6 ms·
Reverse engineering and dismantling Kekz headphones
- deleted 2y ago[deleted]
- taldo 2y agoOuch, open Cosmos DB with geolocation logs publicly accessible...
- deleted 2y ago[deleted]
- bux93 2y agoIt's only the locations of children.. Wait.. That doesn't sound good?
- altairprime 2y agoHopefully someone who is in the EU buys one of these and files a formal complaint! I can't from across the ocean, sadly.
- justinclift 2y agoUgh: ... the application tries not only uploading the ID3 Tags, but also geolocation data, which is most likely gathered from Wi-Fi triangulation from windows itself. That's likely breaking some EU GDPR rules, at the very least. Doesn't seem like that'd be an accidental thing?
- polartx 2y agoI would assume so since much of the code seems to have been stolen in the first place
- consp 2y agoOr made by a contractor or is cots in another region?
- justinclift 2y agoWell, they did set up the database to receive all the information. So they're clearly aware it's happening.
- 10xalphadev 2y agos/stolen/illegitimately used/g
- zkirill 2y agoAwesome article. Just wondering, how can a hardware company voluntarily submit their device for reverse engineering and dismantling as a show of good faith? Given the right circumstances this is basically a free security audit and marketing for the company.
- wpietri 2y agoIf a company wants somebody to do a hardware audit for marketing purposes, they should pay money for that. Please fairly value people's labor, especially when you seek to profit from it.
- cheschire 2y agoWell, influencers are able to work out alternative means of compensation because the content is more valuable than the work performed. For example a blogger that is renowned for teardowns might do the work in exchange for access to early release models so that their content is highly relevant. That is worth more than the hourly cost to perform the teardown work. Compensation negotiation is part of the art of that deal.
- wpietri 2y agoIf an influencer is indeed able to monetize the content sufficient to match market price for the labor, then sure, that is also fairly valuing people's labor. But that's definitely not what's happening here.
- Jerrrrrrry 2y agoright circumstances
- bigallen 2y agoIf someone wants to do the hardware audit for free, or in exchange for some kind of promotional exchange, is that a bad thing? I’d breakdown a lot of devices if I could get a duplicate one intact, for free
- augunrik 2y agoI love when people do this! Now we only need alternative software and the hardware is finally purchasable! Would be cooler if the hardware was more OS before but I take what I can get…
- deleted 2y ago[deleted]
- finaard 2y agoThis is pretty interesting to me for two reasons. First, I just came back from Germany where I've seen that thing in a shop. Didn't have much time to investigate due to the kids, but guessed that it's just NFC chips with data on the headphores. Second, I've been thinking about building a simple MP3-player for my kids for quite a while now, and (minus the obfuscation there) that's not far from what I've been thinking about doing.
- taldo 2y agoThere's also yotoplay.com, although that one does seem to require wi-fi and cloud thingies.
- dud3333 2y agoGoogle tonuino. There are readymade pcbs you can buy for it
- nuitgaspard 2y agoThere have been multiple devices. I have been looking into the jooki box as well, which is quite hackable, tonibox is nice hardware (with already good firmware replacement), yoto is weird.
- netsharc 2y agoI was thinking of a steampunk music player using floppy disks: store a 32-bit (4 billion songs should be enough right?) ID onto a floppy, and have a player (it can be a Raspberry Pi with a USB floppy drive) read the ID, lookup the MP3 the ID corresponds to and play the MP3 from an attached storage device. Because floppies get bad sectors, the ID should be stored repeatedly on it, 4 bytes repeated to fill 1.38 MB should be redundant enough! I suppose without ID's, one can also store the artist name and song title, and do some text search to find the MP3. Or a YouTube video.
- finaard 2y agoI was thinking child friendly, so using NFC tags isn't such a bad idea - plus I have a few hundred spare ones in nice plastic casings. I'd also just store IDs on them, and either have the media files preloaded (as seems to be the case here), or have it download it from my media server on first use. Other thing I want (which they don't do) is the ability of resuming playback at the same position, even when putting it into a different player - that's one reason I still have some audio cassettes for the kids. No other medium I'm aware of does that kind of easy state saving. My idea there is to have the tags locked in the player in a way that gives me enough time to write the position if the user tries to remove it.
- Retr0id 2y ago> We could brute force the 4 Bytes. Without any further assumption, this would be 255**4 possibilities, which is way to many. The author comes up with a much simpler attack in the end, but a 2^32 bruteforce would also have been perfectly doable, taking ~seconds with optimized code on modern hardware.
- consp 2y agoWhile I agree, isn't figuring out what kind of obfuscation they used is part of the fun?
- nuitgaspard 2y agoAgreed :) the problem is though, that you have to decrypt the whole file everytime and not just a few bytes, which makes this still a little bit longer. You get files, which identify as mp3, but are garbage, and have to check multiple frames. But agreed bruteforcing 2*32 key is possible. The "way to many" was: "Way to many " for my taste.
- Jerrrrrrry 2y ago"ID3" should be the first few bytes. You could also put garbage data in nearly every frame and most modern codecs will fit it the best they can - for mp3 anyway.
- nuitgaspard 2y agoJap...Checking for ID3 is not good enough in checking for correctly decrypted MP3. Brute Forcing with only small letters, you get approx 43k possibilities with "ID3" as the first 3 letters, that makes ~10% of all 26*4 possibilities. Jap, you only have to decrypt those 43k possibilities, but you have to look at the whole file. Even if you have garbage in the file, it is not the correct file, as the codec will ignore it, and the output is garbage. I haven't tried how many of these 43k actually work, or give you at least partialy good result.
- Jerrrrrrry 2y ago
- throwaway48476 2y agoExcellent work and interesting read.
- userbinator 2y agoIt looks like this is a German product but the name in English is a meme. Making these play Shadilay would be top kek! After the connection, the files were gone and I was kinda puzzled, until I found the following code in the application [...] They seem to set the hidden Attribute on the first connect, so the files are not easily discovered. I'm surprised that people still leave that setting at the horrible default. Unhiding hidden files and file extensions is one of the first things I do to any installation of Windows since Windows 95. On the other hand, I'm not surprised at all that they attempt to track your location; my default ever since ~2010 has been to assume that any software will contain embedded spyware and phone home whenever given the opportunity. If you're looking for headphones with built-in audio players, a search of the usual Chinese sites for "headphones TF card" will yield plenty of results --- for products that are unlikely to contain spyware nor require an invasive app, but have more useful features like BT. In fact, I suspect they're also using JieLi SoCs, and the company that was contracted to do the firmware on this one may also produce those.
- matheusmoreira 2y agoWhat a wonderful article. I love step by step reverse engineering break downs. I did not expect to read about tracking in such a seemingly self-contained product. Paranoia level successfully raised. Never trust their silly "terms" and "policies" documents, they can change without your knowledge and the company will gaslight you about it. Never trust their proprietary software, reverse engineer it and implement a free software replacement.
- msephton 2y agoGreat work, thanks for taking the time to write it up
- yftsui 2y agoThe beginning of the article says the device "work without any internet connection and all of the content already on the headphones itself", then the device needs a Windows application downloads content from the Internet. I am a bit frustrated as isn't this just an MP3 player playing from SD card but put inside a headphone? Doesn't sound like an invention at all.
- moonsword 2y agobasically yes. it is a prefilled mp3 player with content, which get's activated with nfc chips. You can add custom content for 3 nfc chips with this windows application (or update the pre fillment). all of this little children audio devices are glorified mp3 players, with encryption inside. The point is, that most of them don't allow to really "own" the content, like vinyl/tape/cd. they are encrypted, and you only get the encryption key, which is only playable on the device...you buy a license key and not the content.