Hacker News Reader

Comment by unstatusthequo | Hacker News Reader

I sure wish Tizen was rooted. I’d love to custom flash over the slow ass Samsung UI.

Just yesterday I hacked my Samsung Frame tv. The AI (codex) used an off-the-shelf root with Developer Console access (built in). Though root doesn't give you the signing keys to blow everything away and still boot (is my best understanding), but as a workaround you can still change anything you want after boot automatically.

I had it do:

- Stripping ads

- Disabling mics

- Turning off updates

- Leaving root SSH in place (protected) for future access

The key to getting codex to do this was that this is legal under DMCA, but after a certain point I had to get a new session to change all the "hacking" words into synonyms to not trigger false security alarms. Wouldn't be surprised or bothered if my chatgpt account gets banned though. I can write a blog post and publish the repo if you want

Time to invest a few tokens into an unneuthered model

Is there anyone serving such inference? I can't fit anything usable on my hardware.

I believe Mistral models are fairly capable at cybersecurity tasks, but I don’t think you could get anything useful out of anything smaller than Mistral Large 4.

https://abliteration.ai/

But also if you're working on a local device, any Chinese model will agree to it most of the time.

How do people actually do this kind of work?

I can imagine working on the dumped firmware or update package.

But against the TV over the network without closed loop or access to RAM how could the model find and develop exploits?

I think in this case, the Tizen OS (by Samsung) on these TVs has a developer mode where you can use their Samsung Debug Bridge CLI tool on another computer to connect to the TV and get a regular Linux user shell. From there, they found a local privilege escalation bug to get root. I don’t know the exact details but a lot of smart devices get poor security support, so you can just shotgun different known vulnerabilities and get lucky with one pretty often rather than needing to develop a novel one.

OpenRouter?

Just look for "Heretic"-ed models on Huggingface.

Basically all Qwen models got un-neuthered.

Even the big ones (Deepseek, etc.) got their protection layer ablated.

Reply on news.ycombinator.com