Thread by @doctorow

The Snoo "smart bassinet" is a $1,300 gadget that allows you to control its rocking motions and send sounds to its speaker over the internet.

You. Will. Never. Guess. What. Happened. Next.

wired.com/story/snoo-sma…

1/

Ang Cui and @redballoonsec audited the Snoo and found authentication and infrastructure issues that allowed them to take control of the device over the internet and direct its rocking motor with forces exceeding the safe levels set by the manufacturers.

2/

They raised the neck-stresses from 0.2g to 0.7g, and the forehead stresses from 0.3g to 1.8g.

They were also able to push the sound output of the Snoo's speaker from its nominal max of 94.7dB to 113.93dB.

3/

Red Balloon disclosed the flaws to the manufacturer, the Happiest Baby Company, which patched them. Then Redballoon found new flaws and disclosed those. The manufacturer says it's patched those too.

I'm sure those are the only defects anyone will ever find.

4/

Or not. Because, as Red Balloon notes, the fundamental problem here is that the hardware safety interlocks are inadequate, so there will always be the risks that software defects will be used to do bad things to tiny babies.

5/

The Snoo was designed to prevent SIDS. The company says that parents who are worried about these attacks can use the physical wifi disconnection switch, which also switches off remote monitoring (the fact that this switch exists is actually really good news).

6/

As @lilyhnewman notes in her excellent story, the finances behind this are messy. Red Balloon's lead investor, Bain Capital (ugh) own a Snoo competitor company that uses Bluetooth, but not wifi, thus limiting its attack-surface.

7/

But also, Red Baloon and Snoo SHARE an investor, Greycroft (ugh), so maybe this mitigates any conflict of interest?

Image:
Cryteria (modified)
commons.wikimedia.org/wiki/File:HAL9…

CC BY
creativecommons.org/licenses/by/3.…

eof/