Bought a broken Roborock S5 for $20. Reballed the BGA eMMC, extracted the flash, and found the previous owner's WiFi credentials, Xiaomi cloud token, root SSH password, and a full LiDAR map of their home — all unencrypted. A factory reset leaves every byte of it behind.

A $10 op-shop IP camera with a built-in mechanism that executes arbitrary shell scripts from an SD card at boot — no authentication, no interaction, running as root. Three files on a blank SD card is enough to steal the WiFi password and leave a persistent root backdoor on the network.

A full chain hardware teardown and firmware implant on a cheap Chinese IP camera — from SPI flash extraction and CramFS unpacking, to a custom ARM bind shell and persistent root access on every boot.