AI
Inside the Halo 3C: A Raspberry Pi in Disguise
Ray found the device on his school’s unsegmented Wi-Fi by its OUI from IP Video Corporation. Later he bought one on eBay for half the list price. The opened case revealed a Raspberry Pi Compute Module 4 sandwiched between two PCBs. The bottom board holds sensors: SHT40 temperature/humidity, SCD41 CO2 monitor ($15 part cost), SPS30 particle detector with a laser fan, MEMS microphones connected to a Waveshare audio codec, and a PIR motion sensor. The top board has PoE in/out for daisy-chaining and a ring of RGB LEDs for alerts.
Secure Boot Was Not Booted
The Broadcom BCM2711 on the Pi supports secure boot, but the Halo shipped with it disabled. Nyx removed the CM4 and placed it on a carrier board that triggers USB bootloader mode. A Raspberry Pi script then exposes the eMMC as a block device. They dd’d it and found an unencrypted filesystem running Raspbian 10 and Node.js. The firmware update files contain the AES key and IV in the first few bytes of the header. The update script (extract_upk) unpacks a tar.gz and then runs any file named “extra” it finds inside. That gave them a root shell with a one-line reverse shell payload.
Login Brute Force and a Cloud Backdoor
The web dashboard’s rate-limiting stores the attempt counter in a cookie. A script that never sends the cookie can guess passwords at 3,000 tries per minute. Five hours on a million-word list works. Meanwhile, the device opens a TLS websocket to IoT Manager, the vendor’s cloud. Any message received over that socket is relayed to the local web API as an admin request. The API skips authentication when the request comes from localhost, setting the username to “cloud server” and is_admin to true. This gives Motorola remote root access to every deployed Halo.
The Campaign Against Surveillance Creep
Nyx traced the Halo from schools to Section 8 housing, banks, hotels, and hospitals. He argued that the device’s “privacy without audio recording” claim is meaningless when a cloud toggle could enable the microphones at any time. The same architecture could be forced into private homes by insurance companies. He urged the audience to buy cop tech on eBay and tear it down, attend school board meetings, and donate to the EFF. Oregon Senator Ron Wyden was cited as a pro-privacy ally who listens to hacker constituents.
Notable Quotes
ensures privacy without audio recording. Halo marketing · ▶ Watch (3:26)
if it finds a file called extra, it [ __ ] runs it. nyx · ▶ Watch (16:19)
the swiveleyed loons have a point. nyx · ▶ Watch (34:34)
this is not a problem the free market is interested in solving because neither the people who sell this thing nor the ones who buy it are the ones who eventually have to suffer with the surveillance. nyx · ▶ Watch (36:48)
Key Takeaways
- The Halo 3C is a Raspberry Pi CM4 with secure boot disabled by default.
- Firmware update files contain the encryption key and sign nothing, enabling arbitrary code execution as root.
- A cloud reverse proxy gives Motorola admin access to every deployed device without user consent.
About the Speaker(s)
Reynaldo “buh0” started bug hunting at 15, attended Portland infosec meetups, and reverse-engineered a school surveillance device after discovering it on the network. This Defcon talk was his first mainstage appearance.
nyx is a Portland-based hacker and engineer with a degree in electrical and computer engineering and the OSCP. He develops system software for a Fortune 100 company’s internal consulting team and spends free time at the local hackerspace.