TLDR: there is a vendor-operated remote-command-execution channel (the cloud "remote debug" feature), a shared static root password in the image, a root-SSH enable switch, and a pre-provisioned outbound SSH key to a Nanoleaf AWS host. That's a meaningful attack surface that all funnels through Nanoleaf's cloud and their key management. If that cloud path or signing key is compromised, so is the device.
I've got enough to give you a solid assessment. I pulled the firmware, confirmed it's not encrypted, unpacked it, and went through the accounts, services, and the vendor daemons. Here's what's actually in your Hexagon (Shapes) firmware.
What the firmware is
- Shapes 12.3.2
- Standard OpenWrt 19.07.4 (ramips/mt76x8, a MediaTek MT76x8 MIPS SoC), uImage kernel (Linux 4.14.195, LZMA) + xz-compressed SquashFS rootfs. Built 2020-09-06.
- The image is signed (signify: "signed by key ---------------------"), and the kernel header labels it a "Local build key" — so these public S3 images are signed with a dev/local key, not a hardened production signing key. The GPL kernel/BusyBox sources aren't published, which the reference notes flag as a likely GPL violation, but that's a licensing issue, not a security one.
So: nothing exotic, just an old OpenWrt build. I unpacked the whole root filesystem and read it.
The things worth your attention
- Vendor remote command execution over the cloud (the real headline).
/sbin/cloud_daemon connects to Nanoleaf's MQTT broker (-----------.nanoleaf.me, tokens from apollo.nanoleaf.me / iaso.nanoleaf.me) and implements a feature it calls "remote debug." On receiving a message it logs Got an remote debug request. The command is: [...], parses it into arguments, forks, redirects stdin/stdout/stderr through pipes, and runs it (system/execv). In other words: Nanoleaf's cloud can push a shell command to the controller and get the output back. It also has an "upgrade" path that fetches and flashes firmware from a URL the cloud supplies.
This is the capability most people would call a "backdoor." The honest framing: it's a vendor remote-management channel, not a hidden third-party implant. It's gated behind their cloud auth (device tokens), only works while the device is internet-connected and talking to their broker, and is a known pattern for IoT "remote support / OTA." But it is genuinely remote code execution controlled by Nanoleaf (and anyone who compromises that cloud path), and it's not something you can see or disable from the app.
2. A static root password baked into the image.
/etc/shadow has root:XXXXXXXX — a weak MD5-crypt hash, identical in every unit running this firmware (2020-era). I did not and won't try to crack it, but a shared, firmware-embedded root password is a textbook weakness. It only matters if someone can reach a root login surface (see #3).
3. SSH present, off by default, root login allowed when on.
Dropbear is installed. /etc/config/dropbear ships disabled (enable 0) but with RootPasswordAuth on. /sbin/system_manager has a command sequence (COMMAND_SEQUENCE_SSH_ENABLE) that flips it on, starts dropbear, and touches /nanoleaf_config/ssh_enabled. So SSH isn't running out of the box, but there's a built-in switch to turn on root SSH — and #1 is one way a command could reach the device to flip it.
4. A bundled SSH identity + a hardcoded AWS host.
/root/dropbear is an SSH private key, and /root/.ssh/known_hosts pins one host: ------------.us-west-2.compute.amazonaws.com. Combined with the ssh/dbclient binaries present, this means the device is provisioned to make an outbound SSH connection to a Nanoleaf-controlled AWS box (log upload / remote support / possibly a reverse tunnel). Worth knowing, though an outbound connection the device initiates is less exposed than an open inbound port.
- Telemetry, as expected. Data collector (my-test.nanoleaf.me/datacollector/receive), reliability collector (collector.nanoleaf.me), auto firmware-check on a timer, log upload via curl to firmwareupdate.nanoleaf.me/uploadlogs.
Bottom line
No hidden third-party malware or sketchy foreign callback — it's a stock OpenWrt device. But your instinct wasn't wrong: there is a vendor-operated remote-command-execution channel (the cloud "remote debug" feature), a shared static root password in the image, a root-SSH enable switch, and a pre-provisioned outbound SSH key to a Nanoleaf AWS host. That's a meaningful attack surface that all funnels through Nanoleaf's cloud and their key management. If that cloud path or signing key is compromised, so is the device.
If you want to shrink the exposure without modifying firmware: put the Hexagons on an isolated VLAN/guest network with no inbound access and block their outbound internet (they work fine on LAN-only / local HomeKit — you just lose cloud features and OTA). That neutralizes #1 and #4 in practice.
❯ is there a microphone / ability to record audio or analyze audio or send audio built into the firmware?
Good question — Hexagons do have sound-reactive scenes, so there's likely a mic. Let me check what the firmware actually does with audio.
No ALSA, no /dev/snd or /dev/dsp, no audio libraries, no sound kernel modules. The only audio-adjacent thing is the "Rhythm" subsystem. Let me confirm how it works, since that's where any mic would be.
Clear answer: yes, there's a microphone, but the firmware on the main controller never touches raw audio. Here's the actual architecture I found.
There's no audio stack on the Linux controller at all
The main brain (the OpenWrt/MIPS controller) has nothing to capture or process audio:
- No ALSA, no /dev/snd, no /dev/dsp, no audio codec or FFT libraries.
- No sound kernel modules.
- No raw-audio buffers, no PCM/WAV handling, no sample-rate constants (I grepped for 8000/16000/44100/48000), no .raw/.wav/.pcm file paths anywhere in PixelCC.bin or RhythmCommunicator.bin.
So the Linux side cannot, with the code that's shipped, record or store a sound clip.
The mic lives on a separate dedicated chip (the "Rhythm" module)
The microphone and all audio DSP sit on a separate Silicon Labs Gecko microcontroller — the "Rhythm" subsystem. That's what rhythm.gbl is (a Gecko Bootloader firmware image for that MCU, a different CPU architecture entirely). On Hexagons this is built into the controller; on older panels it was the plug-in Rhythm module.
The Linux controller talks to that chip over a plain UART serial link (rhythm_driver.ko / serial_driver.ko, driven by RhythmCommunicator.bin). What the controller does with it:
- RhythmEngine::enableMicrophone(bool) — the mic is explicitly switched on/off; it's only enabled while a sound-reactive scene is running.
- selectSoundFeatures / getSpecificSoundFeature(SoundFeatureId) / readRhythmMetadata / getAgcPreGainValue — the controller requests and reads back processed "sound features" (beat/energy/frequency-band style summaries). The FFT/beat detection happens on the Gecko chip; Linux only ever sees these abstract numbers, not an audio signal.
What leaves the device
On the LAN API (PixelCC.bin's OpenAPI) the sound-related fields are just state and the live visualizer feed: rhythmConnected, rhythmMode, screenMirrorRhythmMode — on/off, which mode, and the feature stream that drives reactive effects. I found no code path that uploads audio, or even the sound-feature data, to Nanoleaf's cloud. The cloud service publishes command/response and firmware/health messages, not an audio or audio-feature stream.