A developer bought a Rodecaster Duo audio interface and discovered it has SSH enabled by default with hardcoded public keys. By capturing the firmware update process via Wireshark and USBPcap, they reverse-engineered the HID-based update protocol (two ASCII commands: 'M' to enter update mode and 'U' to trigger flashing). The firmware is distributed as a plain gzipped tarball with no signature verification. Using this knowledge, they created custom firmware to enable password-based SSH authentication and add their own public key. The author reported the default SSH keys to RODE but received no response.

5m read timeFrom hhh.hn
Post cover image
Table of contents
fw updatecustom firmwareconclusion

Sort: