# 519: The Password Is All Zeros

- Show: [Embedded.fm](https://hardwarepodcasts.com/podcast/embedded-fm)
- Published: 2026-01-23
- Length: 1h 06m
- Episode: 519
- Page: https://hardwarepodcasts.com/podcast/embedded-fm/2026-01-23-519-the-password-is-all-zeros
- Listen: https://embedded.fm/episodes/519

## Summary

Mark Omo and James Rowley from Marcus Engineering discuss their research into SECURAM safe locks, revealing that the ProLogic series contains critical security flaws, including a debug port password set to all zeros and codes stored on the external keypad. They detail two exploits, 'code snatch' and 'reset heist,' which allow unauthorized access to safes used for pharmaceuticals and cash, despite UL high-security certification. The conversation covers the ethical and legal challenges of responsible disclosure, including threats from SECURAM's legal team and support from the EFF's Coders' Rights Project.

## Chapters

- [0:07](https://hardwarepodcasts.com/podcast/embedded-fm/2026-01-23-519-the-password-is-all-zeros#t=7) Introduction and Background
- [8:41](https://hardwarepodcasts.com/podcast/embedded-fm/2026-01-23-519-the-password-is-all-zeros#t=521) The SECURAM Lock Vulnerabilities
- [14:25](https://hardwarepodcasts.com/podcast/embedded-fm/2026-01-23-519-the-password-is-all-zeros#t=865) Exploiting the Debug Port and PS4 Chip
- [19:54](https://hardwarepodcasts.com/podcast/embedded-fm/2026-01-23-519-the-password-is-all-zeros#t=1194) Threat Modeling and Design Failures
- [22:42](https://hardwarepodcasts.com/podcast/embedded-fm/2026-01-23-519-the-password-is-all-zeros#t=1362) Certification Gaps and Industry Standards
- [40:52](https://hardwarepodcasts.com/podcast/embedded-fm/2026-01-23-519-the-password-is-all-zeros#t=2452) Responsible Disclosure and Legal Threats
- [46:10](https://hardwarepodcasts.com/podcast/embedded-fm/2026-01-23-519-the-password-is-all-zeros#t=2770) Security Through Obscurity vs. Transparency
- [57:45](https://hardwarepodcasts.com/podcast/embedded-fm/2026-01-23-519-the-password-is-all-zeros#t=3465) Future Work and Advice for Engineers

## Topics

- [Security & privacy](https://hardwarepodcasts.com/topic/security-and-privacy)
- [Debugging & failure analysis](https://hardwarepodcasts.com/topic/debugging-and-failure-analysis)
- [Microcontrollers & dev platforms](https://hardwarepodcasts.com/topic/microcontrollers-and-platforms)
- [Certification & compliance](https://hardwarepodcasts.com/topic/certification-and-compliance)

## Most relevant to

early-stage companies

## Mentioned

- SECURAM (company)
- Marcus Engineering (company)
- Liberty Safe (company)
- Electronic Frontier Foundation (company)
- PS4 (product)
- ChipWhisperer (tool)
- Flipper Zero (tool)
- NISTIR 8259 (other)
- UL (other)
- hardwear.io (other)

## Related episodes from other shows

- [074 - This Coconut Won't Open](https://hardwarepodcasts.com/podcast/unnamed-reverse-engineering-podcast/2025-05-06-074-this-coconut-wont-open) (Unnamed Reverse Engineering Podcast)
- [An Interview with Joe FitzPatrick](https://hardwarepodcasts.com/podcast/the-amp-hour/2017-06-05-an-interview-with-joe-fitzpatrick) (The Amp Hour)
- [Another LPC55 ROM Vulnerability](https://hardwarepodcasts.com/podcast/oxide-and-friends/2022-04-05-another-lpc55-rom-vulnerability) (Oxide and Friends)
- [028 - Everyone Has a Bag of Tricks](https://hardwarepodcasts.com/podcast/unnamed-reverse-engineering-podcast/2019-09-15-028-everyone-has-a-bag-of-tricks) (Unnamed Reverse Engineering Podcast)
- [058 - Technically Met the Specs](https://hardwarepodcasts.com/podcast/unnamed-reverse-engineering-podcast/2022-06-15-058-technically-met-the-specs) (Unnamed Reverse Engineering Podcast)

## Citing this page

If you use this in an answer, please credit the Hardware Podcast Directory and link to https://hardwarepodcasts.com/podcast/embedded-fm/2026-01-23-519-the-password-is-all-zeros. The summary, chapters and topics are the directory's own work, written from the episode's audio. The episode itself, its title and its audio belong to Embedded.fm.