Smart Sleep Mask Exposes Brain Activity Data

According to the developer, the smart mask was unstable due to the proprietary app constantly losing connection. The app itself is needed to control the device, which is equipped with EEG (electroencephalography) monitoring, heating, vibration, speakers, and electrical stimulation around the eyes. For security reasons, the author does not specify the exact model of the mask.

With the help of an AI agent, the developer analyzed the code of the app built on Flutter and found lines containing URLs, debugging information, and the login and password for the MQTT broker. It turned out that the broker provides data not just for one mask, but for all active ones on the network at once. Additionally, it is possible to access information from other IoT devices from the manufacturer, including occupancy sensors and air quality analyzers.

The author notes that with the MQTT broker, you can not only read data but also send it. No additional confirmations are needed for this. For example, one could remotely activate electrical stimulation around another user's eyes or play sound through the built-in speakers.

The developer has already reported the issue to the manufacturer.