Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My audio interface has SSH enabled by default

hhh.hn

Post reply on HN
Print view View original

81–90 of 106 posts

Re: My audio interface has SSH enabled by default

#81

Post by CursedSilicon »

throwaway89201 wrote: post #24
rikafurude21 wrote: post #9

Its still crazy to me that everyone has a pocket AI-hacker ready to inspect firmware and modify their devices now. You just put the agent on it and it gives you access in minutes. You would have to be a Hotz tier hacker if you wanted to do anything close to this only last year, or at the very least extremely patient for long hours.

> You would have to be a Hotz tier hacker if you wanted to do anything close to this only last year This isn't true at all. Yes, LLMs have made it dramatically easier to analyse, debug and circumvent. Both for people who didn't have the skill to do this, and for people who know how to but just cannot be bothered because it's often a grind. This specific device turned out to be barely protected against anything. No en…

Minor correction. At 27c3's "Console Hacking 2010" talk. Geohot's Hypervisor work is mentioned at 4:25 or so. Described as "really unreliable" and "eh whatever" due to requiring hardware modification and only granting rudimentary hypervisor access.

These were the same people that then went on to explain how they reverse-engineered the encryption keys of the PS3 to enable "fakesigned" code to be installed

Re: My audio interface has SSH enabled by default

#82

Post by ssl-3 »

pjc50 wrote: post #75
ssl-3 wrote: post #56

Earlier quoted context omitted.

My audio interface is a Linux computer with FPGAs inside (that actually get field-programmed), with two gigabit Ethernet jacks that each talk to different parts of the machine. But I don't think anyone here would care about that. It's not such an unusual arrangement. I guess it's kind of impressive to use it on my desk at home, but in pro audio world it's actually kind of mundane. Maybe I'll write about it more after…

I have some of those at work: they're test platforms for the audio ICs, for things like SoundWire interfaces.

Dedicated test gear is different echelon. We've got some crazy-expensive RF test gear where I work that cost us way more than my house. That's an awesome corner of the world, with a combination of robust-but-fickle at every corner.

The sales volume is low, and the development cost is expensive, so the cost to purchase is also expensive. It's an interesting thing to think about, market-wise.

SoundWire. That's an internal[ish], hard-clocked, multipoint, digital audio bus, yeah? I don't know much about it. Looks like it's mostly useful for OE car audio applications?

---

This box I have is just a finished, retail-product, general-purpose pro audio DSP with a good amount of practical analog and digital audio IO. There are many others like it in the marketplace that do very similar things, but this one has a CVE that I want to exploit for my own purposes. :)

---

I really hate being secretive. I strongly prefer to just chat about stuff here, or there, or anywhere.

But even though I'm just some dude in Ohio, my HN comments consistently show up near the top of Google search results when looking at specific topics that I've covered, sometimes just in-passing, so I'm inclined to keep the details to myself for now.

I mean: In the grand scheme of things I haven't even been posting regularly here for very long, but more than once already I've Googled a question and found a link to an answer in my own comment here.

That can be problematic.

This is a great forum for open discussion, and for releasing information, and it is absolutely the wrong forum for secret skunkworks.

If I had a spare box so I could afford to potentially fuck this one up forever, I'd get on with it already. And then, of course, I would publish the results.

I wish I could spill the beans already and maybe get some great help from someone here who does this stuff routinely, but that scares future-me. If the devices can be rooted, then I want them all to be rooted (if useful) -or- better-secured (if not useful).

That sounds fine, except I don't want them to become botnet members, either.

It's a dilemma. There's a lot of this shit out there in the world that doesn't get updated.

Re: My audio interface has SSH enabled by default

#83

Post by jkrejcha »

ssl-3 wrote: post #49
tombert wrote: post #26

Earlier quoted context omitted.

I had to upgrade the firmware in my HP printer a couple years ago. It’s a printer that I think was released in ~2009 (I am not able to check right now), and in order to upgrade the RAM to 256MB I needed to do a firmware update. I dreaded this, but then I found out that all you do to update the firmware was FTP a tarball to the printer over the network. I dropped it in with FileZilla, it spent a few minutes whirring,…

> Let me FTP or SCP or SFTP a blob there, do a checksum or something for security reasons Whose security are we talking about here? Mine, or the manufacturer's?

I'm not sure if it was what OP meant, but it's arguably a good availability technique (as long as you can generate the checksum, that is). Like, if I want to run custom firmware and flash it, having a checksum which verifies that the firmware isn't corrupted may help prevent bricking.

Re: My audio interface has SSH enabled by default

#84

Post by kolinko »

jasomill wrote: post #58
rikafurude21 wrote: post #9

Its still crazy to me that everyone has a pocket AI-hacker ready to inspect firmware and modify their devices now. You just put the agent on it and it gives you access in minutes. You would have to be a Hotz tier hacker if you wanted to do anything close to this only last year, or at the very least extremely patient for long hours.

From the article, it sounds like he used Claude Code as an alternative to Wireshark and Google to decode USB HID traffic and find protocol documentation, respectively. I suppose this could save a bit of time if you don't already have Wireshark installed, with a minor risk of hallucinations. Other than this, he used Docker for some reason* to edit ~root/.ssh/authorized_keys and /etc/shadow in the firmware tarball, the…

> a bit of time

A bit of time is an understatement.

I used Wireshark to analyze various things (mostly smart home) over the years, but now CC does in minutes what it would take me a few hours before - and provides dedicated, custom made panels for whatever I want.

As an example - debugging KNX magistrale in my home, previously it was either wireshark and a ton of regexes, handwritten scripts (or official software that was terrible), now you just tell CC what you want to extract, and you get beautiful real-time views of the activity.

One thing is previewing the traffic, but then CC can easily fetch docs for any device it finds on the network, if it has an API (official or not), utilize it and do whatever you want.

Re: My audio interface has SSH enabled by default

#85

Post by rl3 »

throwaway89201 wrote: post #24
rikafurude21 wrote: post #9

Its still crazy to me that everyone has a pocket AI-hacker ready to inspect firmware and modify their devices now. You just put the agent on it and it gives you access in minutes. You would have to be a Hotz tier hacker if you wanted to do anything close to this only last year, or at the very least extremely patient for long hours.

> You would have to be a Hotz tier hacker if you wanted to do anything close to this only last year This isn't true at all. Yes, LLMs have made it dramatically easier to analyse, debug and circumvent. Both for people who didn't have the skill to do this, and for people who know how to but just cannot be bothered because it's often a grind. This specific device turned out to be barely protected against anything. No en…

>... but as there's no complete feedback loop, it still would require a lot of human effort.

Not for long. Picture this: a robot receives instructions on what to physically solder in order to complete the desired modification task.

However, before it can send an image back to the vision-aware LLM guiding it, the PCB lights on fire along with the robot because said LLM confidently gave the wrong instructions.

Then, the robotic fire brigade shows up and mostly walks into walls unable to navigate anywhere useful.

The future is bright.

Re: My audio interface has SSH enabled by default

#86

Post by ssl-3 »

jkrejcha wrote: post #83
ssl-3 wrote: post #49

Earlier quoted context omitted.

> Let me FTP or SCP or SFTP a blob there, do a checksum or something for security reasons Whose security are we talking about here? Mine, or the manufacturer's?

I'm not sure if it was what OP meant, but it's arguably a good availability technique (as long as you can generate the checksum, that is). Like, if I want to run custom firmware and flash it, having a checksum which verifies that the firmware isn't corrupted may help prevent bricking.

Right, I'm not sure either. Hence the question. :)

Checksums are great for helping to validate data integrity. And data integrity can be related to security.

But over the last 25 years or so, I've grown to become pretty averse to phrasing that parse like "for security purposes".

Re: My audio interface has SSH enabled by default

#89

Post by realo »

ssl-3 wrote: post #54
realo wrote: post #44

Earlier quoted context omitted.

Well... if you look behind anything that plugs into a wall socket you will see that it has ( among many other things) a CE mark. Even things in the USofA have a CE mark. If your new product cannot have its CE mark for whatever reason, you will not have the approbations to sell in the USA either. What the CRA will do, is if you do not have a "CRA" compliant product, you will not have the CE mark. Which means you will…

We don't place any value on the CE mark in the States. A lot of consumer electronics need to be FCC compliant, which involves a process of proving that the device doesn't emit too much of the wrong EMI/RFI in the wrong places. And safety-wise, we use tend to use ETL, UL, and CSA for testing. These are third-party Nationally Recognized Testing Labs, and their own marks are used on devices they approve. But they're onl…

Oh. Sorry. I work for a rather large company that sells globally. In our business unit we always considered the CE mark mandatory.

I understand your point though. Of course a US company that is only ever going to sell in the US does not need to bother with international marks.

Re: My audio interface has SSH enabled by default

#90

Post by extraduder_ire »

userbinator wrote: post #46

I think "my audio interface is a 64-bit Linux computer" would've sounded far more interesting to me as a title. Perhaps a decade or two ago, the functionality of that device would've likely been implemented on a small 16-bit or 32-bit SoC running an RTOS like VxWorks. Given how many physical controls it has, turning it into a game console seems like a logical next step.

Current ram/storage squeeze aside, chips are cheap. Cheap as chips.

Hard to beat the cost and compatibility of linux too.

Post reply on HN