Unlocking a locked/deactivated e-waste Cricut Maker
- ID
- 16362
- Status
- summarized
- Published
- 20 Aug 2026, 3:06 AM
- Fetched
- 21 Aug 2026, 10:35 PM
- Provider
- Hacker News
- Category
- dev-community
- Original URL
- https://sprocketfox.io/xssfox/2026/07/01/cricut-unlock/
- Source URL
- https://hnrss.org/best
Summary
- Score
- 4.5
- Created
- 21 Aug 2026, 10:37 PM
- Tags
- Audience
- developersvibe_coders
What happened
A developer found a locked Cricut Maker in e-waste and bypassed its deactivation by intercepting USB CDC communication between the cutter and computer using Wireshark, then building an RP2040-based USB proxy (running TinyUSB Arduino examples, overclocked to 240MHz) that rewrites the serial number in transit. The serial number packets had no checksumming or crypto, making the proxy straightforward. Replacement rollers were cheap and readily available, restoring full functionality.
Why it matters
If you ship connected hardware that phones home for activation, this shows how trivially a USB man-in-the-middle can defeat server-side lockout when the device protocol lacks signing or checksums. Founders and engineers building IoT or cloud-locked devices should treat this as a concrete lesson: any device-level identity sent over USB without cryptographic integrity can be spoofed with a $1 microcontroller.
Discussion angle
What does this mean for Malaysian startups building connected devices — should you bake device attestation into your USB protocol, or is cloud-side lockout enough given your threat model?