Episode notes
A researcher pointed Claude Opus 5 at five gadgets on his desk. It got into all five. The webcam recording light can stay off while the camera films. The one device that actually signed its updates only checked the signature during the install. Alex and Jordan also look at Slovakia pausing EU-funded highway cameras after an SMS from hardcoded Russian numbers opened a command line, cheap Android car stereos whose official updater installs the malware, and EU repair rules that force spare parts, not a software key. The side of tech news nobody talks about.
Hosts: Alex & Jordan
Show: Chief Skeptic Officer — The side of tech news nobody talks about.
Drop: Daily at 7:00 A.M. America/New_York
Episode date: 2026-08-24
In this episode
Everything I own, owned — Five desk gadgets. Thirteen hours of agent work. A signature check that only ran while the update was installing.
The camera was the delivery — Slovakia paused 279 EU-funded speed cameras. An SMS from stored Russian numbers opens a command line. The ministry called a closed network a control.
The updater is the installer — Aftermarket Android car stereos. The vendor's own updater installs apps that were never on the unit. Fake ads and a rented home connection.
EU repair rules are in force — Makers must repair listed hardware. Spare parts are not a bootloader key.
Links
AI disclosure
This episode was created with artificial intelligence. Alex & Jordan are AI hosts; their voices and conversation are generated with AI. Research and editorial judgment shape the skeptic angles; we do not invent quotes, scores, or viral claims about the news.
Transcript
Alex and Jordan, turn by turn. Tap a line to jump in the player.
0:00
Alex
Jordan. I'm on the top post on Hacker News from last night. A guy pointed an AI at five gadgets on his own desk. A webcam, a monitor, a microphone, a video capture box, and a little Wi-Fi lamp.
0:13
Jordan
Pointed it how?
0:15
Alex
He handed it the built-in software from inside each device and let it dig. Two weeks of evenings. About thirteen hours of actual machine work. Ninety-eight prompts.
0:26
Jordan
And it got in?
0:28
Alex
Into all five. The webcam's little green recording light now stays off while the webcam records.
0:35
Alex
Also on the board: two more tabs and a quick one.
0:38
Jordan
Slovakia. Their national cyber security office is warning about the new highway speed cameras. A text message from one of a few Russian phone numbers opens a command line on the camera.
0:50
Alex
Thirty million euros of European money. Two hundred and seventy-nine cameras. The install is now paused.
0:57
Jordan
Then this one from Kaspersky. Cheap Android car stereos, the kind you buy online and bolt in yourself, shipped with an updater that installs apps nobody asked for. Fake ad clicks, and your car quietly carrying somebody else's internet traffic.
1:12
Alex
And the updater is the vendor's own.
1:15
Jordan
Last tab, and it's today. The European repair rules are in force. Makers have to fix your washing machine, your vacuum, your phone.
1:25
Alex
Fix the hardware. Nothing in there about the software lock.
1:30
Jordan
What if there was an AI that researched the tech news, checked the sources, and asked what the tech news is not telling you?
1:38
Alex
That's us. I'm Alex.
1:40
Jordan
And I'm Jordan.
1:42
Alex
You're listening to Chief Skeptic Officer, the side of tech news nobody talks about.
1:47
Jordan
Every day at seven A.M. New York time. Wherever you get your podcasts.
1:52
Jordan
If this is useful, subscribe. We do this every morning.
1:56
Alex
So, back to the desk. The author goes by schlarpc. Five devices, real hardware plugged in, and Claude Opus 5 reading the code inside them.
2:05
Jordan
The code inside them. Meaning what, exactly?
2:09
Alex
Firmware. The small built-in program that makes a webcam a webcam. You normally never see it.
2:16
Jordan
And thirteen hours. That sounds like a weekend.
2:19
Alex
That's the part that matters. Pulling one device apart like this used to be weeks of specialist work. Per device. That's why this kind of attack was a government hobby.
2:29
Jordan
And now it's an evening.
2:31
Alex
Two weeks of evenings. Five products.
2:34
Jordan
Start with the webcam. That's the one that made me look at mine.
2:38
Alex
Insta360 Link. Inside the firmware there's a table that says how the green light blinks. He edited the table. The light stays dark. The camera keeps filming.
2:47
Jordan
So the light is a suggestion.
2:51
Alex
The light is a suggestion. And the only thing guarding that firmware is a fingerprint number called an MD5.
2:58
Jordan
Which does what?
3:00
Alex
Nothing useful here. You change the file, you work out the new fingerprint yourself, you write it on the end. It matches. It's a label, not a lock.
3:09
Jordan
Fine. What about the ones that are actually locked?
3:12
Alex
The microphone and the lamp. The Shure microphone has a plain text command line sitting inside it. Forty-eight commands, no password, and you can reach it from a browser tab. There is a permission level, and the check just compares what you type against the name of the top level. So you type the short words for become supervisor, which on this microphone is "su sup". Now you are the supervisor.
3:33
Jordan
That's not security, that's a...
3:35
Alex
It's a spelling test. And the capture box had no signature at all.
3:40
Jordan
And the lamp?
3:42
Alex
The lamp is the one that stung. The Elgato key light actually signs its updates. Real cryptography.
3:49
Jordan
So that one held.
3:51
Alex
The signature check only runs while an update is being installed. Never when the lamp switches on. So the AI sent one small command over the network, and that command switches the check off in memory. After that, the lamp will load firmware nobody signed.
4:05
Jordan
...oh.
4:07
Alex
This is my week. I'm mid-migration on our logging, and somebody keeps telling me the checksum runs at deploy. Deploy happens once. The thing then runs for a year.
4:17
Jordan
A check that only runs while you're watching.
4:21
Alex
Isn't protection. It's paperwork.
4:25
Jordan
What's the thread saying?
4:27
Alex
Split. Half calling it amazing. Half saying new devices will just lock harder, and unlocking gadgets helps stalkers as much as tinkerers.
4:37
Jordan
Both true.
4:38
Alex
One fair note: he found a patch for the monitor and never installed it. Expensive screen.
4:44
Jordan
Doubt has a budget.
4:48
Jordan
Slovakia. This is Risky Business writing up an alert from the NBU, which is Slovakia's national cyber security office.
4:57
Alex
What did the alert actually say?
5:00
Jordan
The cameras are called NERO R-ONE. If a text message arrives from one of a list of phone numbers stored inside the camera, whoever sent it gets a command line on that camera and a way onto the network. The numbers are Russian.
5:12
Alex
Stored inside? Not something an operator set up?
5:16
Jordan
Built into the device software. And the camera is the same product with a different sticker. It's sold out of St Petersburg as CORDON PRO dot M, by a company called Simicon.
5:27
Alex
So the story isn't a hack, it's...
5:31
Jordan
It's a purchase order. Thirty million euros, European funded, a national traffic monitoring rebuild. The interior ministry was getting two hundred and seventy-nine units ready.
5:41
Alex
And the ministry's first answer?
5:44
Jordan
That the cameras are not Russian, and that they sit on a closed ministry network, so nothing can leak.
5:51
Alex
A closed network. On cameras that will start up any software you load into them, and whose live video has no password. That's in the same alert.
6:01
Jordan
Wait. No password at all?
6:04
Alex
If you know the address, you can watch. @after 400
6:07
Jordan
Then the closed network is a sentence. It is not a control.
6:12
Alex
And who proved it's the same camera? The ministry?
6:16
Jordan
That's the bit I had backwards when I started reading. I assumed somebody tested them before the money moved. No. Opposition politicians compared the software inside the Slovak camera against the software in the Russian model and said it's the same. And that comparison lives in comments and local reporting. Not in an official document yet.
6:34
Alex
So the buyer denied where it came from, and strangers did the comparison.
6:40
Jordan
And then the install stopped.
6:43
Jordan
On hold, waiting for an independent auditor. Similar units are alleged in Croatia.
6:49
Alex
Let me be careful here. Nobody has shown that anyone in Russia used that text message door on a live Slovak road.
6:58
Jordan
Nobody has. That matters.
7:01
Alex
It matters. And the purchase is still a scandal without it.
7:05
Jordan
The thread is arguing exactly that. Some people say cheap leftover stock, not a spy operation. Somebody says it's easier to bribe one administrator than to hide code inside a device.
7:17
Alex
And the audit?
7:19
Jordan
The government in power right now is friendly with Moscow. So an audit they choose and pay for is thin comfort. The thread treats it as the punchline.
7:30
Alex
Third one. Kaspersky's research team published this on Friday. They were hunting Android malware, and they found an app with no icon and no window, sitting on car stereos.
7:41
Jordan
Which cars?
7:43
Alex
Not cars. Stereos. The screen you buy online for a hundred dollars and bolt into an older car. The brand here is DoFun.
7:51
Jordan
So not the factory screen in a new car.
7:55
Alex
Not a Tesla. Not Android Auto. And it does not touch the steering or the brakes. Nobody claimed that.
8:02
Alex
Here's the actual story. There is one app on those units that the maker put there on purpose. It does two jobs. It reports usage, and it installs updates. It's called TWCore.
8:13
Jordan
And it's the thing putting the malware on.
8:16
Alex
It waits for messages from a server, cardoor dot cn. The message describes an app, and the app gets installed.
8:24
Alex
And here's the part that matters. That message can tell it to install a brand-new app, not just patch one that was already there. There's a switch in the message for exactly that, and it's the one highlighted there: install not exists.
8:37
Jordan
That's not an update. That's a delivery service.
8:41
Alex
On the official channel. Expected, allowed, trusted.
8:45
Jordan
What does the extra app do? I'm braced for something dramatic.
8:50
Alex
It's boring, and boring is worse. Fake ad clicks in invisible windows. And a second piece that turns the stereo into a middleman, so somebody can rent your car's internet connection and make their traffic look like it came from an ordinary home.
9:05
Jordan
For what?
9:07
Alex
For anything they need to look ordinary. Same family researchers keep finding on cheap Android TV boxes.
9:14
Jordan
That's the part that gets me. Nobody notices. The radio works. The maps work.
9:20
Alex
Kaspersky told the vendor. The vendor says it's fixed.
9:25
Jordan
Says.
9:26
Alex
And one thing to hold on to. Kaspersky is a Russian security company. They are also the only group that has published the technical detail here. No public bug number. No list of affected models.
9:38
Jordan
Do you trust it?
9:40
Alex
I trust the writeup, and I notice who wrote it. Both at once.
9:44
Jordan
This is my week too, and I keep... okay. We ship tablets into classrooms. Every one of them takes official updates from the vendor. And I have sat in a meeting where the answer to "how do we know it's safe" was "it's the official update channel."
9:58
Alex
That's the sentence.
10:01
Jordan
That's the sentence, and this story is what's under it. The official channel is not a wall. It's a door with the vendor's name on it.
10:09
Alex
The thread puts it blunter. It's a computer with a SIM card in your dashboard, and you bought it for a hundred dollars.
10:17
Alex
Quick one, and it happened this morning. The European repair rules are now in force. The Irish broadcaster has the local version: makers have to repair certain things you already own, washing machines, vacuums, phones, tablets, free or at a fair price and in reasonable time. Spare parts and repair instructions have to be available. Ireland even has a directory site, RepairMyStuff dot ie.
10:40
Jordan
That's good. Genuinely good.
10:43
Alex
The Commission number in the piece is four point eight billion euros in growth and investment.
10:50
Jordan
Over what period?
10:52
Alex
Fifteen years, in their own study. Somebody in the thread went and opened the PDF.
10:58
Jordan
So not this year's bonus.
11:01
Jordan
But here's what the thread is really chewing on. A ten-year-old tablet works fine and dies because the browser stopped getting updates. That is not a spare parts problem.
11:12
Alex
Right. The law makes you a spare parts customer. It does not hand you the key to the software.
11:18
Jordan
And after this morning's first story, that software lock was never as solid as it looked.
11:25
Alex
You can get the part. You still can't get the key.
11:29
Alex
That's our audit for today. Find us wherever you get your podcasts. Chief Skeptic Officer, every day at seven A.M. New York time.
11:36
Jordan
Tell us what you're skeptical about. Drop it in the comments, the angle you can't stop chewing on.
11:41
Alex
Stay curious. Stay skeptical.
11:45
Jordan
Doubt both.
