A STORY OF WIFI SECRETS, UART LOCKDOWNS, AND A DAMAGED FLASH MEMORY CHIP

Summary from the TLDR InfoSec newsletter

Researchers extracted firmware from an Eufy HomeBase 2 by desoldering its Winbond flash chip and reading it over SPI. They recovered most of firmware 3.4.2.2h, losing a 64 KB block during chip removal. Reverse engineering showed the OCEAN_ management Wi-Fi password uses HMAC-SHA256 over an I2C-read value, keyed by the device serial number, then URL-safe base64 encoding. The UART lockdown came from a login script checking an NVRAM debug flag. They patched the intact recovery image to force a root shell, reflashed it, then staged a temporary filesystem to run the main home_security binary for dynamic analysis.