Security | Random CPU

Five Taps and a Zip File: Running My Own Code on a Denon DJ Player

A Denon Prime GO is a $1,000 standalone DJ controller. No laptop, no phone; you put music on a USB stick, plug it in, and play. It has a touchscreen, two decks, a battery, and absolutely no reason to let you run your own software on it.

It does anyway. You tap the version number five times, put a zip file on a flash drive, and it runs whatever you gave it.

I’ve been documenting inMusic’s firmware for a couple of years now. Denon DJ, Numark, Akai, HeadRush, Rane all share a codebase, so work on one device tends to apply to a dozen. Everything in this post lives in my documentation site. But the way into the device is my favorite thing I’ve found in it, partly because of how it works and partly because of a bug I found in inMusic’s own version of it.

Let me walk you through it.

The Backdoor That Printed Itself

We’ve all gotten the message you never want to get. Mine came in at 11:57 in the morning: a WordPress site I help maintain had been flagged as compromised. Someone had gotten in and left themselves a way back.

Here’s the part I didn’t expect. By the time I finished reading the malicious code, I realized it had never actually worked. The attacker built a perfectly functional backdoor and then, through one tiny detail, accidentally disarmed it themselves.

Let me walk you through what happened, because the why is genuinely fun, and the lesson underneath it applies to anyone who runs a website.

Pipelock: Agent Firewall for AI Coding Tools

The Problem: AI Agents Are Credentialed, Networked, and Trusted

When you run Claude Code, Cursor, or any agentic coding tool, you’re handing it something dangerous: a live environment loaded with secrets. Your ANTHROPIC_API_KEY is sitting there. Your AWS credentials. Your GitHub tokens. Your .env file. The agent can read environment variables, make HTTP requests, call MCP servers, and run shell commands — all on your behalf, all in the same process that holds those credentials.

That’s a completely different threat model than a traditional web app. A web app has a defined interface. You know what it talks to. You can write static firewall rules around it. An agent decides at runtime what to do, what to fetch, and what to send. You can’t fully enumerate the attack surface ahead of time because the whole point of the thing is that it improvises.

Coreboot

BIOS

We’ve all seen one of these two BIOS screens upon starting a computer:

On the left is American Megatrends’ BIOS, on the right is Award’s BIOS. These are the two main BIOS manufacturers, and they have almost complete marketshare when it comes to firmware on laptops and desktops. Most newer machines don’t show these screens anymore, but they’re typically still running one of these two pieces of software. I’m going to cover what these two pieces of software do, and an alternative to these.

Hack The Box Intro

Hack The Box is a website that gives people a great place to test their penetration testing (hacking) skills. They have a selection of different machines available that are vulnerable to different types of attacks. This site uses the capture the flag scoring mechanism, where you hack machines, get a “flag” from them, and submit it to their site for points.

In this article, I’ll cover how to make an account on HTB.

About Pseudo Random Number Generators

Pseudo Random Number Generators, or PRNGs, are extremely important, as randomness is needed by computers for many purposes. As computers are “deterministic” machines, meaning they follow a specific procedure for everything, they are terrible at making randomness. Because of this, there has been an enormous amount of studying on how to simulate randomness on computers. The algorithms that are developed to simulate randomness are called PRNGs.

Websites that use TLS/SSL (to get the lock symbol in the address bar) use randomness to establish a secure connection to someone visiting their website. If they didn’t use randomness, and used a non-random encryption key with someone who visited their website, then any malicious actor could visit the website, and get the same encryption and decryption key as you got. This would allow a hacker to decrypt your communications with the website. Imagine if this could occur with your banking website, and it becomes clear why this is important.

All About Certificate Authorities

A “Certificate Authority” (CA), is a idea of “Public Key Infrastructure” (PKI), in which a special type of certificate is able to essentially co-sign other certificates to verify them as valid and trustworthy to certain levels.

Although CAs are generally trusted, there are non-trusted CAs. These CAs typically exist in corporate networks, in which their computers trust the CA, but others don’t. For example, a large company will have internal servers that need to be secured using SSL/TLS, but since nobody outside of the company ever accesses these systems, no computers outside of the company trusts this CA.

Root CA Thoughts

A root CA is a certificate authority (CA) that doesn’t have any parent CAs. The root CAs are pretty interesting, because root CAs are CAs that are typically ultimately trusted, with the ability to sign intermediate CAs.