I wrap mine in aluminum foil and haven't had any problems.
Enjoy the benefits of a premium membership!
Upgrade Account
-
TalkBass has been independent since 1998. Add your voice.
Create a free account to reply to discussions, view embedded media, and browse with fewer display ads.
Join free Log in
Want zero display ads or expanded classifieds tools? Compare plans.
Could a pedal be hacked via malicious firmware?
- Thread starter Doctor Roberts
- Start date
Source Audio is collecting my playing via the C4 and they are thoroughly unimpressed.
Possibly, but it's still not all that likely. Something like a thermostat or a printer, which is on 24/7, is a better target.
Malicious code doesn't need to take up much room. That's why relatively simple IOT devices can get hacked and used in botnet attacks.
The bigger issue is that the pedal won't be on all the time, so it won't be all that useful in a botnet.
Very interesting, sometimes it is about exploring possibilities more than making an instant profit
Last edited:
I believe the more relevant question is: why not?
It's such a funny thought. Turn a guy's distortion unit into a ring modulator in the middle of a concert.
I was thinking about some use cases and thought the following: a troll goes to a Taylor Swift concert (or any popstar concert), "hacks" the bluetooth pedal and changes the setting to a Lo-Fi patch that makes the guitarist sound like those old videos of "Paco de Lucia shreds". It would make for good laughs and likes.
I just wrote almost the exact message. I'm 600% sure that I didn't read yours first.
Did you hack my brain by any chance?
Last edited:
Anything can be hacked. If there isn't a reasonable cost to benefit ratio involved then no one qualified to hack the thing, will.
In this case there's no attack vector that would make sense. You'd need to download bad firmware to a pedal, that somehow also could compromise the device you pair with it.
That bad firmware would need viable exploits it could leverage to compromise said device. If they aren't using some unknown 0 day style exploits, that's a non-starter.
Most parties that uncover exploits of that nature either sell them or use them on hacks that are much more profitable than this would be.
So the chances of this happening are nonexistent.
In this case there's no attack vector that would make sense. You'd need to download bad firmware to a pedal, that somehow also could compromise the device you pair with it.
That bad firmware would need viable exploits it could leverage to compromise said device. If they aren't using some unknown 0 day style exploits, that's a non-starter.
Most parties that uncover exploits of that nature either sell them or use them on hacks that are much more profitable than this would be.
So the chances of this happening are nonexistent.
Who thought it was such a great idea to control the fish tank thermometer from the same cell phone they access their bank???
Adamixoye
A PT Pro is cool for worship, right?
- Apr 9, 2012
- 18,158
- 69,338
- Disclosures
- Occasional Beta Tester for Confusion Studios, Singular Sound, and Source Audio
As I said earlier, I don't think this is true. Sometimes people do things just to do things. So, having a negative cost-benefit analysis doesn't make the chances nonexistent, just very low.
They're all around the globe. Just don't try to explain that to them.
In some cases this might be less far-fetched than many here are suggesting. I am thinking of platforms that use the Chrome browser for firmware changes and for patch editing. In the modular synth domain, Noise Engineering does this. In the pedals domain, Red Panda does. Probably others do, too.
The idea is that typically Chrome will be connected to internet, so a series of connections between the device (pedal or module) and Chrome could enable a malicious actor. Next thing you know, your smart refrigerator is a granular reverb. Or something.
It's an edge case, but not unthinkable, I'm thinking.
In order to record it has to have storage. In order to track it has to have the ability to collect data about its location and time -- either through built-in location systems (GPS and/or Wifi-based data) or by collecting that data from a device it's connected to. In order for that recording or tracking data to be useful to a third party that's not the pedal's owner it has to have a means to independently send its data out to a destination of its choosing.
So hypothetically yes. Practically speaking, no. Even if the firmware in an effects pedal is computationally capable of recording and tracking you, that capability is irrelevant if the hardware does not allow it. There's no point to installing a GPS into an effects pedal, and very little point to building a pedal capable of transmitting large volumes of data through the internet either through wifi or through an intermediary device (such as pedal -> bluetooth -> phone). Some pedals (such as loopers) are able to record, by design, but if the only data output the hardware allows are MIDI streams or PCM audio or such, there's no way for the pedal to address that audio to anything farther away than the designated upstream device (your soundboard or MIDI hub or whatnot).
The hacks we hear about are usually the malicious ones done for money. But I suspect most people who hack computers and electronics are doing so out of personal curiosity or to satisfy a personal interest. You don't hear about those often because, for example, getting the control pad of a color printer to play DOOM isn't interesting to many people, and getting an effects pedal to make sounds the manufacturer didn't intend has only a limited specialist's interest. Sometimes a well-intentioned hack is used as the platform for malicious hacks (such as when the discovery that an open-source image compression algorithm is Turing-complete was leveraged to hack the smartphones of political figures through maliciously-crafted GIFs), but there's still a line to be drawn between the people who did one and the people who did the other.
Passinwind
I know nothing.
- Dec 3, 2003
- 23,087
- 46,071
- Disclosures
- Designer/Toaster Tech @ Passinwind Electronics
I've actually seen that done at a fairly big guitar show after I pitched the idea to someone working in the booth I was hanging in, just as a "what-if" thing. It was with one of the newer Fender amps, but we could see a couple of H9s in another booth on the same computer the guy used to hack the Fender. One of us cheated and procured the Fender login credentials at their booth, so it barely counts as hacking really.
I have always understood hacking to be an action that is in a couple contexts:
1. Breaking into a secure network to snoop around and get to things that don't belong to you.
2. Breaking into many computers to do damage to said computes, or to augment them to do stuff you want them to do, like sent out emails for porn or viagra or something...
In the case of #2, Mac owners for years have always said that they were virus-proof. TBT they're not. Most hackers just don't have an interest because they're not a large enough target. - At least that's what I have read and it does make sense...
Based on the idea that networked Macintosh computers are too small of a group to be attractive enough to hack, musicians with pedals is an even smaller group. - Is it possible to impose a virus payload on a pedal patch? Probably. It's more likely to have a messed up patch that produces unexpected results. Also firmware incompatibility could be a thing. I've upgraded devices with perfectly good firmware that just went sideways at the install. Any of the last few things I mentioned could feel virus-like if they happened to you. If I were to experience a problem with how a pedal performs after an update or downloaded patch install, my first thought would not be virus. I'd more likely think, ok, how did i mess this one up...
1. Breaking into a secure network to snoop around and get to things that don't belong to you.
2. Breaking into many computers to do damage to said computes, or to augment them to do stuff you want them to do, like sent out emails for porn or viagra or something...
In the case of #2, Mac owners for years have always said that they were virus-proof. TBT they're not. Most hackers just don't have an interest because they're not a large enough target. - At least that's what I have read and it does make sense...
Based on the idea that networked Macintosh computers are too small of a group to be attractive enough to hack, musicians with pedals is an even smaller group. - Is it possible to impose a virus payload on a pedal patch? Probably. It's more likely to have a messed up patch that produces unexpected results. Also firmware incompatibility could be a thing. I've upgraded devices with perfectly good firmware that just went sideways at the install. Any of the last few things I mentioned could feel virus-like if they happened to you. If I were to experience a problem with how a pedal performs after an update or downloaded patch install, my first thought would not be virus. I'd more likely think, ok, how did i mess this one up...
This feels like a Dr. Evil plan, control the pedals, tweak such that all settings are turned to 11 all at once, cause world shaking earthquake, demand 10 million dollars to make it stop. IDK, maybe I shouldn't write Austin Powers scripts :/
