Normally you can block any device's update if you figure out the server for the update content/update check, and block it out from your router and/or DNS.

The "solution" for that will be embedded 5G connections.

I put all my gym equipment in a faraday cage

The remedy for that will be wrapping the internal antenna in foil or cell tower emulation.

The remedy to that is that the thing will stop working after a while - like how Intel x86 CPUs turn off after 30 mins without their precious spy co-processor[0], or how Diablo 2 Resurrected discontinues working after 30 days of being offline[1]. Of course another remedy is that you're free to buy a similar thing from another manufacturer, that's not completely dropped the ball on the issue. That is, until all of the manufacturers drop the ball, like how the situation is with x86 CPUs and Intel ME / AMD ST. The true remedy would be well thought out, well enforced legislation. But yeah, I'm not holding my breath either.

[0] https://en.wikipedia.org/wiki/Intel_Management_Engine#Undocu...

[1] https://news.ycombinator.com/item?id=29977673

I don't know what scares me more, the fact that all manufacturers might go down this path, or that our society might reward them for doing so.

If we organize as a society, which in part means educating along with fixing the voting systems in most places to be fair and balanced (like by drowning out industrial complex lobby money by giving every eligible voter a $100/year voucher to contribute to the politician of their choice they feel best matches their interests), then we make laws to prevent such abusive-exploitive behaviour by companies.

The remedy for that will be requiring a network handshake to occur on boot.

The remedy for that is to emulate the server

The remedy for that is to encrypt the communication

The remedy for that is to MITM the server connection

The remedy for that is HSTS...

It's a cat a mouse game, the better solution for society (imo) is to have specific rights enshrined by law to allow for a qualified 3rd parties to access a system's internals.

The one advantage of playing the cat-and-mouse game is that the longer it goes on, the more complexity ends up being in the firmware (TLS, HPKP, etc as you already listed), which increases the likelihood of a bug that can be exploited to take over it.

In that vein, it might be worth noting that this thing is just a treadmill. There's this whole fancy computer attached probably via just a handful of very simple wires to the actual treadmill part that anyone cares about. If they get too obnoxious about the computer, you can just open the treadmill, yank the computer out, and replace it with something from China that costs $20

Of course, that'll then get attacked via the legal system for violating DRM.. ugh

And when wintertime rolls around, the gorillas simply freeze to death.

The remedy for that is a crack

At which point, you tell them you have no coverage and get a refund.

At that point it should be easy to return, at least.

Amazon sidewalk, actually. Should prove cheaper and work near any sense housing.

That would work equally well with LTE. It's not happening because it would increase cost.

Oh no, in fact, it’s just around the corner.

https://aws.amazon.com/fr/private5g/

Private 5G is like an alternative to wifi for a large industrial complex or something. No one is going to cover your house in it. You should be more worried about Sidewalk. https://www.amazon.com/Amazon-Sidewalk/b?ie=UTF8&node=213281...

Can you explain further?

"Luckily" in the US, the carrier oligopoly here won't sell you a cheap IoT plan for cell connectivity, and the "lifetime" plans sold to manufacturers are probably at least $50-100 in volume.

Maybe not on optional treadmills, but that's already here for CPAP machines that insurance pays for - they log data to an SD card in case you don't have reception, but it also has an LTE modem to upload it so the insurance company can check up on you and make sure you're using that machine, or else charge you more money for it.

The "solution" is to allow the device use only "official" resolver servers, accessed via encrypted channel, secured by a PKI with a private root.

First covid then gym equipment, 5G is the worst

> It's only a matter of time before Nordic decides to block this method as well.

Maaaybe.

The public statement from them sounds like it was legal whining about liability issues, and if that's actually true (which, well) then if it has to be sufficiently intentional on your part that may be sufficient for them to leave well alone.

Certainly worth preparing for that not being the case though.

IANAL, but are there any actual cases where someone or a class successfully sued a company for using their product off-label in such a way? This kind of stuff seems to me like how schools no longer permit students to go out for lunch, citing liability that they almost assuredly never had in the first place.

I can at least see the argument that tapping the screen a couple times in a certain pattern might not be sufficient, but having to generate a code is. I think it's a ridiculous argument, but I wouldn't be even remotely shocked that some octogenarian judge who doesn't own a cell phone is convinced by it.

Right, and legal departments kind of exist to avoid that sort of ridiculous argument fucking over their employers.

I don't endorse the argument -logically- at all, but if it's "legal being (justifiably) paranoid" then while as I said preparing for that not being it is still worthwhile, the extent to which they'll chase down workarounds may have limits nonetheless.

Yeah or that's just the excuse they use to justify blocking access so more people subscribe to their services.

That's what "if that's actually true" was about, yes.

This is great, thanks for posting this site. I am one of those who bought this awesome treadmill for several reasons, including to watch netflix and plex. It's been frustrating not being able to easily do this... I have just been listening to podcasts from my phone.

DHCP advertise an http proxy to it with a PAC file and block non-proxy communications. It should do the right thing eventually, at which point you can catalogue the usual traffic exchanges and then block anything not in them and/or just the software update URLs (which requires inspection over time, as there may be many).

Surely one can just block the update service via something like a pihole? I do this for my Vizio TV. They're notorious, as as most smart TVs now, for calling home and everywhere else.

I know this is terrible for consumers, but I'm endlessly amused by all the hacks and workarounds in this game of cat and mouse.

Thank you for this. I was hoping someone had figured it out but I hadn't found this yet.

Thank you! I love the hardware but I'm pissed about the software. This is helpful.