Consumer Rights Wiki

Echelon fitness firmware lockout: Difference between revisions

← Older edit
VisualWikitext
Sferaphim (talk | contribs)
confirmed
149 edits
m added and removed various links
m Reverted edit by 82.102.18.155 (talk) to last revision by Icebear
Tag: Rollback
 
(12 intermediate revisions by 3 users not shown)
Line 1: Line 1:
{{Incomplete}}
{{IncidentCargo
{{IncidentCargo
|Company=Echelon Fitness
|Company=Echelon Fitness
Line 10: Line 8:
|Type=Firmware lockout
|Type=Firmware lockout
|Description=Echelon pushed firmware updates blocking third-party apps, requiring server authentication & breaking QZ compatibility for users
|Description=Echelon pushed firmware updates blocking third-party apps, requiring server authentication & breaking QZ compatibility for users
}}Echelon pushed firmware update blocking third-party apps, requiring server authentication and breaking QZ compatibility for thousands of users
}}A July 2025 firmware update pushed by Echelon Fitness retroactively blocked third-party fitness applications from connecting to their devices. The update affected users of QZ (qdomyos-zwift), an open-source bridging application that enables cross-platform compatibility with fitness platforms like [[wikipedia:Zwift|Zwift]], [[wikipedia:Peloton_Interactive|Peloton Digital]], & others.
 
{{Infobox Incident
| title = Echelon Fitness Firmware Lockout (2025)
| date = July 2025
| affected_products = Echelon Connect bikes, treadmills, rowers
| company = Echelon Fitness
| type = Firmware update restriction
| affected_users = Thousands of QZ app users
| status = Ongoing
}}
 
A July 2025 firmware update pushed by Echelon Fitness retroactively blocked third-party fitness applications from connecting to their devices. The update affected users of QZ (qdomyos-zwift), an open-source bridging application that enables cross-platform compatibility with fitness platforms like [[wikipedia:Zwift|Zwift]], [[wikipedia:Peloton_Interactive|Peloton Digital]], & others.


==Background==
==Background==


===QZ & Cross-Platform Compatibility===
===QZ & cross-platform compatibility===
QZ (qdomyos-zwift) was created in September 2020 by Italian software engineer [[wikipedia:Roberto_Viola|Roberto Viola]].<ref>{{cite web |url=https://robertoviola.cloud/2025/07/22/how-i-built-qz-and-how-echelon-is-now-breaking-it/ |title=How I Built QZ—and How Echelon Is Now Breaking It |author=Roberto Viola |date=22 July 2025 |access-date=23 July 2025}}</ref> The application functions as a Bluetooth bridge that intercepts proprietary communications from closed fitness devices & translates them into standard protocols compatible with other mainstream fitness platforms.
QZ (qdomyos-zwift) was created in September 2020 by Italian software engineer [[wikipedia:Roberto_Viola|Roberto Viola]].<ref>{{cite web |url=https://robertoviola.cloud/2025/07/22/how-i-built-qz-and-how-echelon-is-now-breaking-it/ |title=How I Built QZ—and How Echelon Is Now Breaking It |author=Roberto Viola |date=22 July 2025 |access-date=23 July 2025}}</ref> The application functions as a Bluetooth bridge that intercepts proprietary communications from closed fitness devices & translates them into standard protocols compatible with other mainstream fitness platforms.


For almost five years, QZ maintained compatibility with Echelon devices. Viola notes that the app ''"helped Echelon sell tens of thousands of bikes"'' by making them compatible with multiple training platforms. Viola also personally recommended the Echelon as the ''"best indoor bike on the market."''<ref name="viola-blog">{{cite web |url=https://robertoviola.cloud/2025/07/22/how-i-built-qz-and-how-echelon-is-now-breaking-it/ |title=How I Built QZ—and How Echelon Is Now Breaking It |author=Roberto Viola |date=22 July 2025 |access-date=23 July 2025}}</ref>
For almost five years, QZ maintained compatibility with Echelon devices. Viola notes that the app ''"helped Echelon sell tens of thousands of bikes"'' by making them compatible with multiple training platforms. Viola also personally recommended the Echelon as the ''"best indoor bike on the market."''<ref name="viola-blog">{{cite web |url=https://robertoviola.cloud/2025/07/22/how-i-built-qz-and-how-echelon-is-now-breaking-it/ |title=How I Built QZ—and How Echelon Is Now Breaking It |author=Roberto Viola |date=22 July 2025 |access-date=23 July 2025}}</ref> Prior to the incident, Echelon's official marketing materials explicitly promoted third-party compatibility. Their FAQ stated devices were designed to give users '''''"the flexibility to use your favorite devices"''''' & specifically mentions "third party apps you can use as well."<ref name="echelon-faq" />


===Echelon's Business Model===
===Echelon's business model===
Echelon Fitness markets connected fitness equipment ranging from $500 entry-level models to $2,495 premium bikes. The company operates a subscription service priced between $29.99-$39.99 monthly or $399.99-$699.99 annually for access to live & on-demand fitness content.<ref name="echelon-faq">{{cite web |url=https://echelonfit.com/pages/app-faqs |title=APP FAQs |publisher=Echelon Fit |access-date=23 July 2025}}</ref>
Echelon Fitness markets connected fitness equipment ranging from $500 entry-level models to $2,495 premium bikes. The company operates a subscription service priced between $29.99-$39.99 monthly or $399.99-$699.99 annually for access to live & on-demand fitness content.<ref name="echelon-faq">{{cite web |url=https://echelonfit.com/pages/app-faqs |title=APP FAQs |publisher=Echelon Fit |access-date=23 July 2025}}</ref>
[[File:Echelon.png|alt=Subscriptions from echelon's website [1]|thumb|Subscriptions from echelon's website <ref>{{Cite web |title=Choose your Premier Subscription – Echelon Fit US |url=https://echelonfit.com/collections/choose-your-united-sub?_ab=0&_fd=0&_sc=1}}</ref>]]
[[File:Echelon.png|alt=Subscriptions from echelon's website [1]|thumb|Subscriptions from echelon's website <ref>{{Cite web |title=Choose your Premier Subscription – Echelon Fit US |url=https://echelonfit.com/collections/choose-your-united-sub?_ab=0&_fd=0&_sc=1}}</ref>]]


==July 2025 Firmware Update==
==July 2025 firmware update==
 
===Server-based auth system===
In July 2025, Echelon pushed a firmware update that implemented a server-based authentication system. The new system requires devices to:
In July 2025, Echelon pushed a firmware update that implemented a server-based authentication system. The new system requires devices to:


Line 47: Line 31:
According to Viola's technical analysis, the update is "non-reversible" - once installed, users cannot downgrade to previous firmware versions.<ref name="viola-blog" />
According to Viola's technical analysis, the update is "non-reversible" - once installed, users cannot downgrade to previous firmware versions.<ref name="viola-blog" />


===Technical Implementation===
===Technical implementation===
The firmware creates a '''boot-time server handshake''' requirement before any functionality is enabled. Devices send authentication requests to Echelon servers, which respond with rotating unlock keys. Without successful validation, devices become completely non-functional, including for basic manual workouts.<ref name="viola-blog" />
The firmware creates a '''boot-time server handshake''' requirement before any functionality is enabled. Devices send authentication requests to Echelon servers, which respond with rotating unlock keys. Without successful validation, devices become completely non-functional, including for basic manual workouts.<ref name="viola-blog" />


The system specifically targets third-party apps through '''Bluetooth access control''' that only activates after server authentication. This hardware-level lockout cannot be bypassed through software means, effectively transforming ownership into a subscription-based permission model.<ref name="viola-blog" />
The system specifically targets third-party apps through '''Bluetooth access control''' that only activates after server authentication. This hardware-level lockout cannot be bypassed through software means, effectively transforming ownership into a subscription-based permission model.<ref name="viola-blog" />


===Impact on Third-Party Applications===
===Impact on third-party applications===
The firmware update completely blocks QZ & similar third-party applications from communicating with Echelon devices. This affects not only advanced features like automatic resistance control, but also prevents basic manual workouts without internet connectivity & server approval.<ref name="viola-blog" />
The firmware update completely blocks QZ & similar third-party applications from communicating with Echelon devices. This affects not only advanced features like automatic resistance control, but also prevents basic manual workouts without internet connectivity & server approval.<ref name="viola-blog" />


==Marketing vs. Reality==
==Consumer impact==


===Advertised Compatibility===
===Financial losses===
Echelon's official marketing materials explicitly promoted third-party compatibility. Their FAQ states devices were designed to give users '''''"the flexibility to use your favorite devices"''''' & specifically mentions "third party apps you can use as well."<ref name="echelon-faq" />
 
===FitOS Platform Contradiction===
Echelon's FitOS platform, introduced for screened equipment, actually '''expanded''' third-party app access to include Netflix, Disney+, & other entertainment apps.<ref>{{cite web |url=https://echelonfit.com/blogs/blog/introducing-fitos |title=Introducing FitOS |publisher=Echelon Fit |access-date=23 July 2025}}</ref> This contradicts the simultaneous restriction of core fitness functionality through firmware updates.
 
===Lack of Official Communication===
No official Echelon press release, statement, or justification for the July 2025 blocking appears to be present. The company's Terms of Service reserves broad rights to "modify the Services" without specific disclosure about functionality restrictions.<ref>{{cite web |url=https://echelonfit.uk/pages/terms-and-conditions |title=Terms and Conditions |publisher=Echelon Fit UK |access-date=23 July 2025}}</ref>
 
==Consumer Impact==
 
===Financial Losses===
Users who purchased Echelon devices specifically for third-party compatibility are affected:
Users who purchased Echelon devices specifically for third-party compatibility are affected:


Line 77: Line 50:
One affected UK user commented: <blockquote>''"This is infuriating. I paid £1,199 for a bike in 2020, & a further £399 for 2 years of classes, so surely what I choose to do with the hardware I purchased outright is none of their business!"''<ref name="viola-blog" /></blockquote>
One affected UK user commented: <blockquote>''"This is infuriating. I paid £1,199 for a bike in 2020, & a further £399 for 2 years of classes, so surely what I choose to do with the hardware I purchased outright is none of their business!"''<ref name="viola-blog" /></blockquote>


===Elimination of Offline Functionality===
===Elimination of offline functionality===
The update removes all offline workout capabilities, requiring constant internet connectivity for any device operation. Users report being unable to perform basic manual workouts without server validation.<ref name="viola-blog" />
The update removes all offline workout capabilities, requiring constant internet connectivity for any device operation. Users report being unable to perform basic manual workouts without server validation.<ref name="viola-blog" />


==Legal Precedents==
==Echelon's response==
===Press release===
On July 29, 2025, Echelon issued a press release announcing the implementation of "comprehensive security enhancements" including jailbreak detection mechanisms to prevent unauthorized access to their equipment.<ref>{{cite web |url=https://www.prnewswire.com/news-releases/echelon-implements-advanced-security-measures-to-prevent-any-unwarranted-access-to-fitness-equipment-data-302208547.html |title=Echelon Implements Advanced Security Measures to Prevent Any Unwarranted Access To Fitness Equipment Data |publisher=PR Newswire |date=29 July 2025 |access-date=27 August 2025}}</ref> The company specifically targeted QZ developer Roberto Viola, describing him as a "bad actor" who "attempts to bypass Echelon's fitness ecosystem" by charging users $6.99 for access to unauthorized connections.
 
Echelon announced they are "actively reviewing legal action under the Digital Millennium Copyright Act (DMCA) and other applicable laws" against third-party applications. The company stated that customers using applications like QZ would have their warranties voided for violating terms of service and "compromising the secure operation" of products.
 
CEO Lou Lentine framed the issue as protecting American intellectual property from "foreign individuals and entities," stating: <blockquote>"There are a few bad actors in the global marketplace who are constantly trying to shortcut the investments made by Echelon and other American companies—through fraud, copying, and stealing."</blockquote>
 
Concurrent with blocking third-party access, Echelon announced a new "Authorized Partnership Program" for companies seeking approved connections to their equipment. The program offers access to official APIs and developer support, though no timeline or application process was provided.


===iFIT Class Action Settlement===
Echelon repositioned their offerings around two tiers:
The '''Balfour et al. v. iFIT Health & Fitness, Inc.''' case (2023-2024) gives us some directly relevant precedent. mandatory software updates rendered fitness equipment touchscreens "totally inoperable," resulting in a settlement providing free repairs, refunds, & discount coupons.<ref>{{cite web |url=https://www.classaction.org/news/ifit-class-action-says-software-update-left-fitness-equipment-totally-inoperable |title=iFIT Class Action Says Software Update Left Fitness Equipment 'Totally Inoperable' |publisher=ClassAction.org |access-date=23 July 2025}}</ref>
*'''Freestyle Mode''' - Described as "no charge" but requires internet connectivity for "secure sign-in authentication"
*'''Premium Streaming Plans''' - Subscription plans starting at $19.99 monthly for access to classes and features


===HP Printer Firmware Cases===
The press release did not address the removal of offline functionality or the impact on existing customers who had purchased devices with advertised third-party compatibility.
Multiple HP settlements ($1.5 million in 2019, additional settlement in 2025) established precedent for challenging manufacturers who use firmware to block third-party compatibility, based on Magnuson-Moss Warranty Act violations.<ref>{{cite web |url=https://www.theregister.com/2025/03/19/hp_printer_lawsuit_settled/ |title=HP settles lawsuit after killing first responder's printers |publisher=The Register |date=19 March 2025 |access-date=23 July 2025}}</ref>


===FTC Policy on Repair Restrictions===
==FULU Foundation bounty==
The FTC unanimously adopted a policy statement in July 2021 to ''"ramp up law enforcement against illegal repair restrictions,"'' with subsequent enforcement actions against manufacturers for warranty language restricting third-party repairs.<ref>{{cite web |url=https://www.ftc.gov/news-events/news/press-releases/2021/07/ftc-ramp-law-enforcement-against-illegal-repair-restrictions |title=FTC to Ramp Up Law Enforcement Against Illegal Repair Restrictions |publisher=Federal Trade Commission |date=July 2021 |access-date=23 July 2025}}</ref>
After the initial publication of the story, Louis Rossmann released a $20,000 bounty<ref>{{cite web |url=https://www.youtube.com/watch?v=2zayHD4kfcA |title=Fulu Foundation offers $20,000 bounty to repair Echelon firmware lockout |author=Louis Rossmann |publisher=YouTube |date=July 2025 |access-date=27 August 2025}}</ref> for anyone who could create a method to bypass the restrictions placed on Echelon bikes. In August, the winner of the bounty was announced,<ref>{{cite web |url=https://www.404media.co/developer-unlocks-newly-enshittified-echelon-exercise-bikes-but-cant-legally-release-his-software/ |title=Developer Unlocks Newly Enshittified Echelon Exercise Bikes But Can't Legally Release His Software |author=Jason Koebler |publisher=404 Media |date=August 2025 |access-date=27 August 2025}}</ref> however the solution used to claim the bounty was not released. Louis Rossmann stated that the reason for not releasing was the impact of a US law (17 U.S. Code § 1201), which prevents the sharing of methods used to bypass a technological measure designed to manage access to a product.<ref>{{cite web |url=https://www.youtube.com/watch?v=chPzslZKBhI |title=I started an organization to dismantle the DMCA - here's why |author=Louis Rossmann |publisher=YouTube |date=27 August 2025 |access-date=27 August 2025}}</ref>


==Consumer Recourse==
==Consumer recourse==


===Immediate Actions===
===Immediate actions===
Roberto Viola recommends affected users:
The following recommendations for affected users were made by Roberto Viola:
*'''avoid all firmware updates''' & disable automatic updates
*'''avoid all firmware updates''' & disable automatic updates
*'''delete Echelon app''' to prevent forced updates
*'''delete Echelon app''' to prevent forced updates
Line 100: Line 81:
*document current functionality for potential claims<ref name="viola-blog" />
*document current functionality for potential claims<ref name="viola-blog" />
If it prompts you to install a firmware update on reboot, you may avoid this by rebooting the bike again, then, in WiFi settings at the first opportunity, entering a custom SSID and leaving it blank. For some reason, this appears to be the only way to get it to switch from an existing connection. You will need to enter your actual WiFi details again on the member login screen.
If it prompts you to install a firmware update on reboot, you may avoid this by rebooting the bike again, then, in WiFi settings at the first opportunity, entering a custom SSID and leaving it blank. For some reason, this appears to be the only way to get it to switch from an existing connection. You will need to enter your actual WiFi details again on the member login screen.
=== Optional actions ===
You can lock the bike to a fixed resistance and use it as a basic exercise bike without smart features. This is useful if you want to start a workout quickly without powering on the bike or adjusting the resistance again after pausing in the middle of a workout.
# Make sure the bike is plugged in.
# Begin pedaling so the bike powers on.
# Turn the resistance knob to your desired level. (It may take a moment for the knob to respond after powering on.)
# Unplug the bike — it will now stay locked at that resistance.
# If you want to change the resistance later, repeat the process.


==References==
==References==
Line 109: Line 99:
*[https://github.com/cagnulein/qdomyos-zwift/issues/1752 GitHub Issue #1752 - Echelon connection problems]
*[https://github.com/cagnulein/qdomyos-zwift/issues/1752 GitHub Issue #1752 - Echelon connection problems]
*[https://www.classaction.org/news/ifit-class-action-says-software-update-left-fitness-equipment-totally-inoperable iFIT Class Action Settlement Information]
*[https://www.classaction.org/news/ifit-class-action-says-software-update-left-fitness-equipment-totally-inoperable iFIT Class Action Settlement Information]
*[https://consumerrights.wiki Consumer Rights Wiki main page]


[[Category:CRW]]
[[Category:CRW]]
Retrieved from "https://consumerrights.wiki/Echelon_fitness_firmware_lockout"