan604 2y ago"man, i tried going to bed last night, but it was a BSOD so I had to reboot it, but then it needed 45 minutes of OS updates before I could get in the bed." seems like a pretty good torture on multiple levels
- labster 2y agoAnd they wonder why so many people are sleeping on the streets these days. It’s just better UX.