Security researcher unlocks deactivated Cricut Maker from e-waste
Hacker demonstrates vulnerability in Cricut's device-locking system by intercepting USB communications and spoofing serial numbers.
What to know
- A researcher successfully unlocked a deactivated Cricut Maker by building a USB proxy that intercepts and rewrites serial number packets.
- Cricut's device authentication lacks checksums or encryption, allowing arbitrary serial numbers to be spoofed at the hardware level.
- The vulnerability could enable attackers to lock other users' machines out of their accounts or hijack ownership of devices.
- The writeup was published openly on a technical blog and has gained significant visibility on Hacker News.
“Obviously this raises the question about random strangers being able to get other users Cricut serial numbers locked out or added to their accounts…”
Security researcher (xssfox) · sprocketfox.io
Researcher (xssfox) Security researcherCricut Device manufacturer
The record 2 articles and posts · last 30 days
- summary covers to here · Aug 20, 12:15 AM · 1 piece above arrived after
What people are saying 8 voices from 1 site · verbatim
- Aug 20
-
>are really terrible.They are not as terrible as people who commit fraud by lying about throwing away the "bad" unit and selling it, nor are they as bad as people stealing them and then also reselling them.
-
No checksumming on the serial number packet makes this kind of proxy trivial. Using an RP2040 as a USB man-in-the-middle is a clever and cheap fix.
-
If anyone has an old Silhouette vinyl cutter sitting around gathering dust, there's an actively maintained open source Inkscape plugin that lets you "print" your design straight to the cutter: https://github.com/fablabnbg/inkscape-silhouetteI wrote about it a couple years ago:
- Aug 19
-
https://en.wikipedia.org/wiki/Cricut#ControversiesAlso, it's a very fun article to read.
-
I have a silhouette cameo pro 4 (and love it), and have been wondering around similar things. The Cameo can only be controlled via the provided software, or a couple proprietary plugins for popular design software.The provided software is clunky, and the plugins suck. I’ve been building an app for designing stickers, and what I really want is to…
-
I'm just imagining the amount of damage some determined people can do to the Cricut ecosystem because the serial numbers are guessable...
-
Just a PSA to anybody considering buying a new cricut:They are cool machines mechanically, but the software is an absolute nightmare, DO NOT BUY.Source: i bought one. Regret sunk in the moment i tried to do anything even slightly interesting. This isn’t a bambulabs situation where it’s mostly a philosophical objection to a closed ecosystem. It’s…
-
I was hoping this would be a hack that repurposed the unit to work standalone.Getting the unit to work again in the Cricut "ecosystem" just means Cricut can disable it later when they catch on.Companies that "lock" or otherwise brick viable hardware as part of the business model (I'm thinking about Sonos here, too) are really terrible. People…