Hacker News

Funny you mention that, because my first thought when reading that he submitted a report to the vendor was that they'd "fix" the problem by requiring firmware uploads to be signed (in which case it's "secure" because only their service techs have access to the private key, IOW, security by sternly worded written policy).

I’m guilty of using my Zoom R16 in a similar fashion; as USB audio interface most of the time for a couple of inputs.

The only thing that is a little sad about it is that for example the faders do nothing when the R16 is in USB audio interface mode.

It does however like to randomly turn on reverb and one other effect after power cycling. Which I sometimes forget and then wonder for half a second why the audio is sounding weird :P So there is some extra functionality that is available even in USB audio interface mode, although in this case not desirable for me to have enabled within it. If I want to add reverb or other effects when using the R16 as USB audio interface, I prefer to do so in the DAW. I would have liked to be able to use the faders though.

My favorite firmware update story is a time when I had to reflash firmware on an old IBM Fibre Channel/SCSI gateway because it had become corrupted and wouldn't boot.

Fortunately the first stage bootloader (which may have been in ROM) was intact, and had debugging commands that allowed reading and writing bytes of memory one at a time, and to jump to a specific memory address.

After using IDA to find the compressed firmware in the update blob and figure out how the update process worked, I was then able to use an expect script to use bootloader commands to slowly poke the firmware and the code that decompressed and copied the updated firmware to flash (extracted from the firmware itself after decompressing it with zlib) into RAM a byte at a time, then to jump to the uploaded code to finish the installation.

Worked like a charm, and enabled me to continue using the device for several years until I no longer had a use for it.

I think my favorite is wifi access points that support tftp to load a firmware image (with some kind of hardware switch to enable this state). These can be made effective unbrickable and it's really nice for experimenting.

> Let me FTP or SCP or SFTP a blob there, do a checksum or something for security reasons

Whose security are we talking about here? Mine, or the manufacturer's?

I agree that it shouldn't have SSH enabled, but I do like that the firmware isn't encrypted or signed, so it's not hard to mod it, at no cost to thr manufacturer

I’m building an audio device. It runs Linux for the control plane (it’s just a CM4 running Yocto, maybe I’ll leave SSH running on production units, maybe not, haven’t decided yet). No audio passes through the CM4, there’s a dedicated FPGA and MCU for that. It’s been a fun project, first time hardware for me, feel free to ask my anything!

I have some of those at work: they're test platforms for the audio ICs, for things like SoundWire interfaces.

Yeah, LAN is the line for me. USB-side sshd is a weird dev leftover; LAN means it’s now in the home threat model.

>... but as there's no complete feedback loop, it still would require a lot of human effort.

Not for long. Picture this: a robot receives instructions on what to physically solder in order to complete the desired modification task.

However, before it can send an image back to the vision-aware LLM guiding it, the PCB lights on fire along with the robot because said LLM confidently gave the wrong instructions.

Then, the robotic fire brigade shows up and mostly walks into walls unable to navigate anywhere useful.

The future is bright.

The hacking aspect has been hit and miss for me. Just today I was trying to verify a fix for a CVE and even giving the agent the CVE description + details on how to exploit it and the code that fixed it, it couldn't write the exploit code correctly.

Not to say it's not super useful, as we can see in the article

Minor correction. At 27c3's "Console Hacking 2010" talk. Geohot's Hypervisor work is mentioned at 4:25 or so. Described as "really unreliable" and "eh whatever" due to requiring hardware modification and only granting rudimentary hypervisor access.

These were the same people that then went on to explain how they reverse-engineered the encryption keys of the PS3 to enable "fakesigned" code to be installed

didn't PS3 have a hardcoded nonce for their ECDSA impl that allowed full key recovery? I would agree that I doubt LLMs let people mount side-channel attacks easily on consumer electronics though.

> fully secured against attackers, of which the mere existence of a hypervisor layer is proof of

https://en.wikipedia.org/wiki/Virtual_machine_escape

> Perhaps an LLM can assist with mounting such an attack, but as there's no complete feedback loop, it still would require a lot of human effort.

LLMs have had no problem modifying software on an attached android phone. It's only a matter of time.

I used wireshark to capture the traffic, and looked thru the pcap for the area that looked like the updating, and gave the packet numbers and the pcap to claude code to find the details of how it worked instead of scribbling notes for an hour or two i’d guess

I’m very used to doing this stuff manually for various devices and software, but am also interested in tracking llm progress, and it seemed simple enough to get a rundown of what was happening while I did other work.

It was the first time I have messed around with hid devices though, so that was aided by claude

and yeah i’ve been bit by having to google how to get mkpasswd dozens of times over the years and used to have to do a lot of rootfs editing on a mac, so I got used to doing it in a container.

no real reason for wanting pw auth, I ended up turning it off afterwards but it’s been a bit since I wrote this

thanks for the comment!

> a bit of time

A bit of time is an understatement.

I used Wireshark to analyze various things (mostly smart home) over the years, but now CC does in minutes what it would take me a few hours before - and provides dedicated, custom made panels for whatever I want.

As an example - debugging KNX magistrale in my home, previously it was either wireshark and a ton of regexes, handwritten scripts (or official software that was terrible), now you just tell CC what you want to extract, and you get beautiful real-time views of the activity.

One thing is previewing the traffic, but then CC can easily fetch docs for any device it finds on the network, if it has an API (official or not), utilize it and do whatever you want.

I'm sorry, are you trusting an LLM to touch a camera that costs like a new car?

to me this is just normal to do with your devices. I think it’s interesting because it has no fw signing etc and because they left ssh, not because of figuring out how to do the patching.

So both mics will pick up both people (at least somewhat, in the same room) - but because there is no, I assume 20-100ms latency going through the system, to discord, and back - it avoids a slight difference in timing of the two mics picking up the same sound slightly differently. Is that right?

Very cool!

Why connect it to both computers?

I get it! Thank you that is genius.

Not in the same league or form factor, but I have an old Jabra 65 headset, and the noise canceling is amazing. I can be playing my cello while unmuted on a call, and nobody can hear it.

I know headsets aren't everyone's cup of tea, but a mic close to the source (your mouth) with good noise canceling is a solid solution.

Cyber Resilience Act [1], which is well-intentioned, and doesn't outright forbid user access to firmware, but most vendors will take the easy road and outright block user-modifiable software (if they didn't already), so that their completely closed source, obfuscated and vulnerable version is the only version allowed on their devices.

[1] https://en.wikipedia.org/wiki/Cyber_Resilience_Act

https://github.com/ThomasStolt/Copy-Recordings-Off-Rodecaste...

It used to be completely open lol

Hacker News doesn't know what to do with anyone that doesn't think the world is ending and that humanity is inherently evil and must be punished.

It's still better than Reddit, though.