I spent two evenings decoding the LED wiring on the BSides Joburg 2026 badge by hand, wrote firmware around what I found, and shipped it. Then the guy who built the badge sent me the original firmware, which I could have read off the chip at any point, and which proved my map wrong on every single pin.
I put five cheap embedded devices on their own VLAN, took away the internet, and wrote down what they did about it. One of them blamed my router while it was still uploading. One of them downloads a shell script over plain HTTP every boot and runs it as root. One of them was fine, which was somehow the most upsetting result.
1. Why This Camera? I came across this cheap IPC camera on a local marketplace here in South Africa. The price was perfect to mess around with the device and potentially break it. The device cost around R300, or roughly $10. My goal with this device was to go from zero to one hundred in terms of how I document findings, while also looking at every nook and cranny I could reasonably reach. ...
Two devices off the same shelf, two completely different threat models. A cheap XiongMai-based IP camera that waves you through at every layer, versus a TP-Link VIGI NVR that makes you fight for every inch and still keeps its secrets in hardware.