x.comthreadP7RIM3 (@P7RIM3) on X
Tweet about an unofficial open firmware, "waved", for the Insta360 Wave conference speakerphone, written as a single Rust program with a one-script revert to stock. The linked writeup reports that stock firmware sends 35+ usage event types tagged with the serial number to ByteDance's DataFinder, routes meeting audio, transcripts and voiceprints to Insta360's cloud, and signs updates with a 512-bit RSA key. Releases up to 1.0.13.6 exposed a root telnet shell with the password 123456. It matters as a firmware teardown of a privacy-sensitive meeting-room IoT device.
TL;DR Open replacement firmware for the Insta360 Wave speakerphone; stock firmware phones home to ByteDance DataFinder, uploads audio and voiceprints, uses a 512-bit RSA update key, and old builds had root telnet with password 123456.
Organisations named here
- ByteDance
- DataFinder
- waved
Technologies named here
- Insta360 Wave firmware releases up to 1.0.13.6
- Rust
- Insta360 Wave
Techniques named here
- Replacing stock device firmware with custom open firmware
- Telemetry exfiltration
- Default credential root telnet shell with password 123456
Related in Hardware & RF
eprint.iacr.orgpaperHAETAE on a Diet: Less Stack, Less Time on Low-End Microcontrollers
github.comrepogeo-tp/ESP32-Bit-Pirate
github.comrepo