Issue dossier
The stock updater's own comment says updates are integrity-checked with SHA-256 but not signed, so a malicious server on an adversarial network could serve matching hashes for malicious files. It names a signed ed25519 manifest as the future fix. The site's publish workflow still sets a plain-HTTP host with a note to switch once a certificate is issued, although the dev manifest was served over HTTPS on October 27, 2026.
A linkable camp-impact record with badge context, severity, evidence confidence, and source notes.
Back to issues index
unsigned OTA updates · stock updater source comment · documented limitation
The record treats OTA as a user-started convenience with a known trust gap, not as a secured update channel. Whether attendee badges point at the prod channel or have OTA configured is not shown.
- Badge
- OzSec 2026 Conagotchi Badge
- Category
- unsigned OTA updates
- Severity
- note
- Confidence
- stock updater source comment
- Status
- documented limitation
- Timeframe
- dev channel version 12, October 20, 2026
- Source note
- rufflabs/ota.conagotchi.com dev/ota.py and .github/workflows/sync-ota.yml, checked 2026-10-27.
community alternative firmware
Alternative Rust firmware for the Conagotchi by John Vishnefske, created October 24, 2026. It trades Chi with stock badges, saves contacts, shows an animated pet, adds a Bluetooth LE GATT service and synchronised LED patterns, and is driven by the badgectl host tool over the USB debug link. Its README says the stock files, radio key, and DOOM stay on the badge. The repository has no licence file.
Badge: OzSec 2026 Conagotchi Badge
community firmware release
First release, published October 24, 2026, with a merged flash image and SHA-256 checksum. Not an OzSec release.
Badge: OzSec 2026 Conagotchi Badge
community hardware and protocol notes
Design notes with the GPIO table taken from the stock firmware's config.py and the board silkscreen, the stock image layout (MicroPython 1.27, littlefs, DOOM partition), the Chi trading protocol, and hardware checks dated October 23 and 24, 2026.
Badge: OzSec 2026 Conagotchi Badge
official badge talk listing
Friday, October 23, 2026, Session 3 (1:30-2:15 PM, Redbud B): a joint talk by Jason, Chief Pixel Chef, Angle, and Daniel on bringing the Conagotchi badge to life, from concept to completion. No recording or slides have been published.
Badge: OzSec 2026 Conagotchi Badge
official event page
Official site for the October 23-24, 2026 conference at the Hyatt Regency Wichita. Its FAQ tells attendees to bring a laptop and a USB data cable for connecting to their badge, the sponsor list names Raxis as Badge Sponsor and Arista as Lanyard Sponsor, the leadership list names Jason Taylor as Badge President / Honorary Chair, and the page loads a Conagotchi stylesheet. On October 27, 2026 it still invited ticket purchases and had no wrap-up.
Badge: OzSec 2026 Conagotchi Badge
official speaker page
Speaker entry for the Conagotchi talk: your badge creation crew has been hard at work the past year preparing to bring you this year's badge.
Badge: OzSec 2026 Conagotchi Badge
organizer-linked stock firmware update site
GitHub Pages repository for ota.conagotchi.com, created September 24, 2026 by a GitHub account named Jason Taylor. Its publish workflow copies the badge application tree from the non-public OzSecICT/badge-conagotchi repository: a dev channel on every push to main and a prod channel, meant for attendee badges, only on ota-v* tags. On October 27, 2026 only the dev channel had been published, last as version 12 on October 20, and the prod manifest URL returned 404. The repository has no licence file.
Badge: OzSec 2026 Conagotchi Badge
stock firmware release notes and file list
Version 12 manifest of October 20, 2026, generated from OzSecICT/badge-conagotchi commit a46b4fd. It lists 270 files (MicroPython modules, 30 screens, 17 challenge modules, 8 character modules, and 160 images) with SHA-256 hashes, and release notes for new challenges (Full Spectrum, Stamp Collector), the Firewall Rush and Intrusion Prevention games, an item shop and item trading, Packachi artwork, a Completionist challenge that keeps the green raffle LED lit, the retired Freedomchi test character, and a start-up time cut from about 10 to 5 seconds.
Badge: OzSec 2026 Conagotchi Badge
John Vishnefske / GitHub · retrieved 2026-10-26
Secondary first-hand source for the hardware and stock-firmware details: ESP32-S3-WROOM-1 with 8 MB flash and no PSRAM, GC9A01 240x240 display, eight WS2812B LEDs, red alert and green raffle LEDs, five buttons, 38 kHz infrared, link UART, and the Bluetooth LE Chi trading protocol, read from the stock firmware and silkscreen of one badge. It names the badge as the OzSec 2026 Conagotchi and records hardware tests on October 23, 2026, the first conference day. It is not an organizer document.
Badge: OzSec 2026 Conagotchi Badge
OzSec · retrieved 2026-10-27
Primary official source for the October 23-24, 2026 dates, the Hyatt Regency Wichita venue, the instruction to bring a USB data cable for the badge, the Raxis badge sponsorship, the Badge President listing, and the Conagotchi site theme. It has no post-event wrap-up.
Badge: OzSec 2026 Conagotchi Badge
OzSec · retrieved 2026-10-26
Primary official source for the Conagotchi name and the badge talk, its time, room, and listed speakers.
Badge: OzSec 2026 Conagotchi Badge
OzSec · retrieved 2026-10-26
Primary official source saying the badge creation crew worked on this year's badge for the past year.
Badge: OzSec 2026 Conagotchi Badge
rufflabs / GitHub · retrieved 2026-10-27
Organizer-linked source for the stock badge application: a repository by an account named Jason Taylor, matching the official Badge President listing, whose workflow publishes from OzSecICT/badge-conagotchi. It shows the pre-event dev build (version 12, October 20, 2026), its game, challenge, and character modules, the 'OZ' Bluetooth LE company ID, and an unsigned file-level OTA updater. It leaves out config.py, so it does not give pin assignments, and it does not show which version attendee badges carried.
Badge: OzSec 2026 Conagotchi Badge