"Hit any key to stop autoboot": what pressing the key does

The prompt Hit any key to stop autoboot: N (where N counts down 3, 2, 1, 0) is emitted by U-Boot after DRAM init and before it loads the kernel. Pressing any key within the countdown drops the boot into an unauthenticated command shell on the serial console.

The shell is not a toy. It lets anyone with UART access to the debug header do all of:

• printenv: dump the entire boot environment, including any variables the firmware stashed at build time (crypto keys, Wi-Fi provisioning tokens, backend URLs, factory-signing state).
• setenv bootargs "console=ttyS0,115200 root=/dev/mtdblock2 rw init=/bin/sh" + boot: inject an alternate init, dropping the system into a root shell before any userspace authentication runs.
• tftpboot or fatload usb + bootm: load an arbitrary kernel image and boot it.
• md.b, sf read: dump raw flash contents to reconstruct firmware for offline analysis.
• saveenv: persist compromised env variables so the change survives reboot.

No password. No token. Nothing that resembles authentication.

20 of the 31 real boot captures in the BootIntel sample corpus expose this prompt: consumer routers, hobbyist single-board computers, TI industrial gateways. The prompt is not a bug; it's a bootloader configuration the vendor left in shipping firmware.

Mitigations, best to worst:

1. CONFIG_BOOTDELAY=-2 in the U-Boot config: no interruption possible.
2. CONFIG_AUTOBOOT_KEYED + CONFIG_AUTOBOOT_STOP_STR: require a specific key sequence, not any keypress.
3. Physical enclosure with tamper evidence: if you can't defend the shell, at least defend the header.

Even a 3-second countdown falls to a scripted attacker with a serial cable and a printf '\r' loop. The exact attack incantation is public.