Could a pedal be hacked via malicious firmware?

[N. Kentucky Bass]

Put this one on your board and tells us what happens:

Putin Russian Big Muff Pi 2015 Killer Pedal with 2N5089 EBC/NPN Silicon Bipolar Transistors | Reverb

Link Removed

 

[tbz]

But I suspect most people who hack computers and electronics are doing so out of personal curiosity or to satisfy a personal interest.

That isn't even remotely accurate. Children with no real skills do that.

Competent individuals that are actually capable of this stuff, do it for profit. You need to be at the "actually competent software engineer" level or above to create a highly specialized exploit of this nature.

I'm guessing you don't work in IT and aren't well versed in, say, how STUXNET was created or propagated.

 

[capnjagg]

Honestly I think a bigger concern would be a Bluetooth-enabled pedal (e.g., the Eventide H9) getting "hacked" by someone who then messes with the settings.

This is a particularly fun one to think about. Consider going to see one of your favorite bands, when all of a sudden somebody from the crowd starts messing with the guitarist's tone, just because they can.

 

[tbz]

As I said earlier, I don't think this is true. Sometimes people do things just to do things. So, having a negative cost-benefit analysis doesn't make the chances nonexistent, just very low.

No. If you're competent enough to do this, you have a day job that you do this at for a living. Anyone at the "eh I just like to play around" state of their career development wouldn't be able to create this. It's too complicated.

 

[tbz]

In the case of #2, Mac owners for years have always said that they were virus-proof. TBT they're not. Most hackers just don't have an interest because they're not a large enough target. - At least that's what I have read and it does make sense...

It's very difficult to emulate Mac hardware and very difficult to run a macOS VM, on a non-Mac platform. Mac hardware tends to keep a price premium even when it's worthless. Resellers, for example, will charge you $500+ for an old MacBook Air that runs worse than a $100 Walmart chrome book.

People writing viruses would need access to the hardware and software to craft a virus, test it, etc.

That upfront hardware cost more or less stops them 95% of the time. Why spend $500 on specialized hardware to write a virus when you can just use an old windows machine you already have.

So like, we'll sponsored state actors will create Mac viruses. Entities that are involved in organized crime will have people create them to exploit specific targets. But as you mentioned they're much less common.

 

[DanAdams]

I believe that an evil consortium of acoustic guitar makers has executed a nefarious plot to BRING DOWN all the electric guitars of the world! only then will the FOLK revolution TRULY TAKE HOLD.
Hold onto your hats rockers. They are coming for the keyboards next! AND THEN WHAT!?!?
Some people say it's ok to eat the candy from Sweetwater. But what if the Martin executives are involved??? people are saying that that they could be...

 

[ardgedee]

In the case of #2, Mac owners for years have always said that they were virus-proof. TBT they're not. Most hackers just don't have an interest because they're not a large enough target. - At least that's what I have read and it does make sense...

Mac owners stopped saying that quite a few years ago. At least most knowledgeable ones. There have been quite a few exploits we've had to deal with in the past decade. If you find one who still says that, gently disabuse them of the notion.

Of course web browsers, and the stack of technologies used in them, make all personal computers and mobile devices into potential zero-day targets. The Spectre and Meltdown bugs were Intel CPU-based but could be exploited through well-crafted Javascript, which made 2017-18 a period equally memorable to the people responsible for our web browsers as it was to the people involved in the major operating systems. (Even if Macs aren't Intel-based any more, that just means they're based on systems that haven't been as extensively investigated yet.)

 

[tbz]

Even if Macs aren't Intel-based any more, that just means they're based on systems that haven't been as extensively investigated yet

Being a non-commodity cpu, that is only available on somewhat costly hardware, makes the process of investigating this a bit harder on malicious actors.

So the chance of issues like that occurring are substantially lessened.

But, as you noted, nothing is hack proof.

 

[Adamixoye]

No. If you're competent enough to do this, you have a day job that you do this at for a living. Anyone at the "eh I just like to play around" state of their career development wouldn't be able to create this. It's too complicated.

Just because you can't conceive of it doesn't mean it doesn't happen.

 

[Crackle]

It would be hilarious if a hacker sabotaged someone's show by hacking into a pedal.

 

[mike buzzetti]

LMFAO !!! HAHAHAHAHA

 

[tbz]

Just because you can't conceive of it doesn't mean it doesn't happen.

Just because you have an incorrect idea of how things work, doesn't mean it's reality. Generally people with an incorrect idea of how things work draw incorrect conclusions. Which is what you're doing.

Have you ever worked with a software dev that's capable of this? I have. At several companies over several decades. This isn't stuff they do for fun.

Do you understand that any exploit that could hack a phone over Bluetooth would be exceptionally valuable? You can just report it to apple or google for a bounty. Or write something that will actually generate revenue for you via data collection (bank logins, account info, etc.)

Random dudes on the street don't end up with those lying around. Career software developers don't find and hoard those.

Might make sense to educate yourself on this topic.

 

[Pauly 4001]

If you get a corrupted firmware file and load it to your pedal, yes you can kill your pedal.

You can certainly render a synth or computer totally non functional if a firmware update is not done correctly.
Not sure that applies to my Zoom pedal.

 

[Adamixoye]

Just because you have an incorrect idea of how things work, doesn't mean it's reality. Generally people with an incorrect idea of how things work draw incorrect conclusions. Which is what you're doing.

Have you ever worked with a software dev that's capable of this? I have. At several companies over several decades. This isn't stuff they do for fun.

Do you understand that any exploit that could hack a phone over Bluetooth would be exceptionally valuable? You can just report it to apple or google for a bounty. Or write something that will actually generate revenue for you via data collection (bank logins, account info, etc.)

Random dudes on the street don't end up with those lying around. Career software developers don't find and hoard those.

Might make sense to educate yourself on this topic.

I think we've lost the plot of what the actual argument is, and you've clearly taken it personally and chosen to be condescending.

I am not suggesting that this sort of thing is easy, and I'm not questioning or trying to challenge you on the technical side of things. However what I am questioning is whether your handle on human behaviors and motivations --- presumably not your area of expertise --- is as absolute as you are making it out to be. I do happen to be in a field where people try new things all the time. People who do things outside of their regular expertise or that they aren't directly funded to do. They do these things for fun, on a lark, and have the technical expertise to be successful in certain cases (though failing in others).

Again, it would seem I don't have the technical expertise to hang with you --- nor have I claimed as such --- but my assertion isn't really a technical one, it's a human one. But if you're not interested in treating me like an adult then I'm fine to discontinue my end of the conversation.

 

[drwv]

let's say a corrupted TonePrint or Line6 file

Ignoring the idea about malicious hacking, the fear of "bricking" your device with a corrupted firmware image or incomplete transfer is legit.

If the firmware image were corrupted - when uploaded to the manufacturer's website, when downloaded from the internet, when copied from device to device - all modern devices will perform a checksum or hash comparison of the firmware image before attempting to update their firmware. This is a sort of calculated fingerprint, and if so much as one single bit has been corrupted, the device should recognize this and reject the firmware image.

If your USB or Bluetooth connection to the device fails while transferring the firmware to the device - unless the developers were insane, given how fragile these connections are - the device, again, should detect the partial upload and reject it.

If however, the power to your device dies while it is performing that last step of overwriting the firmware byte-by-byte to the device's persistent memory... your device can definitely be turned into an expensive paperweight.

Hopefully the developers baked the original firmware into the hardware, and there is a small tip-of-a-ballpoint-pen sized hole with button, somewhere on the device. Pressing and holding this tiny button might completely reset the device, restoring its original firmware. Or, if the developers separated the firmware update mechanism from the firmware itself, then you may simply be able to try and re-upload your firmware image again... but this might not be an option given the complexity of USB and Bluetooth communication.

Disclaimer: It's because I work with devices like this professionally that I refuse to use any music gear with a USB or Bluetooth connection! So I'm not speaking with direct experience of TonePrint or Line 6 devices.

 

[Fynn]

I'm not an expert in computer/software stuff, but I was wondering if it is theoretically possible that a pedal could stop working if you download a malicious firmware (let's say a corrupted TonePrint or Line6 file, or any other).

Could something like this happen?

Ofcourse that's technically possible. The better question is why someone would upload malicious firmware in the first place. I think it's much more likely that your device just stops working, before you actually accidentally download malicious software. Such pedals are really not complicated devices and I don't really see a reason what someone might gain from bricking such a device...

 

[ClusterFlux]

Ignoring the idea about malicious hacking, the fear of "bricking" your device with a corrupted firmware image or incomplete transfer is legit....

It's because I work with devices like this professionally that I refuse to use any music gear with a USB or Bluetooth connection!

That's your choice, but that seems like a bit of an overreaction to me. Sure, you can't accidentally brick a Boss MetalZone with a firmware update, but pedals can break too. If you use more than a handful of settings for your gigs, the convenience of a multi-FX pedal is really hard to beat.

 

[dalahorse]

Yes - Depending on the application installed on your PC/Mac and the firmware on the pedal. As many have pointed out, the benefits and ability to gather meaningful information are low, and the attack vector is likely difficult. However, I doubt the manufacturers of digital pedals are worried about security. So they are unlikely to do any data verification, code signing, or anything else of the sort. If they are, that's awesome! But remember that Stuxnet attacked SCADA systems supporting Iran's nuclear programs on air-gapped networks. Line6, Zoom, and others are likely just as vulnerable and have far more potential attack vectors from people willing to click and download software or patches without thinking about the security implications. Then they connect their computer or phone to their pedals to install updates and configuration data.

Nobody wants to hack your pedals... Yet. But they're absolutely vulnerable.

Note: I work in government IT and spend a significant part of every workday dealing with cyber security. This is one of my everyday considerations.

 

[mike buzzetti]

Yes - Depending on the application installed on your PC/Mac and the firmware on the pedal. As many have pointed out, the benefits and ability to gather meaningful information are low, and the attack vector is likely difficult. However, I doubt the manufacturers of digital pedals are worried about security. So they are unlikely to do any data verification, code signing, or anything else of the sort. If they are, that's awesome! But remember that Stuxnet attacked SCADA systems supporting Iran's nuclear programs on air-gapped networks. Line6, Zoom, and others are likely just as vulnerable and have far more potential attack vectors from people willing to click and download software or patches without thinking about the security implications. Then they connect their computer or phone to their pedals to install updates and configuration data.

Nobody wants to hack your pedals... Yet. But they're absolutely vulnerable.

Note: I work in government IT and spend a significant part of every workday dealing with cyber security. This is one of my everyday considerations.

Dont listen to this guy he works on Aurora !! J/Kidding lmao

 

[BioWeapon]

Anything resembling a real "attack" on a pedal by downloading something like an effects preset would require reverse engineering the firmware that exists on the pedal. This may or may not be possible depending on which family of MCU is used in the pedal.