An embedded-hardware teardown of the Eufy HomeBase 2 (firmware 3.4.2.2H) documents the process of extracting and unpacking flash contents from a Winbond 25Q256JWEQ chip. Initial on-board SPI reads with spring clips produced inconsistent, garbage dumps because other board components interfered, so the flash was desoldered and read off-board with a Raspberry Pi. Desoldering likely damaged a 64 KB block that remained unreadable, complicating extraction. Despite that, binwalk and 7z carving recovered U-Boot 1.1.3, a MIPS uImage Linux kernel, a JFFS2 filesystem and many XZ-compressed streams, though data-after-end and stream fragmentation required ad-hoc carving and manual searching to retrieve useful files.
Reverse engineering focused on how the OCEAN_XXXXXX management Wi‑Fi ESSID and password are generated. Strings and shell scripts show SSID and WPAPSK NVRAM entries and reveal the ESSID is constructed by concatenating "OCEAN_" with a derived SSID_MAC taken from ra0’s MAC address (awk picks bytes 4-6). The author used radare2 to trace related binaries and validate the generation logic and strength. Additional sections describe overcoming a UART lockdown by reflashing a backdoored U-Boot to gain a shell, performing filesystem workarounds to run the main binary, and technical notes on the limits and frustrations encountered during the hardware-focused research.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
Neuralwatt emphasizes that prompt caching significantly impacts energy efficiency in AI models, with cache misses roughly doubling energy use. Proper harness design can reduce unnecessary recomputation, saving both energy and computational costs. (neuralwatt.com)
An integration in Home Assistant scans secrets without user authorization, causing privacy concerns. The user warns that this mechanism could be abused, despite no consent given. (github.com)
Cloudera has been ordered to pay back wages and faces a two-year debarment for discriminating against US workers. The settlement was secured by the U.S. Department of Justice and the Department of Labor. (justice.gov)
911 emergency response system in the US struggles to effectively address mental health crises and properly route emergency calls. This highlights the need for specialized response protocols to improve outcomes. (themarshallproject.org)
The seeds for the NIST elliptic curves were generated using the drand48 random number generator seeded with the current UNIX timestamp in 1997-98. A team from Anthropic discovered and claimed the bounty by revealing this cryptographic history, donating the prize to Let’s Encrypt. (words.filippo.io)
Claude revealed that the seeds for the widely used ECDSA elliptic curve standards were generated using a Unix time seed in the C library's random-number generator, not by hashing humorous phrases as previously thought. This discovery clarifies the long-standing mystery about the origins of these cryptographic parameters. (anthropic.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.