"By holding down the single button, while powering the device, the Chromecast boots into USB boot mode. USB boot mode looks for a signed image at 0×1000 on the USB drive. When found, the image is passed to the internal crypto hardware to be verified, but after this process the return code is never checked! Therefore, we can execute any code at will."
That's a pretty big screw-up on someone's part - it seems strange that no one tested "does this unsigned image boot".
I very much doubt it's a screw up.
I'm working with these people: http://dev.moorescloud.com/
Check out the text on the pcb mask just between the bottom row of pads and the microSD card here:
http://dev.moorescloud.com/wp-content/uploads/2013/07/Holida...
We're going to a lot of effort to ensure these are "secure" for regular users – but it's an iMX233 ARM Linux device with a ATmega328 "Arduino" hanging off it – it's eminently hackable, and at least at the current introductory price it's very cost effective compared to, say, a RaspberryPi with a power-supply/case/wifi-adapter/Arduino (which is almost exactly what the prototype was).
While we're working hard to ensure your Christmas tree lights aren't remotely exploitable – if you've got it in your hands and have a screwdriver handy – it's yours to do what you want with. You can pop that SD card out and load your own OS to play with the software, and you've got a bunch of GPIO pins from both the iMX233 and the ATmega328 if you want to play with the hardware. I'll be a little disappointed if no-one's got one controlling a quadcopter or a laser cutter or a 3d printer within a few weeks of them shipping…
(So you don't ned to watch right through – though I highly recommend you do – there's a trick he describes where you use a specially crafted "USB Drive" which can return one version of a file the first time it's read, and a different file the second time – if you know you've got a device that reads in a file to check it's signature first, then reads it again assuming it's getting the same content – that assumption isn't necessarily correct… A "smart" USB Drive can return whatever you choose, including a properly signed Google sourced image the first time 0x1000 is read, and whatever else you want the second time when the device is mounting it rather than verifying it.)