My smart sleep mask broadcasts users' brainwaves to an open MQTT broker
7 hours ago
- #Reverse Engineering
- #Privacy
- #IoT Security
- A smart sleep mask from a Chinese company was reverse-engineered to reveal security flaws.
- The mask includes EEG brain monitoring, electrical muscle stimulation (EMS), and other features.
- Claude reverse-engineered the Bluetooth protocol and decompiled the app to find hardcoded credentials.
- The app's MQTT broker credentials were shared across all devices, exposing live EEG data from multiple users.
- The flaw allowed not only reading brainwaves but also sending electric impulses to users.
- The issue was disclosed to the company, highlighting serious security concerns in IoT devices.