Back

Login

also I hope they wiped these hard drives

but given the state of them when they arrived at ewaste?

no they did not

when you see a gaylord stacked high with NUCs and half of them still have USB fans attached, you know these were all just yanked off a shelf.
no one wiped these.

I have now stuck the hard drive in my imaging box

it turns out it was in service as of June.

and this one has log errors about the sensors in the bathroom and bedroom. this was used. fuck.

HEY FUN FACT: this was used as part of an Alexa/google home type thing! this is the "cloud" half, as in the part sitting in a warehouse somewhere.
It turns out every time the customer asked for something from the smart assistant, the WAV file was sent to the cloud box

where it is still stored. and I now have eleven thousand wave files

god the logs are full of errors about assorted video streams failing.
so this thing was connecting to something which had cameras. like, I can tell which room of the house failed.

now I don't think there's any video stored on this device, but keep in mind: the fools that made this thing fill up with WAV files? they also designed the video streaming part. Where are those videos stored, and how safe are they?

or maybe the fools who dumped all the NUCs from their entire "AI remote healthcare" in the recycling without yanking any drives are just somehow REALLY GOOD at knowing how to secure their s3 buckets.

assuming their S3 keys aren't just saved in this harddrive somewhere

jesus christ this isn't the only time THIS MONTH I've found an IoT device and checked the filesystem contents and it's got their private git repos on it

and now I can email the lead developer.

or just commit to their git repo, I guess.

okay so the good news is that they don't just have S3 keys laying around in plain text.
the other good news is that they have a secrets manager
the bad news is that they rolled their own secrets manager
the extra bad news is that I have the source for said secrets manager
and the extra extra bad news is that it has to decrypt those keys without external input, meaning I have all the parts here to pull out their s3 keys

oh hey!

this thing authenticates to some of their servers (which are still up, even if the company might not be (this is unknown at the moment)) over SSH! using keys kept in the same home-rolled vault thing!

so I can SSH into their servers now!

oh god this thing sends email from gmail

please tell me they didn't embed the google login into this device

tempted to drive past their HQ with a megaphone "I'VE GOT YOUR MODELS, YOU AI HACKS!"

wait. did they seriously stuff videos into their redis database?

they sure did! I have a video of someone picking something up from outside a door.

okay found their S3 creds. they hardcoded them in a Jenkinsfile.

not a good sign to see a bash case statement for environment, and prod sets the server to FOOBAR.EGG
and test sets the server to... FOOBAR.EGG

anyway I'm gonna be near their HQ on thursday. Maybe I'll stop by and ask if they're still in business, and if they are, do they know where their NUCs are?

and in case anyone is getting deja-vu:

This is a completely different company than the other one I found like 3 weeks ago:

https://digipres.club/@foone/112817523308786223

I'm really not the right person to work in computer security research, but it'd be nice to have a sort of consulting job with a local one where I can just point them at some really broken shit and they investigate it and maybe give me a commission

because this keeps happening

Why the fuck is this on hacker news? ugh. I'm gonna need to run my own mastodon instance, aren't I?

If you found this on hacker news, you owe me 5$:

https://digipres.club/@foone/112929955279707608

BTW I want to make something clear:
remember how I said there was a gaylord full of NUCs?
yeah. I took one. of like, a hundred.