Could a pedal be hacked via malicious firmware?

[ClusterFlux]

I would say the opposite about @Sean150 's knowledge and insight.

Here we go

All malware - regardless of its final target - needs an entry point.

And again: Few, if any, pedals connect directly to the Internet, let alone use wifi in the first place. Even if they did, those devices won't contain any of the personal data that hackers want, and won't be good candidates for botnets as they aren't on 24/7.

The new smart multi-effects units are computers....

True, but you also need to use a firmware loader to actually control that device. You can't take over a Boss GT-1000 just by loading a patch.

when they have WiFi or Bluetooth, they are on networks.

No, dude. That's not how it works.

For example, I have a camera that offers wifi connectivity. It doesn't connect to my network, it creates its own wifi network, and I have to use special software to connect to the camera. My phone or laptop's wifi can't be connected to the Internet when that connection is active. Bluetooth also isn't "on the network," it can only pair two devices to each other, and almost all attacks via Bluetooth require physical proximity to the device(s).

So, this is what would have to happen:
• Hacker has to somehow get access to Boss' proprietary code for a GT-1000 (a step which may require hacking Boss'/Roland's corporate network... and why not just stop there? or spending lots of time trying to reverse engineer the device), examine the code, insert the malicious code, and re-upload it to Boss' website provider

• Hope that no one notices that anything changed (even though skilled workers are paid to do just that)

• Wait for users to download and install the new firmware

• Hope that your malware doesn't brick a ton of expensive pedals, which would obviously tip off Boss/Roland

• Wait for users to turn on the devices and pair the device to a laptop or tablet, at which point the malware can... do stuff? Until the user unplugs it?

If you're going to go through all that effort, why not just compromise the GT-1000 System Software, which actually runs on a computer that has the data you want in the first place?

And how many users are you going to nail with this elaborate process before it gets noticed? How many people do you think buy $1200 multi-FX pedals anyway?

This isn't a serious method of attack. It's a Rube Goldberg device.

As someone who works with computers, I assure you: It is far, far, far easier to send out a bunch of phishing emails or use a zero-day exploit than do anything like what you're suggesting.

Why target an effects pedal? Because it's something that nobody is watching.

No one's watching it because... wait for it... it's a crappy attack vector that has no useful data on it.

Heck, even Bluetooth speakers would be a significantly better attack vector than pedals, as they are far more abundant than pedals. Are you terrified of those, too?

Another scenario... Let's say company X wants to compete with company Y's device. Company X could very easily purchase a unit and reverse engineer the software.....

Are you seriously suggesting that companies like Zoom, Boss or Line 6 are going to engage in highly illegal activities like that? And you think no one would figure out who was responsible? Please.

The fact that people think this is a useless thing to worry about is exactly why it could potentially become a high value target.

Right. So hackers are going to pass up tons of data-rich and poorly protected targets in favor of a complicated multi-phase attack to... take over devices that are almost never actually connected to anything at all, and owned by a tiny handful of people. Yep, that makes sense... if you live on Bizarro World.

Back in the real world, what the Bad Guys are actually doing is stealing millions just by sending out phishing emails. THAT is the real threat today, and THAT is the type of attack you should worry about.

 

[CC7]

I'm not an expert... Could something like this happen?

Didn't read the whole thread.. but.. don't give 'em any idea's!

 

[dalahorse]

you also need to use a firmware loader to actually control that device. You can't take over a Boss GT-1000 just by loading a patch.

Unless you've studied the system software and found a flaw. And I doubt Boss/Roland is terribly concerned about buffer overflows on the GT-1000.

No, dude. That's not how it works.

Actually, it is. I see this all the time. I've worked in IT and focussed on information assurance fro 30 years.

For example, I have a camera that offers wifi connectivity. It doesn't connect to my network, it creates its own wifi network, and I have to use special software to connect to the camera. My phone or laptop's wifi can't be connected to the Internet when that connection is active. Bluetooth also isn't "on the network," it can only pair two devices to each other, and almost all attacks via Bluetooth require physical proximity to the device(s).

And the device will already be paired with the computer that is used to configure it, and install patches and updates.

• Hacker has to somehow get access to Boss' proprietary code for a GT-1000 (a step which may require hacking Boss'/Roland's corporate network... and why not just stop there? or spending lots of time trying to reverse engineer the device), examine the code, insert the malicious code, and re-upload it to Boss' website provider

Or they could spend a grand, buy one, and reverse engineer it.

No one's watching it because... wait for it... it's a crappy attack vector that has no useful data on it.

Actually, I already said there is no valuable data on the device. It's an entry point rather than a final target.

Are you seriously suggesting that companies like Zoom, Boss or Line 6 are going to engage in highly illegal activities like that? And you think no one would figure out who was responsible? Please.

No judgement on any of those companies. But corporate espionage is real.

Yep, that makes sense... if you live on Bizarro World.

You're being very rude.

Back in the real world, what the Bad Guys are actually doing is stealing millions just by sending out phishing emails. THAT is the real threat today, and THAT is the type of attack you should worry about.

That is one single type of attack I do worry about. But not the only. I understand cyber, IA, attack vectors, and target value. I've red teamed and managed IA postures since before most people have know what the internet is. This has been a major focus of my career in IT/IA. Part of my job is to identify and firm up vulnerabilities before the other guys figure them out.

 

[Wretched Banana]

You can't take over a Boss GT-1000 just by loading a patch

You absolutely can find a vulnerability that lets you do that. It's one input validation flaw away.

It is scary that folks say this is impossible and/or there is no reason. Curiosity is a reason, not all attacks stem from cybercrime-as-a-business purposes. I for one poked at everything digital I owned and reported concrete findings to vendors which got fixed. I am a security professional and an engineer, but this is by no means advanced stuff and any kid with CS101 knowledge can do it.

 

[dalahorse]

You absolutely can find a vulnerability that lets you do that. It's one input validation flaw away.

It is scary that folks say this is impossible and/or there is no reason. Curiosity is a reason, not all attacks stem from cybercrime-as-a-business purposes. I for one poked at everything digital I owned and reported concrete findings to vendors which got fixed. I am a security professional and an engineer, but this is by no means advanced stuff and any kid with CS101 knowledge can do it.

Exactly. One overlooked input validation can lead to multiple buffer overflow and code injection attacks. This is how it works in the real world.

 

[juggahnaught]

Again - this stuff is theoretically and technically possible. But in a practical sense - not really.

 

[Wretched Banana]

But in a practical sense - not really.

Here's some perspective on the practicality. I have found 3 issues that impact 3 distinct devices from 2 makers. All are fixed today.

2/3 of those three are device brickers through sharable patches. So not a huge deal besides being an annoyance.

The other one is arbitrary code execution on the device through a patch leading to memory corruption. This too wasn't a huge deal TODAY, but only because the device does not have radio connectivity to anything. That's fast changing, find a similar flaw in a bluetooth/wifi enabled pedal and it gets interesting very quickly.

Edit: The big danger here is (as somebody stated above somewhere) these companies don't necessarily have people that speak security, because traditionally & historically they didn't need to. We know how that went for IoT, I expect the same will happen here as all pedals eventually become the Quad Cortex.

 

[GIBrat51]

I'm not an expert in computer/software stuff, but I was wondering if it is theoretically possible that a pedal could stop working if you download a malicious firmware (let's say a corrupted TonePrint or Line6 file, or any other).

Could something like this happen?

Well, after wading through this entire thread? The answer seems to be a qualified "yeah, maybe; but I don't see why"...
Personally, though? No, it ain't never gonna happen - to me. In the 50+ years I've been playing bass, I've never used a pedal. I do understand and appreciate that lots of people do use them; do like them; and do need them. You'll never get any grief about using pedals from me. But, for what I play? Don't need them - and doubt that I ever will... I do have one, though; an MXR M83 Chorus Deluxe (with "built-in Flanger", too! Whatever the Hell that is).... A guitar player friend bugged the bejeezus out of me for years, about my needing at least a chorus pedal. So, I bought this one - to shut him up. Worked like a charm, too; he thinks I use it, and has never bothered me since. I actually did use it - once; for about 3 minutes. Frankly, I thought it sounded like ass, and made a mess of the song I was playing. So... it's currently safely put away in it's box; that's in another box; which is in a bigger box of miscellaneous bass junk; that's under a couple of gig bags, down in a corner of my basement. If anybody can hack into anything from there? They're welcome to anything they can get, brother...

 

[XLunacy]

Aaaaand it happened. Kind of.

Not directly through the firmware, but still.
Quad Cortex's firmware update procedure had a vulnerability that allowed hackers to access user data through a service email account, which would include names, email addresses and WiFi network names and passwords, from what I'm understanding.

So yeah, even though the nature of the data is not sensitive per se, it shows that hackers are definitely able to get to you through the pedals you use as an access point (phishing campaign, unauthorized access to WiFi networks, ..)

Just read about this and remembered this thread from a few months ago.

Statement regarding a Quad Cortex security vulnerability

Edit: The big danger here is (as somebody stated above somewhere) these companies don't necessarily have people that speak security, because traditionally & historically they didn't need to. We know how that went for IoT, I expect the same will happen here as all pedals eventually become the Quad Cortex.

Peculiarly accurate.

Stay safe.