The ecobee3 lite device does not use encryption on the NAND flash storage. The device firmware as well as user information is stored on the flash chip. A threat actor with physical access can extract sensitive data from the flash storage by removing the NAND flash chip and connecting directly using a parallel flash reader. With a copy of the device firmware, a threat actor can perform offline analysis to identify vulnerabilities in the device, including recovering the root password.
The research team demonstrated that device storage was unencrypted by desoldering and connecting directly to the NAND chip using a parallel flash reader.
The team was able to recover the content of the device. Using the recovered information, the team extracted root passwords and PINs used to access the serial console on the device.