Are you denying the existence of an authorised ssh key on each of these beds allowing the holder of the key?
Are you denying there is a config file pointing to a target called remote-connectivity-api.8slp.net?
No there's not enough evidence to prove in a court of law who has access to the private key, or that the config file is enabling a return ssh connection, but it's pretty damning.
The only thing that's not newsworthy about this is that large amounts of IOT shit does this.
"I downloaded the firmware and I found an SSH key and a configuration file that mentions an SSH endpoint; therefore, I know that all of Eight Sleep’s engineers are allowed to remotely SSH into every customer’s bed and run arbitrary code!"
Do you not see a problem with this line of reasoning? That's literally what he says in the article, and he presents it as a near-certainty, not the wild leap of unsupported reasoning that it is.
Are you denying there is a config file pointing to a target called remote-connectivity-api.8slp.net?
No there's not enough evidence to prove in a court of law who has access to the private key, or that the config file is enabling a return ssh connection, but it's pretty damning.
The only thing that's not newsworthy about this is that large amounts of IOT shit does this.