#firmware

3 articles

The camera-hacking crew left 407 MB of their own working directory on the internet, shell history included

2026-08-20Gadgets

Hunt.io reconstructed Operation CameraSwarm from the operator's own exposed files: 2,616 of them across 234 folders, with tooling, logs and command history. The campaign took more than 14,530 Dahua devices in 35 days using password guessing, two authentication bypasses and a peer-to-peer relay — concentrated in Ukraine and Russia.

Six flaws sit in the code that checks whether firmware is genuine — and it has been there since 2013

2026-08-10Gadgets

Binarly found six vulnerabilities in U-Boot's FIT signature verification. Two allow code execution during verification itself. The code dates to U-Boot 2013.07, and the devices running it mostly update through vendors who may never ship a patch.

A hardware wallet's random number generator wasn't random — and $88.6m left in 41 minutes

2026-08-10Gadgets

COLDCARD firmware fell back to a deterministic pseudo-random generator seeded from the chip ID and system timing. Researchers say seeds made that way could be reconstructed offline, and the sweep began roughly 30 hours before the flaw was public.