Top
Best
New

Posted by minimalthinker 9 hours ago

My smart sleep mask broadcasts users' brainwaves to an open MQTT broker(aimilios.bearblog.dev)
298 points | 140 commentspage 2
basedrum 8 hours ago|
Name the company, hiding it is irresponsible
Jolter 7 hours ago||
Author doesn’t spell out why they are not naming them, but my guess is they are trying to not promote the product to malicious actors who would be interested in the sleep data of others.

I guess that’s not a huge problem, though, since all users are presumably at least anonymous.

bstsb 5 hours ago||
less sleep data, i imagine, and more the whole “send remote electrical impulses” thing
brabel 7 hours ago||
It’s probably safe to assume they are all like that.
Larrikin 6 hours ago||
This feels like a reason to buy the device to me? I would want to block all of the data going to the cloud and would only want operations happening locally. But the MQTT broadcast then allows me to create a local only integration in Home Assistant with all of the data.

What's the real risk profile? Robbers can see you are asleep instead of waiting until you aren't home?

I have not implemented MQTT automations myself, but it's there a way to encrypt them? That could be a nice to have

matthewfcarlson 5 hours ago|
Sounds like you cannot control which MQTT endpoint it is headed to? It just goes to the server of the device. Assuming you could modify the firmware, you could program it to send to a local MQTT.
erazor42 5 hours ago||
Simpler just update your local network dns so whatevercompany.brain.com redirect to your local 10.0.0.3 mqtt
autoexec 7 hours ago||
This guy bought an internet connected sleep mask so it's not surprising that it was collecting all kinds of data, or that it was doing it insecurely (everyone should expect IoT anything to be a security nightmare) so to me the surprising thing about this is that the company actually bothered to worry about saving bandwidth/power and went through the trouble of using MQTT. Probably not the best choice, and they didn't bother to do it securely, but I'm genuinely impressed that they even tried to be efficient while sucking up people's personal data.
8n4vidtmkvmk 6 hours ago|
Meanwhile streaming everyone's data, negating any benefit.
anonymousiam 3 hours ago||
The narrator in the article acts as a third person observer and identifies "Claude" as the active hacker. So assuming the (unidentified) company that sells/manages the product wants to prosecute a CFAA violation, who do they go after? Was Claude the one responsible for all of the hacking?
bryanrasmussen 9 hours ago||
huh, not sure if life imitates snark and bull https://medium.com/luminasticity/great-products-of-illuminat...

"The ZZZ mask is an intelligent sleep mask — it allows you to sleep less while sleeping deeper. That’s the premise — but really it is a paradigm breaking computer that allows full automation and control over the sleep process, including access to dreamtime."

or if this is another scifi variation of the same theme, with some dev like embellishments.

mrguyorama 7 hours ago|
That is the premise of HypnoSpace Outlaw, a neat game about 90s internet nostalgia and scifi.
t3chd33r 3 hours ago||
Nevermind. I have just described my iPhone as a “generic chinese mobile device” to Claude, and he successfully gained root access with admin privileges to my iPhone, and even captured a couple minutes of EEG from 30 genetic mobile devices in my neighborhood. Seems like iPhones are tracking your thoughts, Claude could prove that, just ask it to tell you everything
baby_souffle 9 hours ago||
Well that’s a brand new sentence.
amelius 8 hours ago|
But not a beautiful sentence.
tomsmithtld 7 hours ago||
the shared MQTT credentials pattern is unfortunately super common in budget IoT. seen the exact same thing in smart plugs and air quality sensors. the frustrating part is per-device auth is not even hard to set up, mosquitto supports client certs and topic ACLs with minimal config. manufacturers skip it because per-device key provisioning adds a step to the assembly line and nobody wants to think about key management. so they hardcode one set of creds and hope nobody runs strings on the binary.
flax 6 hours ago||
This smells like bullshit to me, although I am admittedly not experienced with Claude.

I find it difficult to believe that a sleep mask exists with the features listed: "EEG brain monitoring, electrical muscle stimulation around the eyes, vibration, heating, audio." while also being something you can strap to your face and comfortably sleep in, with battery capacity sufficient for several hours of sleep.

I also wonder how Claude probed bluetooth. Does Claude have access to bluetooth interface? Why? Perhaps it wrote a secondary program then ran that, but the article describes it as Claude probing directly.

I'm also skeptical of Claude's ability to make accurate reverse-engineered bluetooth protocol. This is at least a little more of an LLM-appropriate task, but I suspect that there was a lot of chaff also produced that the article writer separated from the wheat.

If any of this happened at all. No hardware mentioned, no company, no actual protocol description published, no library provided.

It makes a nice vague futuristic cyperpunk story, but there's no meat on those bones.

petercooper 1 hour ago||
This isn't to the level of the OP, but I just asked Claude "Are there any interesting Bluetooth devices in my vicinity which aren't actually mine or ones I am connected to?" and it downloaded a tool called `blueutil` and identified a variety of things.

When I complained that the results were boring, it installed a Python package called 'bleak', found a set of LED lights (which I assumed are my daughter's) and tried to control them. It said the signal was too weak and got me to move around the house, whereupon it connected to them, figured out the protocol, and actually changed the lights while I was sat on her bed - where I am right now. Now I have a new party trick when she gets home! I had no idea they were Bluetooth controlled, nor clearly without any security at all.

minimalthinker 18 minutes ago|||
thread with claude: https://gist.github.com/aimihat/a206289b356cac88e2810654adf0...
threecheese 2 hours ago|||
Claude could access anything on your device, including system or third party commands for network or signal processing - it may even have their manuals/sites/man pages in the training set. It’s remarkably good at figuring things out, and you can watch the reasoning output. There are mcp tools for reverse engineering that can give it even higher level abilities (ghidra is a popular one).

Yesterday I watched it try and work around some filesystem permission restrictions, it tried a lot of things I would never have thought of, and it was eventually successful. I was kinda goading it though.

skibz 6 hours ago|||
A lot of BLE peripherals are very easy to probe. And there are libraries available for most popular languages that allow you to connect to a peripheral and poke at any exposed internals with little effort.

As for the reverse engineering, the author claims that all it took was dumping the strings from the Dart binary to see what was being sent to the bluetooth device. It's plausible, and I would give them the benefit of the doubt here.

RachelF 3 hours ago|||
Yes, it is very lacking in details. The Claude output would have been interesting, or a few logs or protocol dumps.

The lack of detail makes me suspect the truth of most of the story.

llm_nerd 6 hours ago|||
https://www.kickstarter.com/projects/selepu/dreampilot-ai-gu...

Found that in seconds. EEG, electrical stimulation, heat, audio, etc. Claims a 20 hour battery.

As to the Claude interactions, like others I am suspicious and it seems overly idealized and simplified. Claude can't search for BT devices, but you could hook it up with an MCP that does that. You can hook it up with a decompiler MCP. And on and on. But it's more involved than this story details.

flax 6 hours ago|||
That appears to be more than a centimeter thick, and not particularly flexible. It's more like ski goggles than a sleep mask.

So yeah, a product exists that claims to be a sleep mask with these features. Maybe someone could even sleep while wearing that thing, as long as they sleep on their back and don't move around too much. I remain skeptical that it actually does the things it claims and has the battery life it claims. This is kickstarter after all. Regardless, this would qualify as the device in question for the article. Or at least inspiration for it.

Without evidence such as wireshark logs, programs, protocol documentation, I'm not convinced that any of this actually _happened_.

orsorna 6 hours ago|||
Claude, or any good agent, doesn't need MCP to do things. As long as it has access to a shell it can craft any command that it needs to fulfill its prompt.
llm_nerd 5 hours ago||
There are no shell commands to do what is described. I could get Claude to interact with BLE devices, but it did it by writing and running various helper applications, for instance using the Bleak library. So I guess not an MCP per se.
sublinear 5 hours ago||
I was originally going to ask something similar, but from a different angle.

These blog posts now making the rounds on HN are the usual reverse engineering stories, but made a lot more compelling simply because they involve using AI.

Never mind that the AI part isn't doing any heavy lifting and probably just as tedious as not using AI in the first place. I am confused why the author mentions it so prominently. Past authors would not have been so dramatic and just waved their hands that they had some trial and error before finding out how the app is built. The focus would have been on the lack of auth and the funny stuff they did before reporting it to the devs.

morkalork 9 hours ago|
>Since every device shares the same credentials and the same broker, if you can read someone's brainwaves you can also send them electric impulses.

Amazing.

More comments...