Rendered at 01:33:13 GMT+0000 (Coordinated Universal Time) with Cloudflare Workers.
RobMurray 1 hours ago [-]
It's really sad that getting a shell on a device you own is now considered a vulnerability.
FungalRaincloud 23 minutes ago [-]
I understand having a locked-down version of mass-produced tech that is for the general consumer. However, I also firmly believe that anyone who wants to should be able to bypass that. Make it void the warranty, don't allow customer support, whatever you want. But make it a free option to have complete control. If I buy a piece of hardware, I should own it.
(I say this as I am currently charging a cheap doorbell camera I bought, so that I can start dumping data from it and reverse engineer its protocol, solely so that I can lock it down to my local network...We needed something at the time, or I would have bought something more expensive that had an open protocol...)
mzajc 2 hours ago [-]
This is a very neat and approachable write-up, but is the final result really a hack? If I understand correctly, you're getting an unprivileged shell on a device you own and have paired with your smartphone; more or less equivalent to installing a terminal emulator on your smartphone, except it's smart glasses in this case.
Should the ability to own one's devices really be treated as a vulnerability and reported to security teams?
no-dr-onboard 2 hours ago [-]
"hack" on hackernews essentially means "I used my computer to do something". The overwhelming population of people here aren't security engineers, but rather developers.
mzajc 2 hours ago [-]
I considered that, but the mentions of pwn2own and the bug bounty program have me thinking "hack" is used in the security/mainstream sense.
nullsanity 21 minutes ago [-]
[dead]
stavros 1 hours ago [-]
How is it not a hack to do something on a device that doesn't let you do it? Yes, the device should let you do whatever you want, but it doesn't, therefore this is a hack.
I'm going to try it on my glasses, and disable autoupdating ASAP.
frenchsalmon 2 hours ago [-]
Nice. How robust is this with software upgrades though? Also looks like arbitrary code execution in the app sandbox, so no persistance?
(I say this as I am currently charging a cheap doorbell camera I bought, so that I can start dumping data from it and reverse engineer its protocol, solely so that I can lock it down to my local network...We needed something at the time, or I would have bought something more expensive that had an open protocol...)
Should the ability to own one's devices really be treated as a vulnerability and reported to security teams?
I'm going to try it on my glasses, and disable autoupdating ASAP.