It Looks Like a School Bathroom Smoke Detector. A Teen Hacker Showed It Could Be an Audio Bug

To hack the Halo 3C, they found that if they could connect to one over the network it was installed on, they could brute-force guess its password with virtually no rate limitations due to a flaw in how it tried to throttle those guesses. “It’s trivially possible to guess passwords as quickly as the thing can respond to you,” says Nyx. That meant they could guess roughly 3,000 passwords a minute, and crack any insufficiently complex password relatively quickly.

Once they had administrator access to a Halo 3C, they found they could update its firmware to whatever they chose: Despite its security measures that attempted to require those firmware updates to be encrypted with a certain cryptographic key, that key was in fact included in firmware updates available on the Halo’s website. “They’re handing you a locked box where the key is taped to the underside,” Nyx says. “As long as you know to look down there, you can open it up.”

A Motorola Solutions spokesperson said in a statement: “Motorola Solutions designs, develops and deploys our products to prioritize data security and protect the confidentiality, integrity and availability of data. A firmware update is available, and we are working with our customers and channel partners to deploy the update together with our additional recommendations and industry best practices for security.”

Marketing material available online says the Halo 3C uses a “Dynamic Vape Detection algorithm” which can sense nicotine, THC, and when someone is trying to mask their vaping with aerosols. Halo can also “alert security teams to motion after hours” and includes a “spoken keyword feature.”

“The HALO Smart Sensor can detect specific spoken keywords that immediately alert security to a potential issue. Pre-defined keywords like ‘help’ are particularly valuable in environments such as schools, where bullying is a concern, or for teachers in need of assistance, as well as nurses and hospital patients,” the marketing material adds. Another section says the sensors can be used to detect “bullying or aggression” in schools.

The marketing material also says Halo sensors have been used in public housing units in New York. “The sensors helped SSHA [the Saratoga Springs Housing Authority] reduce risks, enforce nonsmoking rules, and protect vulnerable residents, with plans for further installations across the housing authority,” it says.

Nyx argues that the notion of requiring public housing residents to keep a hackable device that can become an audio eavesdropping tool in their apartment may represent the most disturbing application of the Halo 3C. “That kind of took it up a notch as far as how egregious this entire product line is,” Nyx says. “Most people have an expectation that their home isn’t bugged, right?”

As sensors like the Halo 3C proliferate across schools and even homes, Vasquez-Garcia says the biggest takeaway from his and Nyx’s findings ought to be that putting microphones and internet connections into every device in our lives as simple as a smoke detector is a decision that carries real risk. “If people remember one thing from this, it should be: Don’t blindly trust every internet of things device just because it claims to be for safety,” Vasquez-Garcia says. “The real issue is trust. The more we accept devices that say ‘not recording’ at face value, the more we normalize surveillance without really knowing what’s inside or bothering to question it.”