{
  "id": "dc852167e9b0",
  "url": "https://trufflesecurity.com/blog/removing-jeff-bezos-from-my-bed",
  "title": "Removing Jeff Bezos From My Bed — Truffle Security Co.",
  "note": "This articles title would be better to describe what is a pretty big backdoor in the [8Sleep](https://www.eightsleep.com) product. A friend sent this over to me knowing I’m an 8Sleep customer. I love/hate the product. It for sure brings incredible comfort and improvement to my sleep, and it also gives me the best sleep data I've ever had. However, I also suspect (know?) that it is a privacy disaster and now we see that they have access points into the devices in glaringly bad ways. \n\n> What goes too far in my opinion, is allowing all of Eight Sleep’s engineers to remotely SSH into every customer’s bed and run arbitrary code that bypasses all forms of formal code review process.\n> \n> And yes, I found evidence that this is exactly what’s happening.\n\nSo based on this articles finding we must assume that any engineer at 8Sleep can know a lot of things.\n\n> What Can They Do with This Access?  \n>   \n> Let's start with the basics: \n> \n> - They can know when you sleep\n> - They can detect when there are 2 people sleeping in the bed instead of 1\n> - They can know when it's night, and no people are in the bed\n\nI've got some personal experience here. Our first 8Sleep mattress pad malfunctioned at one point so I had to contact support. I never had to call or anything, simply notified them via the app. I got a response a couple days later that a specific sensor in our mattress had malfunctioned. How did they do that? I’m sure that an engineer connected to our unit and ran a diagnostic. \n\nNow that fundamentally isn't a bad thing, but how that person got access, how long they had it, and what controls were over that access are completely unknowable to me. Until this article where now I know there is some group of folks at 8Sleep with an SSH key that gives them 'God mode' access to my bed, and from there access to any devices on our home network. \n\nWhat is the solve? Privacy protection is for sure part of this. Also companies need to reveal what access they have and how it is protected. However, I’m also going to pursue other solutions. I think I should be able to configure my Unifi network so that the 8Sleep is segmented from the rest of my network and cannot connect to other devices. I would do the same for the Peloton devices and our Tesla cars. ",
  "voice": "mixed",
  "saved": "2025-02-28T01:43:21Z",
  "host": "trufflesecurity.com",
  "kind": "page",
  "tags": [],
  "record": "https://links.thingelstad.xyz/links/dc852167e9b0/",
  "markdown": "https://links.thingelstad.xyz/links/dc852167e9b0.md",
  "issues": [
    {
      "number": 311,
      "slug": "311",
      "title": "Weekly Thing 311 / WikiTok, Bookmarklets, Tapestry",
      "date": "2025-03-01T16:00:56.135461Z",
      "section": "Notable",
      "position": 5,
      "url": "https://weekly.thingelstad.com/archive/311/",
      "page": "https://links.thingelstad.xyz/issues/311/"
    }
  ],
  "connections": {
    "same_host": {
      "count": 0,
      "page": "https://links.thingelstad.xyz/hosts/trufflesecurity.com/",
      "nearest": []
    },
    "same_week": {
      "count": 20,
      "nearest": [
        {
          "id": "ebd81c216a24",
          "title": "Daring Fireball: Apple Pulls Advanced Data Protection From the UK, in Defiance of UK Demand for Global Backdoor",
          "url": "https://daringfireball.net/2025/02/apple_pulls_advanced_data_protection_from_the_uk",
          "record": "https://links.thingelstad.xyz/links/ebd81c216a24/"
        },
        {
          "id": "c2f7fab68801",
          "title": "Migraine is more than a headache — a radical rethink offers hope to one billion people",
          "url": "https://www.nature.com/articles/d41586-025-00456-x",
          "record": "https://links.thingelstad.xyz/links/c2f7fab68801/"
        },
        {
          "id": "85ab0f4a9f0e",
          "title": "Introduction to CUDA Programming for Python Developers | PySpur - AI Agent Builder",
          "url": "https://www.pyspur.dev/blog/introduction_cuda_programming",
          "record": "https://links.thingelstad.xyz/links/85ab0f4a9f0e/"
        },
        {
          "id": "1c8c833ac87f",
          "title": "Software engineering job openings hit five-year low? - The Pragmatic Engineer",
          "url": "https://blog.pragmaticengineer.com/software-engineer-jobs-five-year-low/",
          "record": "https://links.thingelstad.xyz/links/1c8c833ac87f/"
        },
        {
          "id": "41454e3afe8f",
          "title": "How the largest crypto exchange hack happened: What Ethereum security experts say about Lazarus' $1.5 billion Bybit attack | The Block",
          "url": "https://www.theblock.co/post/342791/largest-crypto-exchange-hack-what-ethereum-security-experts-know-lazarus-bybit",
          "record": "https://links.thingelstad.xyz/links/41454e3afe8f/"
        }
      ]
    },
    "mentions": [],
    "mentioned_by": [],
    "saved_twice": []
  },
  "elsewhere": {
    "wayback": "https://web.archive.org/web/*/https://trufflesecurity.com/blog/removing-jeff-bezos-from-my-bed"
  }
}