A developer bought a Rodecaster Duo audio interface and discovered it has SSH enabled by default with hardcoded public keys. By capturing the firmware update process via Wireshark and USBPcap, they reverse-engineered the HID-based update protocol (two ASCII commands: 'M' to enter update mode and 'U' to trigger flashing). The firmware is distributed as a plain gzipped tarball with no signature verification. Using this knowledge, they created custom firmware to enable password-based SSH authentication and add their own public key. The author reported the default SSH keys to RODE but received no response.
Sort: