Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My audio interface has SSH enabled by default

hhh.hn

Post reply on HN
Print view View original

61–70 of 106 posts

Re: My audio interface has SSH enabled by default

#61

Post by jasomill »

EvanAnderson wrote: post #16
yonatan8070 wrote: post #2

Having the firmware image just be a boring old tarball + hash sounds super nice. I wish more devices were this open, and I hope Rode won't see this and decide to lock the firmware upgrades down.

In the off chance anybody from Rode sees this: This makes me want to purchase your gear. Don't change it. It's funny this comes up now. Tomorrow I'm dragging my Zoom R20 recorder on-site to use as an overly-featured USB audio interface for a single-mic live stream. If I'd know this about Rode a week ago I'd have purchased one of these and could have left my R20 hooked-up in the home studio!

Funny you mention that, because my first thought when reading that he submitted a report to the vendor was that they'd "fix" the problem by requiring firmware uploads to be signed (in which case it's "secure" because only their service techs have access to the private key, IOW, security by sternly worded written policy).

Re: My audio interface has SSH enabled by default

#63

Post by mikae1 »

BiraIgnacio wrote: post #39
throwaway89201 wrote: post #24

Earlier quoted context omitted.

> You would have to be a Hotz tier hacker if you wanted to do anything close to this only last year This isn't true at all. Yes, LLMs have made it dramatically easier to analyse, debug and circumvent. Both for people who didn't have the skill to do this, and for people who know how to but just cannot be bothered because it's often a grind. This specific device turned out to be barely protected against anything. No en…

The hacking aspect has been hit and miss for me. Just today I was trying to verify a fix for a CVE and even giving the agent the CVE description + details on how to exploit it and the code that fixed it, it couldn't write the exploit code correctly. Not to say it's not super useful, as we can see in the article

CVEs and all, but I just can't wait for firmwares for cheaper modern cameras from Sony, Nikon and Panasonic getting hacked and modified too add features from more expensive models.

They're all firmware restricted to justify buying more expensive models, in one way or another way.

DNG support would be pretty awesome too.

Re: My audio interface has SSH enabled by default

#64

Post by jasomill »

tombert wrote: post #26
yonatan8070 wrote: post #2

Having the firmware image just be a boring old tarball + hash sounds super nice. I wish more devices were this open, and I hope Rode won't see this and decide to lock the firmware upgrades down.

I had to upgrade the firmware in my HP printer a couple years ago. It’s a printer that I think was released in ~2009 (I am not able to check right now), and in order to upgrade the RAM to 256MB I needed to do a firmware update. I dreaded this, but then I found out that all you do to update the firmware was FTP a tarball to the printer over the network. I dropped it in with FileZilla, it spent a few minutes whirring,…

My favorite firmware update story is a time when I had to reflash firmware on an old IBM Fibre Channel/SCSI gateway because it had become corrupted and wouldn't boot.

Fortunately the first stage bootloader (which may have been in ROM) was intact, and had debugging commands that allowed reading and writing bytes of memory one at a time, and to jump to a specific memory address.

After using IDA to find the compressed firmware in the update blob and figure out how the update process worked, I was then able to use an expect script to use bootloader commands to slowly poke the firmware and the code that decompressed and copied the updated firmware to flash (extracted from the firmware itself after decompressing it with zlib) into RAM a byte at a time, then to jump to the uploaded code to finish the installation.

Worked like a charm, and enabled me to continue using the device for several years until I no longer had a use for it.

Re: My audio interface has SSH enabled by default

#65

Post by lukeh »

ssl-3 wrote: post #56
userbinator wrote: post #46

I think "my audio interface is a 64-bit Linux computer" would've sounded far more interesting to me as a title. Perhaps a decade or two ago, the functionality of that device would've likely been implemented on a small 16-bit or 32-bit SoC running an RTOS like VxWorks. Given how many physical controls it has, turning it into a game console seems like a logical next step.

My audio interface is a Linux computer with FPGAs inside (that actually get field-programmed), with two gigabit Ethernet jacks that each talk to different parts of the machine. But I don't think anyone here would care about that. It's not such an unusual arrangement. I guess it's kind of impressive to use it on my desk at home, but in pro audio world it's actually kind of mundane. Maybe I'll write about it more after…

I’m building an audio device. It runs Linux for the control plane (it’s just a CM4 running Yocto, maybe I’ll leave SSH running on production units, maybe not, haven’t decided yet). No audio passes through the CM4, there’s a dedicated FPGA and MCU for that. It’s been a fun project, first time hardware for me, feel free to ask my anything!

Re: My audio interface has SSH enabled by default

#66

Post by yonatan8070 »

gamerslexus wrote: post #55
yonatan8070 wrote: post #2

Having the firmware image just be a boring old tarball + hash sounds super nice. I wish more devices were this open, and I hope Rode won't see this and decide to lock the firmware upgrades down.

I don't want my audio interface to run SSH (and have some random authorized key added), personally.

I agree that it shouldn't have SSH enabled, but I do like that the firmware isn't encrypted or signed, so it's not hard to mod it, at no cost to thr manufacturer

Re: My audio interface has SSH enabled by default

#67

Post by hhh »

uwagar wrote: post #62

is he happy that rode has an ssh to his device? the guy is like too nice. where's the outrage?

I would like for SSH to be turned off, but I also like that I can just do that myself.

Normally when I look at these devices firmware they’re horrific beasts with insane issues everywhere. This just requires a config change to fix the single thing I don’t like about it. There’s plenty of outrage in the world :)

Re: My audio interface has SSH enabled by default

#68

Post by hhh »

ZihangZ wrote: post #60

Yeah, this is pretty common once a device has any real DSP in it. There's usually some stripped-down Linux on an ARM SoC underneath, and the vendor BSP just happens to ship with sshd on. Not necessarily malice, more like nobody on the audio side really owns the rootfs. The big question is whether it's only listening on the USB-side network, or on the actual LAN. First one is annoying. Second one would actually bother…

It is listening on the LAN. It connects over wifi only when you use certain features, so i didn’t test if that interface is listening as well.

Re: My audio interface has SSH enabled by default

#69

Post by hhh »

jasomill wrote: post #58
rikafurude21 wrote: post #9

Its still crazy to me that everyone has a pocket AI-hacker ready to inspect firmware and modify their devices now. You just put the agent on it and it gives you access in minutes. You would have to be a Hotz tier hacker if you wanted to do anything close to this only last year, or at the very least extremely patient for long hours.

From the article, it sounds like he used Claude Code as an alternative to Wireshark and Google to decode USB HID traffic and find protocol documentation, respectively. I suppose this could save a bit of time if you don't already have Wireshark installed, with a minor risk of hallucinations. Other than this, he used Docker for some reason* to edit ~root/.ssh/authorized_keys and /etc/shadow in the firmware tarball, the…

I used wireshark to capture the traffic, and looked thru the pcap for the area that looked like the updating, and gave the packet numbers and the pcap to claude code to find the details of how it worked instead of scribbling notes for an hour or two i’d guess

I’m very used to doing this stuff manually for various devices and software, but am also interested in tracking llm progress, and it seemed simple enough to get a rundown of what was happening while I did other work.

It was the first time I have messed around with hid devices though, so that was aided by claude

and yeah i’ve been bit by having to google how to get mkpasswd dozens of times over the years and used to have to do a lot of rootfs editing on a mac, so I got used to doing it in a container.

no real reason for wanting pw auth, I ended up turning it off afterwards but it’s been a bit since I wrote this

thanks for the comment!

Re: My audio interface has SSH enabled by default

#70

Post by hhh »

akdev1l wrote: post #53
rikafurude21 wrote: post #9

Its still crazy to me that everyone has a pocket AI-hacker ready to inspect firmware and modify their devices now. You just put the agent on it and it gives you access in minutes. You would have to be a Hotz tier hacker if you wanted to do anything close to this only last year, or at the very least extremely patient for long hours.

there’s barely any hacking here the guy found this through looking at the firmware but nmap -p 22 would have also found this So like the first thing you would do to attack the device I found an issue exactly like this on an ISP-provided router. I am nowhere near geohot but also didn’t even do as much as the guy in the article lmao

to me this is just normal to do with your devices. I think it’s interesting because it has no fw signing etc and because they left ssh, not because of figuring out how to do the patching.
Post reply on HN