frontpage.
newsnewestaskshowjobs

Made with ♥ by @iamnishanth

Open Source @Github

fp.

Open in hackernews

How I discovered a hidden microphone on a Chinese NanoKVM

https://telefoncek.si/2025/02/2025-02-10-hidden-microphone-on-nanokvm/
73•ementally•2h ago

Comments

kotaKat•1h ago
https://wiki.sipeed.com/hardware/en/kvm/NanoKVM/introduction...

Probably an older NanoKVM.

"NanoKVM-Cube hardware is built on the LicheeRV Nano platform. To coordinate production and maintain consistency with the LicheeRV Nano for the SMT project, the hardware retains the display, touch, MIC, and amplifier circuits. To address potential privacy concerns, versions 2.2.6 of the application and 1.4.1 of the firmware and above will remove the relevant drivers. We will also eliminate these components in future productions."

tayiorrobinson•1h ago
To be fair, the microphone _is_ listed on the specsheet of the LicheeRV Nano

https://wiki.sipeed.com/hardware/en/lichee/RV_Nano/1_intro.h...

I assume they didn't intend to put a mic on the KVM product, but they wanted to make a KVM product, already had this SBC product, which reusing their existing stock of helped keep cost low.

Should they have been more up front about it it? Sure, and it's not great that they had a bunch of security issues in the FW anyway, so not exactly great, but "hidden microphone in a Chinese KVM" lets the mind wander

ndsipa_pomu•21m ago
It doesn't strike me as that useful to have a hidden microphone in a KVM product as most of the time, they're going to be stuck in server rooms with just lots of fan noise to record.

Far more of an issue would be any kind of keylogger built into the software, which is why it's best to go for devices that support open source software.

i_am_proteus•16m ago
It is possible to keylog via audio.

https://ieeexplore.ieee.org/abstract/document/10190721

BenjiWiebe•9m ago
But the point of a device like this is that you (and your keyboard) are NOT physically present.
Y_Y•2m ago
just fan noise?

https://arxiv.org/abs/1606.05915

Any signal that you can modulate can be an exfiltration channel, and fan noise is no different.

mannanj•1h ago
any speaker can be tapped into as a microphone by a motivated government.
Aachen•43m ago
From a hardware point of view I've also noticed that speakers work like poor microphones (and LEDs like poor solar panels / light sensors), but is there any way to actually make this work on most devices without physically changing wiring? If the circuits aren't made to take measurements (or the software can't get at the readings) but only set a voltage on the wires, there wouldn't be a way to (an)use this. I don't know enough about electronics to know whether this is commonly the case

Not that it's not a good thing to be aware of, but do you have any sort of source for what kinds of devices can have their speakers turned into microphones? Then I'll believe you about the government part

withinboredom•4m ago
I don’t think they meant literally “any” but more like a device with a speaker could be delivered to you that has a speaker/microphone. Like a Bluetooth speaker you order of the internet. It seems it would probably have to be personally targeted to you, but in that case, there are probably simpler ways.
Workaccount2•25m ago
No, because the drive circuit for a speaker is the opposite of the circuit for a microphone. The output stage of a speaker amplifier is just that, an output. The only way to record audio from a speaker, which is totally possible, is to have also purposely built an input stage also attached to the speaker. Which at that point you might as well just use a microphone...

Audio input and output are not reversible.

Milpotel•1h ago
> [...] and runs a heavily stripped-down version of Linux that lacks systemd and apt. And these are just a few of the issues.

?!

stefan_•1h ago
> But what additionally raised red flags was the presence of tcpdump and aircrack - tools commonly used for network packet analysis and wireless security testing. While these are useful for debugging and development, they are also hacking tools that can be dangerously exploited.

Must be another AI slop article. Stop feeding your writings into GPT & co to turn into extra long nonsense.

kenjackson•37m ago
What was wrong with the above paragraph?
nottorp•7m ago
Let's see:

1. It lacks systemd and apt.

systemd is so resource hungry that i'm sure they removed it to reduce the RAM bill. Apt... why install apt if the distro has a different means of updating?

2. While these are useful for debugging and development, they are also hacking tools that can be dangerously exploited.

This is purely fear mongering. Even the shell could be a "hacking tool that can be dangerously exploited". Let's remove the shell too.

There are some legitimate complaints in the article, like the use of the same key on all installs. The rest looks more like fear mongering and security theater.

Including the microphone. What were they supposed to do, desolder it manually and add $10 to the price of each device?

I don't see the article complaining that a PiKVM has so many unused peripherals when used as a KVM. To go in the spirit of item #2, the usb ports could be used as "dangerous hacking tools" so you should desolder your usb ports from a Pi used as a KVM, right?

lousken•45m ago
is there a recording sample to hear the quality?
jlward4th•25m ago
I recently discovered a similar concerning security issue with my KVM. In my case it was a pretty standard KVM for multiple machines to share a keyboard, mouse, and screen but also Ethernet. One day while looking at my home network I noticed the KVM had its own IP and was transferring GBs of data everyday. I quickly blocked it from my network. But having used it for a number of months I worried that with screen capture and access to all my input devices, someone could have gotten access to pretty much everything I use. I wasn’t able to figure out if any data was actually being sent off my network and I really didn’t want to put myself in any more risk so I just threw it in an electronics recycling bin. Pretty scary what a network connected KVM could maliciously do.
Renaud•10m ago
Shame you threw it away. It would have been useful to collect the traffic with Wireshark and share that with info about the device in a post or a blog for others to investigate and be warned about that brand and model.
stragies•8m ago
Why did you not just login to the device, and switched off "Broadcast to multicast", or changed the destination address?
supportengineer•3m ago
What an amazing device, but also the price is incredible. This kind of device would have been such a game changer 15 to 20 years ago. Thank you for the detailed security analysis. At least the developers are responsive, that does seem like a green flag.

Tiny Core Linux: a 23 MB Linux distro with graphical desktop

http://www.tinycorelinux.net/
87•LorenDB•1h ago•39 comments

HTML as an Accessible Format for Papers

https://info.arxiv.org/about/accessible_HTML.html
21•el3ctron•1h ago•10 comments

Linux Instal Fest Belgrade

https://dmz.rs/lif2025_en
67•ubavic•5h ago•8 comments

Self-hosting my photos with Immich

https://michael.stapelberg.ch/posts/2025-11-29-self-hosting-photos-with-immich/
509•birdculture•6d ago•266 comments

A compact camera built using an optical mouse

https://petapixel.com/2025/11/13/this-guy-built-a-compact-camera-using-an-optical-mouse/
164•PaulHoule•3d ago•30 comments

Mapping Amazing: Bee Maps

https://maphappenings.com/2025/11/06/bee-maps/
6•altilunium•6d ago•0 comments

Touching the Elephant – TPUs

https://considerthebulldog.com/tte-tpu/
29•giuliomagnifico•3h ago•6 comments

The unexpected effectiveness of one-shot decompilation with Claude

https://blog.chrislewis.au/the-unexpected-effectiveness-of-one-shot-decompilation-with-claude/
44•knackers•1w ago•22 comments

Cloudflare outage on December 5, 2025

https://blog.cloudflare.com/5-december-2025-outage/
716•meetpateltech•1d ago•519 comments

The Absent Silence (2010)

https://www.ursulakleguin.com/blog/3-the-absent-silence
37•dcminter•4d ago•2 comments

Wolfram Compute Services

https://writings.stephenwolfram.com/2025/12/instant-supercompute-launching-wolfram-compute-services/
184•nsoonhui•8h ago•88 comments

How I discovered a hidden microphone on a Chinese NanoKVM

https://telefoncek.si/2025/02/2025-02-10-hidden-microphone-on-nanokvm/
73•ementally•2h ago•20 comments

Schizophrenia sufferer mistakes smart fridge ad for psychotic episode

https://old.reddit.com/r/LegalAdviceUK/comments/1pc7999/my_schizophrenic_sister_hospitalised_hers...
290•hliyan•8h ago•243 comments

PalmOS on FisherPrice Pixter Toy

https://dmitry.gr/?r=05.Projects&proj=27.%20rePalm#pixter
138•dmitrygr•12h ago•17 comments

Gemini 3 Pro: the frontier of vision AI

https://blog.google/technology/developers/gemini-3-pro-vision/
501•xnx•23h ago•257 comments

Netflix to Acquire Warner Bros

https://about.netflix.com/en/news/netflix-to-acquire-warner-bros
1621•meetpateltech•1d ago•1228 comments

Have I been Flocked? – Check if your license plate is being watched

https://haveibeenflocked.com/
233•pkaeding•12h ago•146 comments

Leaving Intel

https://www.brendangregg.com/blog//2025-12-05/leaving-intel.html
291•speckx•18h ago•162 comments

Divine D native Linux open-source mobile system – Rev. 1.1 Hardware Architecture

https://docs.dawndrums.tn/blog/dd-rev1.1-arch/
30•wicket•4d ago•6 comments

Making tiny 0.1cc two stroke engine from scratch

https://youtu.be/nKVq9u52A-c?si=KVY6AK7tsudqnbJN
98•pillars•5d ago•24 comments

Kids who ran away to 1960s San Francisco

https://www.fieldnotes.nautilus.quest/p/the-kids-who-ran-away-to-1960s-san
41•zackoverflow•3d ago•1 comments

Infracost (YC W21) is hiring Sr Node Eng to make $600B/yr cloud spend proactive

https://www.ycombinator.com/companies/infracost/jobs/Sr9rmHs-senior-product-engineer-node-js
1•akh•9h ago

Netflix’s AV1 Journey: From Android to TVs and Beyond

https://netflixtechblog.com/av1-now-powering-30-of-netflix-streaming-02f592242d80
514•CharlesW•1d ago•263 comments

Frinkiac – 3M "The Simpsons" Screencaps

https://frinkiac.com/
131•GlumWoodpecker•3d ago•41 comments

Patterns for Defensive Programming in Rust

https://corrode.dev/blog/defensive-programming/
294•PaulHoule•23h ago•72 comments

Skin-Shedding Code (2024)

https://registerspill.thorstenball.com/p/skin-shedding-code
3•Kerrick•14m ago•0 comments

Idempotency keys for exactly-once processing

https://www.morling.dev/blog/on-idempotency-keys/
156•defly•5d ago•66 comments

Why Speed Matters

https://lemire.me/blog/2025/12/05/why-speed-matters/
49•gsky•3h ago•18 comments

The missing standard library for multithreading in JavaScript

https://github.com/W4G1/multithreading
114•W4G1•18h ago•31 comments

I'm Peter Roberts, immigration attorney who does work for YC and startups. AMA

212•proberts•1d ago•276 comments