Eufy HomeBase 2 Firmware 3.4.2.2h Analyzed, WiFi Credential Generation and UART Lockdown Bypassed

Eufy HomeBase 2 Firmware Analysis

Security researchers conducted an analysis of the Eufy HomeBase 2, specifically focusing on firmware version 3.4.2.2h. The decision to analyze HomeBase 2 instead of HomeBase 3 was based on its prevalence in the researcher's city and ease of acquisition. This marks the first hardware-related vulnerability research for the individual involved.

Firmware Extraction Challenges

Initial attempts to extract the firmware were complicated by the HomeBase's flash memory being soldered directly to the board without exposed pins. The researchers eventually had to desolder the Winbond 25Q256JWEQ (WSON8 8.6mm) flash memory chip, which resulted in some damage to the chip during the process. Spring clips were later used for a makeshift setup.

WiFi Credential and UART Lockdown

The analysis successfully identified the algorithm used to generate WiFi credentials for the OCEAN_XXXXXX management WiFi network. Additionally, researchers bypassed the UART lockdown mechanism. This was achieved by reflashing a backdoored U-Boot image, which allowed for shell access via UART.

Filesystem Modifications for Debugging

To facilitate debugging, modifications were made to the filesystem. The recovery image had limitations, requiring specific filesystem adjustments to enable the main binary to run effectively for further analysis.