Rescuing a ‘Deactivated’ Machine from Electronic Waste
Australian security researcher xssfox retrieved a discarded Cricut Maker industrial cutting machine from an e-waste pile. Apart from natural wear on its mechanical rubber drive rollers, the machine’s body and circuit boards were in pristine condition. However, when the researcher replaced the worn parts and connected the unit to the official control software, a prompt flashed across the screen: “Machine deactivated.”
Cricut has long enforced an aggressive hardware management policy. When original owners trade in or submit warranty claims for their devices, the manufacturer flags the corresponding device serial numbers as void on its cloud servers. Once a new user connects the second-hand unit to a computer, the client software checks the serial number against the cloud blacklist and instantly locks the hardware, reducing a fully functional machine to electronic trash.
By remotely invalidating legally sold physical hardware at the press of a cloud button, the vendor downgrades purchased equipment into a fragile software license subject to sudden revocation. This control mechanism undermines second-hand markets and user self-repair. Consumers who buy the hardware outright retain nothing more than a physical shell, while actual operational control remains tethered to vendor servers.
No Debug Headers, No Encryption: Hardware Magic with a $5 Pico
Figure: The microcontroller chip wired into the internal board of the deactivated cutter. Source: xssfox blog
Restoring the cutter’s functionality presented several technical hurdles. Upon disassembling the machine, xssfox discovered that the main board lacked a standalone EEPROM for serial storage, and the main microcontroller had its external debug interfaces permanently disabled. Intercepting and altering traffic at the network layer also failed, as the client application enforced strict Certificate Pinning, completely shutting down Man-in-the-Middle (MitM) proxies.
The breakthrough came from analyzing USB protocol traffic. Using Wireshark to capture data packets exchanged between the device and the PC, the researcher discovered that the cutter communicated via plaintext over standard USB CDC (Communications Device Class). The device serial number was transmitted in plain text during connection setup, with neither hash checksums nor encryption applied.
Using a Raspberry Pi Pico board costing roughly $5, xssfox leveraged its onboard RP2040 microcontroller to build a hardware MitM proxy. Acting simultaneously as a USB Host to the cutter and a USB Device to the PC, the Pico was spliced directly between the machine and the computer. Whenever the cutter transmitted its original blacklisted serial number upstream, the Pico intercepted and swapped it within milliseconds for an unbanned serial number.
The official software remained completely oblivious to the substitution, seamlessly recognizing the machine as a fresh device on the researcher’s account. While Cricut invested heavily in application-layer certificate pinning and cloud blacklisting, it omitted basic cryptographic authentication at the underlying USB transport layer. The openness of physical hardware dictates that without cryptographic protection, terminal protocols cannot withstand hardware relay attacks once users hold physical access.
Replacing Drive Rollers, Registering Fake Serials, and Exposing Security Risks
Figure: Official control software successfully recognizing the spoofed serial number and returning to operational status. Source: xssfox blog
To make the cutting machine fully usable, the researcher restored the degraded drive rollers using hot water molding and 3D-printed a custom enclosure to snugly fit the Raspberry Pi Pico inside the machine chassis. The modified device passed official software registration smoothly and could even register completely fabricated serial numbers on Cricut’s status servers. Physical mechanical repair combined with electronic signal spoofing brought the hardware back to life.
However, this rudimentary verification logic exposes severe authorization vulnerabilities. Because serial numbers lack anti-tampering verification and allow arbitrary registration, a malicious actor could theoretically craft serial numbers belonging to other legitimate users. By sending automated batch registration requests to the official software, an attacker could trigger cloud-side serial conflicts, accidentally deactivating or forcibly unbinding valid devices owned by innocent third parties.
Relying entirely on plaintext cloud serial comparisons for hardware security neither deters hardware hackers nor protects legitimate customers. The vendor’s restrictive architecture—designed to safeguard software subscription revenue—inadvertently introduced structural vulnerabilities that threaten the trust chain of its entire hardware ecosystem.
When Ownership Becomes a Lease: Software Hijacking Physical Hardware
This is not Cricut’s first controversy over hardware ownership rights. In 2021, the company announced plans to cap custom pattern uploads for non-subscribers, backing down only after facing a massive global boycott from craft enthusiasts. Similarly, traditional printer manufacturers like HP have faced ongoing backlash for pushing firmware updates that block third-party ink cartridges, keeping hardware business models at the center of heated debate.
While vendors argue that remote deactivation protects against fraudulent warranty claims and unauthorized trade-in resales, Right to Repair advocates counter that consumers who purchase hardware outright own full property rights to use, repair, and transfer their physical assets. Software licensing should not grant manufacturers a permanent license for remote destruction after point-of-sale.
The “Device as a Service” (DaaS) model attempts to package one-time hardware purchases into dynamic, subscription-dependent cloud permissions. This paradigm creates a profound rift with traditional consumer understandings of physical ownership. As demonstrated by a $5 microcontroller chip, software locks alone cannot suppress the fundamental demand for user autonomy over physical possessions.
Returning Physical Control to Physical Hardware
The cutter resurrected from e-waste reinforces an axiom of computer engineering: as long as physical hardware remains in the user’s hands, pure software locks cannot build insurmountable walls. From open-source microcontrollers to hardware proxy relays, the Right to Repair movement is using engineering methods to redefine the boundaries of hardware ownership.
Striking a balance between intellectual property protection and consumer repair rights requires joint exploration across legal and engineering domains. Respecting physical ownership and reducing artificial electronic waste must become core design principles for the future of smart hardware.
Reference Links:
- xssfox blog: Bypassing Cricut machine deactivation
- Hacker News discussion: Bypassing Cricut machine deactivation
