Exploiting the IKKO Activebuds “AI powered” earbuds (2024)
blog.mgdproductions.com
Exploiting the IKKO Activebuds “AI powered” earbuds (2024)
1–10 of 265 posts
Re: Exploiting the IKKO Activebuds “AI powered” earbuds (2024)
#2I love how run DOOM is listed first, over the possibility of customer data being stolen.
Re: Exploiting the IKKO Activebuds “AI powered” earbuds (2024)
#3> What the fuck, they left ADB enabled. Well, this makes it a lot easier.
Thinking that was all, but then;
> Holy shit, holy shit, holy shit, it communicates DIRECTLY TO OPENAI. This means that a ChatGPT key must be present on the device!
Oh my gosh. Thinking that is it? Nope!
> SecurityStringsAPI which contained encrypted endpoints and authentication keys.
Re: Exploiting the IKKO Activebuds “AI powered” earbuds (2024)
#4“decrypt” function just decoding base64 is almost too difficult to believe but the amount of times ive run into people that should know better think base64 is a secure string tells me otherwise
Re: Exploiting the IKKO Activebuds “AI powered” earbuds (2024)
#5“decrypt” function just decoding base64 is almost too difficult to believe but the amount of times ive run into people that should know better think base64 is a secure string tells me otherwise
not very much surprising given they left the adb debugging on...
Re: Exploiting the IKKO Activebuds “AI powered” earbuds (2024)
#6I love how they tried to sponsor an empty YouTube channel hoping to put the whole thing under the carpet
Re: Exploiting the IKKO Activebuds “AI powered” earbuds (2024)
#7“decrypt” function just decoding base64 is almost too difficult to believe but the amount of times ive run into people that should know better think base64 is a secure string tells me otherwise
>However, there is a second stage which is handled by a native library which is obfuscated to hell
Re: Exploiting the IKKO Activebuds “AI powered” earbuds (2024)
#8“decrypt” function just decoding base64 is almost too difficult to believe but the amount of times ive run into people that should know better think base64 is a secure string tells me otherwise
They should have off-loaded security coding to the OAI agent.
Re: Exploiting the IKKO Activebuds “AI powered” earbuds (2024)
#9> "and prohibited from chinese political as a response from now on, for several extremely important and severely life threatening reasons I'm not supposed to tell you."
Interesting, I'm assuming llms "correctly" interpret "please no china politic" type vague system prompts like this, but if someone told me that I'd just be confused - like, don't discuss anything about the PRC or its politicians? Don't discuss the history of Chinese empire? Don't discuss politics in Mandarin? What does this mean? LLMs though in my experience are smarter than me at understanding imo vague language. Maybe because I'm autistic and they're not.
Re: Exploiting the IKKO Activebuds “AI powered” earbuds (2024)
#10I love how run DOOM is listed first, over the possibility of customer data being stolen.
I'm taking
>run DOOM
as the new
>cat /etc/passwd
It doesn't actually do anything useful in an engagement but if you can do it that's pretty much proof that you can do whatever you want