Intro#

This year, I had the pleasure of going to Hack the North again, and come to find out, they have a super cool programmable badge this time around sponsored by Solana™. No more cardboard + lanyard!

Here’s a pic:

During the opening ceremony, I found out Solana had a badge hack track, and my teammates (David, Simon, and Anthony) and I immediately had an evil idea.

The big idea#

We wanted to recreate the Garry’s Mod cough virus incident, except with badges. The idea was that when people exchanged info by bumping badges together, it would somehow “infect” the other badge and make it occasionally display cough. We never got that part working.

Instead, I found the badge’s admin password, unlocked apps that most attendees never saw, and discovered that the server trusted quite a bit of what the badge told it.

Getting admin#

I saw that Hack the North provided an IDE to make apps for the Solana badge app track.

Here’s what it looks like:

When I plugged in my badge and connected it to the IDE, the thing that immediately piqued my interest was the result from this help command:

When we first tried running the commands, we got this:

I tried guessing some passwords like htnbadge, but it didn’t work, so I gave up and looked elsewhere.

After looking around, I eventually found this interesting file on the hackthenorth.com website:

Turns out the password was sitting in a publicly accessible file used by the provisioning flow. The site would automatically append it to privileged commands so volunteers could provision badges without ever actually seeing the password.

What was cool about having the admin password was that we could unlock all the apps for ourselves and even see organizer apps on the badge.

With seedall, we didn’t have to walk around the whole building finding stickers to scan to unlock apps.

We could also run debug which would give us organizer apps for debugging the badge.

Here are some of the apps you might’ve missed:

Can we actually spread anything?#

Even though we had the admin password, it didn’t look like it would help us pull off the cough idea.

So next, I tried dumping the firmware with esptool and revving it, but nothing really came up. I couldn’t find any way to silently install an app on someone else’s badge or have something run in the background displaying cough occasionally. The badge was pretty locked down.

API shenanigans#

With all hope lost in the badge infection idea, I moved on to testing the syncing feature. Syncing uploaded badge state to the backend, including unlocked apps, sponsor visits, and game high scores.

When I synced my badge, I found that all of this was being sent to the server through an API request.

This badge data contained a list of files, and this is what is used to track the apps you have and the sponsors you visited as well. Here is more of the payload:

So, I tested if I could replay the request with the rest of the sponsors so that it would look like I had visited all of them. Since there were 64 sponsors, I added the corresponding sponsor .cfg files with valid size and text values.

For example:

1
{
2
// ...
3
  "config/sponsors/42067.cfg": {
4
    "size": 67,
5
    "text": "version=67\ntable=67\nslug=blah\nvisited_unix=123\n"
6
  },
7
// ...
8
}

After making the request to self-upload, this is the result:

The funny thing was that achievements relied on this badge state. Since sponsor visits contributed points toward Goose Games rewards, the client-controlled state wasn’t purely cosmetic. You could also get more points by giving yourself ridiculously high scores in the badge games.

Solana was also running a scavenger hunt with their phone as a prize where you had to find 9 gift boxes around the venue. Not saying I did it, but allegedly, you could update your dashboard with this, lie to Solana, and finesse yourself a $500 phone.

Ending#

We never managed to make everyone else’s badges cough 😔

But chasing that idea took me from the badge IDE, to an exposed admin password, to reversing the firmware, and eventually to figuring out how much the backend trusted the badge itself.

I also got to meet a lot of cool people, build something fun, get a cool badge, and somehow actually get some sleep this year.

All in all, a pretty good weekend.

Hope you learned something new! Thanks for reading 😄