6 ms·
I mean, even something as simple as `md5("very-long-secret-only-phillips-knows" + uid)[:4]` would be effectively unguessable. Not hard if you have the code for
by nneonneo 3y ago
I mean, even something as simple as `md5("very-long-secret-only-phillips-knows" + uid)[:4]` would be effectively unguessable. Not hard if you have the code for the firmware, but nigh-impossible otherwise.
- netsec_burn 3y agoThe Sonicare app lets you download the latest firmware blob. So all you'd do is intercept it and find the function responsible for generating the password.
- kuroguro 3y agoThe app has the firmware embedded in it (resources/assets/firmware), not sure if it actually downloads a newer one or if it updates with the app. It does seem to be encrypted or compressed somehow tho.
- kuroguro 3y agoIt does seem to be for the more expensive diamondclean series tho I guess the brush checking would be similar. Didn't find any decryption in the APK, it just transfers it as is. Must be hidden inside the firmware as well. I don't think there's any way to get the firmware except dump it from the chip :/
- roundandround 3y agoIf one person has access once and publishes it, the work of setting up a proper md5 was a waste compared to an xor.