The login barrier
The vendor acknowledged that brute-force attacks could bypass protections on the device’s web portal.
Vendor advisory01 / THE STORY
It started with
a student’s curiosity.
Rey found an unfamiliar device on his high school’s network. Getting a secondhand unit to examine turned a question about a ceiling sensor into a public security investigation.
In his BSidesPDX retrospective, Rey describes moving from web security into hardware research and the Portland community that helped him along the way. [5]
FROM NETWORK DISCOVERY TO DEF CON
Reynaldo and nyx took the device apart, extracted its firmware, and examined the software behind its reassuring exterior. Their work became Unmasking the Snitch Puck, presented at DEF CON 33 in August 2025. [1] [8]
WIRED reported that attackers on the device’s network could guess weak administrator passwords and install custom firmware. Researchers demonstrated live listening through a secondhand HALO 3C’s microphones. [2]
Read the finding carefully. A demonstrated capability is not proof that deployed devices were secretly recording people. The vendor’s advisory said it knew of no exploitation in customer environments. [3]