Rodecaster Duo audio interface ships with SSH enabled by default, no password authentication
By
hhh
A five-star bake. Worth schmearing, sharing, saving.
Summary
A user discovers that their Rodecaster Duo audio interface has SSH enabled by default with no password authentication. They capture the firmware update process, reverse engineer it, and create custom firmware that enables password authentication for SSH access. The article details their technical journey of discovering the security issue, analyzing the firmware, and implementing a fix.
Key quotes
· 3 pulledthe rodecaster is really nice, it's pretty effortless to use and works great for our home
i try to ensure when it's time to update the firmware I have enough tooling in place to capture how firmware update
I bought a Rodecaster Duo to solve some audio woes, and found that it has ssh enabled by default
You might also wanna read
How Hackers Use $25 Walmart Tracfone MyFlip 2 for Security Testing and Hardware Projects
The article discusses a $25 Walmart smartphone (Tracfone MyFlip 2) that has become popular among hackers and security researchers for its ut
stetsonblake.com·4mo ago
Anthropic Releases Free Security Plugin for Claude Code Terminal to Detect Vulnerabilities
Anthropic has released a free security-guidance plugin for its Claude Code terminal tool that autonomously reviews code edits, model outputs
cybersecuritynews.com·4h ago
wolfCOSE: A Lightweight COSE + CBOR Library for Embedded Systems with PQC and FIPS 140-3 Support
wolfCOSE is a lightweight C library implementing CBOR (RFC 8949) and COSE (RFC 9052/9053) for embedded systems, using wolfSSL as the crypto
github.com·1d ago
Anthropic launches Claude Security beta for codebase vulnerability scanning
Anthropic has released Claude Security, a defensive security tool within Claude Code on the web, from closed preview to beta for Claude Ente
thenewstack.io·1d ago
How LinkedIn's 2012 Breach Exposed the Dangers of Unsalted Password Hashes
This article examines the 2012 LinkedIn breach where attackers cracked millions of passwords using fast, unsalted hashes like MD5 and SHA-1.
hendryadrian.com·1d ago
AI-Generated npm Package Leaks Its Own GitHub Token, Exposing Malware Operator
A malicious npm package named mouse5212-super-formatter, identified by OX Security, was caught leaking its own hardcoded GitHub token. This
infosecurity-magazine.com·1d ago