‘eyeDisk’ USB drive secured with iris recognition reveals password in plain text

Breaking a few of the plastic pegs allowed the “front” of the device to be seen:

Here we can see another MCUy type chip (in red); a third MCUy chip (in green), the camera with a quite reddy lens or filter on the outside (in blue) and two tssop8 chips (in purple). This will be done, but not until I’m happy to kill the device:

The interesting bit, from a hardware side is that there is not real central MCU – the Phison NAND controller has the most flexibility; but each chip is specific to a role. First a SCSI command:

Followed by a transferring of data from the host to the device:

That string in red, that’s the password I set on the device.

Source: www.pentestpartners.com