Reverse engineering and dismantling Kekz headphones
nv1t.github.io
nv1t.github.io
The author comes up with a much simpler attack in the end, but a 2^32 bruteforce would also have been perfectly doable, taking ~seconds with optimized code on modern hardware.
But agreed bruteforcing 2*32 key is possible. The "way to many" was: "Way to many " for my taste.
You could also put garbage data in nearly every frame and most modern codecs will fit it the best they can - for mp3 anyway.
Even if you have garbage in the file, it is not the correct file, as the codec will ignore it, and the output is garbage.
I haven't tried how many of these 43k actually work, or give you at least partialy good result.
A highly optimized (for this _exact_ context) hash/bloom function may yield comparable results, in general.
Or you can compute an efficient delineation algorithm using the docs:
https://www.loc.gov/preservation/digital/formats/fdd/fdd0001...
If the so many bytes of the rolling context don't match any numbers, keep brut'in the key til you have magic numbers and non-random garbage.
I'd expect the average difference in entropy of random data vs. a compressed format to be so small as to be a useless filter. After all if it wasn't so, it would be bad compression. Now I don't know about mp3 specifically...
However, since the format is also resilient and flexible, it should have a structure - even if that complexity is hidden in the codec - with a magnitude less entropy than the mis-decrypted possible plaintexts.
But yes, you compress, than encrypt. If your encrypted data is compressible or otherwise distinguishable from random noise, than you have (exploitable, correlatable) bias in your encryption functions, or you have inefficiency/redundancy in your compression.
I would think a very limited set of magic numbers/possible hex ranges would yield the highest performance per error.
After the connection, the files were gone and I was kinda puzzled, until I found the following code in the application [...] They seem to set the hidden Attribute on the first connect, so the files are not easily discovered.
I'm surprised that people still leave that setting at the horrible default. Unhiding hidden files and file extensions is one of the first things I do to any installation of Windows since Windows 95.
On the other hand, I'm not surprised at all that they attempt to track your location; my default ever since ~2010 has been to assume that any software will contain embedded spyware and phone home whenever given the opportunity.
If you're looking for headphones with built-in audio players, a search of the usual Chinese sites for "headphones TF card" will yield plenty of results --- for products that are unlikely to contain spyware nor require an invasive app, but have more useful features like BT. In fact, I suspect they're also using JieLi SoCs, and the company that was contracted to do the firmware on this one may also produce those.
right circumstancesI have been a fan of the Sony MDR-7502 headphones since Moses was in a basket. They provide an explosion of each of the parts and their numbers so that you can order replacements. Granted, these are "old skool" dumb wired headphones, so no software is needed, nor are chips necessary to look up and what not.
Speaking of wireless, their battery problems over time have already bit me, will continue buying "dumb" ones in the future.
This doesn't mean they shouldn't have done it. They should. But they get away with it more easily.
If you can go open at all, I'd recommend Sennheiser HD600. It doesn't get more solid than this.
HD560S are new, and use the same type of body HD598/99/579 do. They aren't anywhere as durable.
Ultimately they're bought for the sound; HD600 is the tried and true all-rounder neutral reference, and that's why it remains relevant.
HD560S is good relative to its peers at its price, but isn't tuned the same way, nor has it passed the test of time.
There are plenty of other consultants that do that too, but they don't have the same reach and brand recognition.
First, I just came back from Germany where I've seen that thing in a shop. Didn't have much time to investigate due to the kids, but guessed that it's just NFC chips with data on the headphores.
Second, I've been thinking about building a simple MP3-player for my kids for quite a while now, and (minus the obfuscation there) that's not far from what I've been thinking about doing.
Because floppies get bad sectors, the ID should be stored repeatedly on it, 4 bytes repeated to fill 1.38 MB should be redundant enough!
I suppose without ID's, one can also store the artist name and song title, and do some text search to find the MP3. Or a YouTube video.
Other thing I want (which they don't do) is the ability of resuming playback at the same position, even when putting it into a different player - that's one reason I still have some audio cassettes for the kids. No other medium I'm aware of does that kind of easy state saving. My idea there is to have the tags locked in the player in a way that gives me enough time to write the position if the user tries to remove it.
... the application tries not only uploading the ID3 Tags, but also geolocation data,
which is most likely gathered from Wi-Fi triangulation from windows itself.
Doesn't seem like that'd be an accidental thing?
So they're clearly aware it's happening.
I am a bit frustrated as isn't this just an MP3 player playing from SD card but put inside a headphone? Doesn't sound like an invention at all.
all of this little children audio devices are glorified mp3 players, with encryption inside.
The point is, that most of them don't allow to really "own" the content, like vinyl/tape/cd. they are encrypted, and you only get the encryption key, which is only playable on the device...you buy a license key and not the content.
Would be cooler if the hardware was more OS before but I take what I can get…
I did not expect to read about tracking in such a seemingly self-contained product. Paranoia level successfully raised. Never trust their silly "terms" and "policies" documents, they can change without your knowledge and the company will gaslight you about it. Never trust their proprietary software, reverse engineer it and implement a free software replacement.