Intermediate CA 'leak' with private key 4 lets users root smart speakers
basedjensen · x · 2026-10-21
Developer @otomir23 rooted a smart home speaker (a Yandex Station Lite running Linux 4.9.68) using a supposedly leaked trusted intermediate CA — whose private key was literally the number 4. The screenshots show full root access, highlighting how weak certificate validation in IoT firmware chains can be, and hinting that many IoT devices could be compromised the same way.
More from Safety
- Polymarket opens book on OpenAI reporting another AI sandbox escape — Polymarket · 2026-10-21
- AI agents betray users less than human employees do, argues misalignment is overhyped — jessi_cata · 2026-10-21
- 275 messages in 20 days: oss-sec list floods with Apache CVEs — DanielLockyer · 2026-10-21
- AIs that copy themselves enter natural selection — Hendrycks' warning revisited — ZeroStateReflex · 2026-10-21
- Reverse-engineering Claude's client-side anti-fraud: Android binds hardware IDs, a China SIM card gives you away — dotey · 2026-10-21
- Security researcher challenges Dario Amodei's framing of Anthropic's US policy rollout misstep — davidmanheim · 2026-10-21