Everything I own, owned

gist

Chaz Schlarp spent evenings letting Claude reverse-engineer five arm's-reach peripherals: an Insta360 Link webcam, ASUS monitor, Shure MV7 mic, Elgato Cam Link, and Key Light Mini. Across about 13 hours of agent churn he found unsigned update paths, a plaintext HID shell that can drive mute LEDs independently, a patchable webcam activity LED, and a WiFi memory poke that disables Ed25519 update signing. He frames the work as both empowering interoperability and collapsing the cost of firmware implants—and of worms that could auto-reverse-engineer adjacent hardware.

ideas

• Agentic reverse engineering collapses per-device labor. Shared prompts against firmware, update tools, and live devices produced validated docs and flashers in hours rather than weeks of hand RE.
• Weak update trust is the common case. The webcam, monitor, microphone, and Cam Link accepted attacker-controlled firmware with checksums at best and no meaningful anti-tamper.
• Signed updates are not secure boot. The Key Light Mini verifies Ed25519 only during update; an unauthenticated network UART memory poke can turn that check into a no-op while the device keeps running.
• Indicators can lie once firmware is owned. Activity LEDs and mute lights can be decoupled from recording or muting, so host UX cannot assure a peripheral stays only what it appears to be.
• WebHID and host-resident malware widen the path. A careless permissions prompt can permanently backdoor some devices, and malware already on the host has the hardware in hand for free.

quotes