5 ms·
Buried lede: “What I did find was a "convenient" backdoor that Sleep Number can use to SSH back into the hub (and my internal home network as a result).”
by teddyh 2y ago
Buried lede: “What I did find was a "convenient" backdoor that Sleep Number can use to SSH back into the hub (and my internal home network as a result).”
- op00to 2y agoThis was the most interesting point for me, and I assume most of my IOT type shit has this functionality.
- repler 2y agosome of the newer WiFi setups have an IoT subnet that works like a guest network. Worth using if your gear has it.
- loufe 2y agoFor those who know their stuff, setting up a dedicated VLAN for IoT and putting devices in it based on MAC addresses (allow or disallow lists) is a solid option as well and fun to learn.
- op00to 2y agoI have a separate IOT vlan, but ensuring things like AirPlay work correctly is really, really, really annoying.
- fragmede 2y agoif my iot bed can talk to my iot camera, that's still not great. better than it talking to my NAS or laptop I suppose though
- alwa 2y agoSometimes this type of guest network can provide device isolation: devices can talk to the open internet, but not to anything else on the LAN.
- philsnow 2y agoI don't even want these devices making outgoing connections to the internet. I have my router drop all outgoing connection attempts from my IOT vlan. I can connect to the cameras etc on there from other VLANs but that's the only way packets get out.
- fargle 2y agoyou absolutely need to do this. we call it the "internet of shit VLAN".
- shiroiushi 2y agoThis takes on extra meaning when you consider my internet-connected automatic cat litter box.
- NewsaHackO 2y agoYea, that part is insane. At this point it is safe to say that any non open source device that has access to you home network and the Internet can function as a backdoor. Not to be a conspiracy theorist, but I guarantee the CIA has a list of common devices with this feature that they can use to get local access in most houses.
- BadHumans 2y agoWhy are you assuming that only non open source devices are vulnerable? We've seen enough open source vulnerabilities in broad daylight to know that open source does not mean secure.
- hiddencost 2y agoOpen source is auditable, and tends to get fixed.
- BadHumans 2y agoI don't think you can say it tends to get fixed because you don't know the ratio between the number of vulnerabilities and the ones that get fixed. Closed source can also be audited. Auditing code for companies is an entire business model.
- prettyStandard 2y agoYou have it backwards. They're assuming non-open source is backdoor'ed. Not that open source isn't backdoor'ed.
- therein 2y agoI created 3 new firewall rules after reading this comment.
- binwiederhier 2y agoDevil's advocate. As someone who has developed a Linux based appliance with over 100k live units across the globe, it seems insane to NOT have access to the thing you're selling and that you have to maintain. If your thing breaks or gets bricked by an update, you will call support and expect them to fix it. You don't want to send in your device or have a support technician come to your house to fix it. So yes, to the conspiracy theorists it may look like a secret backdoor -- it sorta is. But in many cases I bet it's just a safety net for developers and support to fix things. I speak for myself and my own experience working for $oldjob. Other companies or countries may of course use this differently. And of course companies get sold and such so you'll never know.
- 01HNNWZ0MV43FF 2y agoThe problem is it's gonna be a golden key system where everyone who's worked there for the last ten years has a copy
- binwiederhier 2y agoThat is correct. But it is possible to design a system with short lived auth tokens/keys and frequent key rotation. I designed such a system at $oldjob for remote access (see [1]). Obviously there is always a risk, and there are always syseng/ops people with access. That is correct. [1] https://blog.heckel.io/2019/11/19/providing-remote-access-to-devices-via-ssh-tunnels/ https://blog.heckel.io/2019/11/19/providing-remote-access-to...
- number6 2y agoNice write up and a lot of gotchas you encountered
- flaminHotSpeedo 2y agoThat's a fair argument, but it doesn't appear that that updates are high on sleep number's priority list: > The hub includes Python 2.7.18. While extremely old (keep in mind the Hub appears to have been last updated in 2018) If we give them the benefit of the doubt, perhaps they intended to to keep it up to date but ultimately compaines need to either be transparent about their remote access and manage it responsibly, which includes keeping the system patched, or give up access
- deleted 2y ago[deleted]
- lmm 2y agoIn my book if your setup grants access to anyone on your network then it was already insecure. Your wifi is too big a perimeter to defend; lock down the stuff you care about instead.