[thisismyaccoun7]

I was surprised to see him give up at having to bruteforce the password for root on ssh. That's how the community got into Mazdas, at least the 2015 I had anyway. The password was simple, jci, presumably because it was designed by Johnson Control Istruments.

You think a company is going to heavily lock down an embedded system they don't expect anyone to try to access, or are they going to make the password easy so that all the techs and engineers can remember it?

[bdelay]

Two reasons I didn't do that:

1. I believe Harman had a previous device hacked back around 2014 due to a weak shadow hash. My guess was that they learned their lesson and made the password more complex. An easy way to test would be to diff the latest shadow file in the updated Subaru images (assuming they exist) -- if it changed, you may be right, if not, I'd still wager it is strong enough.

I don't like the idea of a backdoor like that available, but it is what it is.

2. The QNX6 hashing mechanism, to the best of my knowledge, isn't fully understood. Upstream changes to JTR seem to indicate that it has some form of bug in it or isn't fully reverse-engineered. That, along with having to spend presumably a large amount of time learning about contributing to hashcat & gpu programming, made this seem like a potential dead end without massive time investment.

So, is it possible it is crackable? Almost certainly, but I'm one guy doing this and you have to spend your time carefully in these ventures.

[thisismyaccoun7]

Thanks for thr reply! That all makes sense. With the Mazda, I don't think anyone bothered to try to go as far as you did with the software because it was so easy to get wifi turned on, connect, and then let your device try short password after password (and at just three lowercase letters, the result came fast).

Given the reet of the work and your first point, it does seem like yours is the smart choice in this case. I was just surprised you didn't tey bruteforcing via ssh at first.

Thanks for the awesome article by the way! My Mazda got totalled last month, and I got a new 2019 Honda Fit I haven't gotten around to messing with yet. This gives some great ideas for how to proceed.

[tyingq]

Hashcat appears to have added support in the past month: https://github.com/hashcat/hashcat/commit/87c24200da61ab5ca2...

[bdelay]

Okay, that's really cool. Tempted to see if I can get some AWS credits or spend a bit of cash and throw an 8xGPU instance at this for a few days...

[Daneel_]

I have a 2080Ti at home I can throw at it for a few days, if you're willing to share the hashes with me? I'm the same username on reddit if you're interested in DM-ing me.

[stefan_]

They also had an authorized_keys file so it doesn't seem a stretch that the password login is some device-specific autogenerated value since the engineers would just use PubKey auth.