MotoTRBO Password Interception

ki4gyw · Post by **ki4gyw** » Mon Mar 02, 2009 10:48 pm

Read the Radio or Repeater from the CPS and Sniff the Network Interface the password is in the clear!
Just got to look for it, Wireshark Works good thanks to Comtran Associates Inc for trying to charge me
a arm and a leg to remove your password you just drove me to succeed on my own!

Post by **melv7956** » Fri Mar 06, 2009 8:58 am

Could you elaborate a bit more please?

ki4gyw · Post by **ki4gyw** » Fri Mar 06, 2009 8:32 pm

the programing is done over a network connection (RNDIS) so all the codeplug info is encrypted but is transferred over the network interface however motorola didn't encrypt the password in one place so it is sent in cleartext over the network interface when doing a read from the radio to cps before the cps asks you for the password. download and install wireshark from www.wireshark.org then start a new capture on the "Motorola" Network interface it will show up in the list! then open your cps and do a read from the radio, view and search through the packets that were transferred the password will show up just use wireshark and view the packet dump! I don't think there's a certain phrase to look for, but after alittle searching it will show up! I found mine just by searching some of the numbers contained in the packet!

gopher · Post by **gopher** » Fri Jan 15, 2010 11:02 pm

So if the password is unkown how would one locate it inside the captire file?

SlimBob · Post by **SlimBob** » Sun Jan 17, 2010 8:03 pm

Hex/ASCII view.

jfyrfytr25 · Post by **jfyrfytr25** » Tue Jan 26, 2010 9:58 am

please excuse my ignorance. But I have done what is in this thread. I have downloaded wireshark and read the CP. I have captured the data. BUT I dont see the password.

I am using a radio that I know the password to as to find where it is easily. but i see nothing. PLEASE HELP!!

I need to know what to do or where to look after capturing the packet.

Forts · Post by **Forts** » Sat Feb 13, 2010 8:51 am

I tried this on my radio and it indeed worked. The password was in the ascii portion of one of the wireshark packets (I started capture just as I was ready to read the radio, then stopped it as soon as the CPS asked for the password, to minimize the amount of into to look thru). It was in one of the last few packets captured. As an example, if my password was 'BatLabs' it showed in the capture as .B.a.t.L.a.b.s.

Post by **alex** » Sat Feb 13, 2010 10:53 am

Forts wrote: if my password was 'BatLabs' it showed in the capture as .B.a.t.L.a.b.s.

Interesting - that means that it probably allows UNICODE based passwords

.

Probably a feature for overseas radios.

-Alex

Post by **Kc2bst** » Tue Mar 23, 2010 5:29 pm

i aint to smart is there a step by step?

ok so i figured it out i had a driver issue

the shark must be run as administrator

Post by **Kc2bst** » Wed Mar 24, 2010 3:48 pm

ok so i have been sucsessful and here is what i learned and i hope it helps others

to find the password it will be just above the radio name (whatever it was named in the cps) so lets say your company is BOB the company may call the radio BOB the password will be just a line or two above that.
If your radio is a display model power it on and watch the display the radio name is in the display when it powers up briefly.

This is only new stuff that was not in this post i did not explain what was already explained.

Thanks to all that helped me and i hope what i added will help others

Post by **wb6wui** » Fri Dec 24, 2010 4:04 pm

Kc2bst wrote:...to find the password it will be just above the radio name (whatever it was named in the cps) so lets say your company is BOB the company may call the radio BOB the password will be just a line or two above that.
If your radio is a display model power it on and watch the display the radio name is in the display when it powers up briefly.

I use a Hex editor and simply look at the RAM occupied by CPS. This method does not require WireShark or looking at the packet stream. Both methods work but no need for WireShark. The codeplug is loaded when the radio is read, so it is simple to see the .x.x.x.x.x... password toward the end of the RAM segment.

It's best to try this with a known password first so you know what to look for in the protected codeplug.

-- Mike, WB6WUI

Post by **nycap** » Mon Mar 14, 2011 9:24 pm

hey guys; I really need help with this issue. i have an XPR6550 MODEL: AAH55JDH9LAN1AN
The codeplug is passworded so i cant get into it to program it the way i want. I dont give a damn about hte previous programing i just want to be able to set this thing the way i want.

I tryed to get it by created a codeplug in the cps with a password and using the winhesx to locate the password when prompted for the password i can find the password easily. when prompted for the password when trying to read the radio i cant find the password.

Now im trying the wireshark method. I dont know weather i still need the hex editor or what. i followed the directions here and no luck. granted i just started trying it but i need help bad.

Any help would be greatly appreciated! thanks in advance.

id rather judt get an oped codeplug for this model and blow in with the cps. codeplug supersite wont process my request for registration. its been like 3 days since i tried to sign up.

RADIO: XPR 6550
MODEL: AAH55JDH9LAN1AN
CPS VER: 6.0 build 244
CODEPLUG NEEDED!!!!!!!!!!!!!!!!!!!!!!!!

Forts · Post by **Forts** » Thu Mar 17, 2011 7:22 pm

Try following my method that I posted above.. it's worked every time for me. Make sure you have wireshark and the pcap drivers installed and up to date. Connect your radio, start the CPS then switch to wireshark and start capturing on the Motorola network adaptor. Flip back to the CPS and hit Read to start the process. Once the dialog box pops up asking for the password go back to wireshark and stop capturing. Look thru the last few packets captured and you should see some ASCII text with the model # of the radio, the name that was given to the radio in it's current codeplug (which will be displayed usually when the radio is powered up) and the password should be right before that. I can post examples from my radio if that will help.

If you don't have any luck, I'm just waiting on a programming cable to arrive for the portables (I only have a mobile cable). Once I get it I can dump a VHF portable and send you a codeplug.

Post by **wavetar** » Fri Mar 18, 2011 7:43 am

FYI, the TRBO CPS will not overwrite a blank codeplug into a password protected radio...it still asks for the password before allowing the write cycle.

Max · Post by **Max** » Fri Nov 18, 2011 12:31 pm

Just wondering if there is still a way to find the password for the XPR 4550.

Max

Forts · Post by **Forts** » Wed Nov 23, 2011 8:00 am

Yes you can. Wireshark does the trick for me.

mancow · Post by **mancow** » Wed Nov 23, 2011 9:01 am

On a somewhat related note it's interesting to use an RS232 sniffer to watch as an Astro radio's codeplug is written. It's unencrypted.

EindhovenOne · Post by **EindhovenOne** » Wed Feb 08, 2012 2:12 pm

I know this has been inactive for a while, but I just used Wireshark with the latest CPS and I recovered the password with ease. Thanks to all for the suggestions and tips along the way!

RFguy · Post by **RFguy** » Mon Jun 02, 2014 5:23 pm

FYI: Motorola just patched this loophole with the latest radio firmware. Password is now encrypted on radios with the newest firmware and can no longer be "sniffed" with wireshark.

com501 · Post by **com501** » Tue Jun 03, 2014 8:30 am

Have you actually tried yet? I haven't seen the firmware in my MOL account yet.

gopher · Post by **gopher** » Fri Jun 13, 2014 7:22 pm

confirmed - its hashed with SHA256 ..

com501 · Post by **com501** » Fri Jun 13, 2014 8:51 pm

Where there is a will, there is a way. As long as Motorola allows the blockage of completely erasing the codeplug, and continues to CHARGE A FEE for unlocking a customer radio, someone will be working on a bypass.

Post by **escomm** » Fri Jun 13, 2014 9:34 pm

com501 wrote:Where there is a will, there is a way. As long as Motorola allows the blockage of completely erasing the codeplug, and continues to CHARGE A FEE for unlocking a customer radio, someone will be working on a bypass.

Don't buy stolen radios

Problem solved

tvsjr · Post by **tvsjr** » Sat Jun 14, 2014 3:58 pm

escomm wrote:
com501 wrote:Where there is a will, there is a way. As long as Motorola allows the blockage of completely erasing the codeplug, and continues to CHARGE A FEE for unlocking a customer radio, someone will be working on a bypass.
Don't buy stolen radios

Problem solved

What about surplus radios? Or radios programmed by some provider who (unethically) password protect them and don't provide that password to the radio's owners? Or a thousand other cases that are completely legitimate and don't involve stolen radios?

FMROB · Post by **FMROB** » Sat Jun 14, 2014 7:24 pm

tvsjr wrote:
escomm wrote:
com501 wrote:Where there is a will, there is a way. As long as Motorola allows the blockage of completely erasing the codeplug, and continues to CHARGE A FEE for unlocking a customer radio, someone will be working on a bypass.
Don't buy stolen radios

Problem solved
What about surplus radios? Or radios programmed by some provider who (unethically) password protect them and don't provide that password to the radio's owners? Or a thousand other cases that are completely legitimate and don't involve stolen radios?

Agreed, stolen radios are always an issue. However, given the influx of trbo radios to the market and the rise of "overnight" radio shops, password protection is now more than ever prevalent. Most times it is simply a owner changing shops because of poor service, and the new shop finding the surprise left by the old shop.

Post by **escomm** » Sat Jun 14, 2014 8:51 pm

tvsjr wrote:
escomm wrote:
com501 wrote:Where there is a will, there is a way. As long as Motorola allows the blockage of completely erasing the codeplug, and continues to CHARGE A FEE for unlocking a customer radio, someone will be working on a bypass.
Don't buy stolen radios

Problem solved
What about surplus radios? Or radios programmed by some provider who (unethically) password protect them and don't provide that password to the radio's owners? Or a thousand other cases that are completely legitimate and don't involve stolen radios?

What about them? How is this any different than an ASK? A legitimately purchased radio can be unlocked.

I can't speak to "unethical" radio shops as there are thousands of ethical reasons to password protect a codeplug and the needs of a user purchasing a radio secondhand pale in comparison to firsthand owners wishing to protect their system configuration. It's far too easy to pirate or cause harmful interference on a TRBO system as it is.

com501 · Post by **com501** » Sat Jun 14, 2014 11:55 pm

escomm wrote: What about them? How is this any different than an ASK? A legitimately purchased radio can be unlocked.

Did you even bother to read the release notes?

You CAN'T get a radio unlocked unless MOTOROLA gets permission from the original vendor. THEY WILL BE CHARGING FOR EVERY INSTANCE.

This fails horribly on several notes. What happens when the original VENDOR who sold the radio to MY CUSTOMER, who had his radio password protected by the radio programming dude AT THE MINE, has gone out of business? What happens when MY CUSTOMER, who BOUGHT THE RADIO FROM ME, comes in with a password protected radio, because some douche bag at a mine decided he needed to 'protect' his system by password protecting every contractor radio who goes there, even if the mine doesn't own them, and WILL NOT tell us the password. My CUSTOMER doesn't care about the mine he was just at, he is moving on to the next job. HE JUST WANTS HIS RADIO TO WORK, WITHOUT HAVING TO PAY $50-$100 BECAUSE SOMEONE HE WAS WORKING FOR, EFFED IT UP.

I remove passwords on a routine basis out here. We NEVER password protect a radio, its the kiss of death if the customer decided to go somewhere else. If his radio is password protected, he will NEVER come back.

Without the ability to wipe the radio, this is a no win situation for everyone. And it IS NOT the same as an ASK. What commercial user uses radio systems with ASKs?? Maybe it is worthwhile for public safety to have that kind of protection. Even so, ASK protection is easily removed.

Here's a beer for the experimenter who is the first to break the password encryption and restore a radio to its useful state.

MTS2000des · Post by **MTS2000des** » Sun Jun 15, 2014 2:42 am

Password protection and holding the radio "hostage" is the same slimy crap that cellular providers do by locking a phone from accepting another carriers' SIM. Even if you pay FULL PRICE for a piece of hardware, you have to jump through hoops to get it unlocked. As COM501 pointed out, Motorola's so-called "service" is ONLY applicable to the ORIGINAL PURCHASER, this is the same B.S. the cellular cartels play. Not OUR customer? We don't care if that phone isn't stolen and you have a receipt from the buyer, we aren't going to unlock your $600 Galaxy S5. This is the same nonsense here.

The stolen radio excuse doesn't justify the extortion that Motorola is playing. Other manufacturers like Kenwood provide the tools to dealers and service centers to completely WIPE a radio and remove any user password without playing these silly nickel and dime games to both their dealers and customers. Kenwood is also good about changing up KPG so when these dealer level passwords do get out, they only work for so long.

I think the main reason is to de-value used radios, which we all know Motorola has been doing for decades. It's simple, your radio is locked? Aww..too bad for you. Buy a new one. They are merely taking a page from the cellular industry on this one.

COM501 bravo!

Post by **escomm** » Sun Jun 15, 2014 11:20 am

com501 wrote:
escomm wrote: What about them? How is this any different than an ASK? A legitimately purchased radio can be unlocked.

Did you even bother to read the release notes?

Yes. Did you? A legitimately purchased radio can be unlocked. I'm not even going to dignify the rest of your commentary about how you (or anyone else) that is not authorized to have access to the radio's databus when no such authorization is present. Being able to compromise a password protected radio entirely the defeats the concept of having a password protecting the radio and you know that.

Post by **escomm** » Sun Jun 15, 2014 11:35 am

MTS2000des wrote:I think the main reason is to de-value used radios, which we all know Motorola has been doing for decades. It's simple, your radio is locked? Aww..too bad for you. Buy a new one. They are merely taking a page from the cellular industry on this one.

Yes, Motorola really cares about your secondhand radio that you purchased for a fraction of its original price, so much that they invested engineering resources for the rare instance in which a password was programmed into it. For a self proclaimed expert in Motorola you really don't know how they operate. Motorola doesn't spend money on anything if they don't have to, especially if it's not something they can't make money hand over fist for.

Perhaps a very large customer, like one that has theme parks that charge tens of thousands of people per day a hundred dollars or more for admission, complained to Motorola. Maybe it was a hotel with a few hundred rooms they get a thousand a dollars a night for. Or maybe someone at Motorola realized that hobbyists were mouthing off at every opportunity about how "easy" it was to compromise a codeplug password and realized they had a little problem on their hands and fixed it on their own volition.

Hopefully you can appreciate how Mother M is going to care more about these organization's perceptions, that have invested hundreds of thousands of dollars into their equipment, than that of a hobbyist that resells a couple of radios per month and rarely purchases new product, if ever. Shame on Motorola for not catering to to very important customers such as yourself. They will obviously be bankrupt before we know it

com501 · Post by **com501** » Sun Jun 15, 2014 12:57 pm

escomm wrote:
com501 wrote:
escomm wrote: What about them? How is this any different than an ASK? A legitimately purchased radio can be unlocked.

Did you even bother to read the release notes?
Yes. Did you? A legitimately purchased radio can be unlocked. I'm not even going to dignify the rest of your commentary about how you (or anyone else) that is not authorized to have access to the radio's databus when no such authorization is present. Being able to compromise a password protected radio entirely the defeats the concept of having a password protecting the radio and you know that.

You don't get it. Even a radio I HAVE SOLD TO A CUSTOMER is going to require that Motorola charge a FEE for being unlocked. I don't give a wit for the programming that is in the radio, I just want to be able to satisfy my customer's requirement that I program his radio for the next job. This happens where we are on a consistent MONTHLY basis. It will get REAL OLD in a HURRY, when the customer has to pay me for programming AND an overly outrageous fee to Motorola for that privilege.

There is no provision for any of this to happen in a timely manner, either, if it is after hours. THE NOTES CLEARLY STATE THE 'MAGIC BULLET' will expire at midnight of the day issued. WTF does that mean?

Frequently Motorola issues emails late in the day. So here we are, its after 5pm, and we don't get the email until the next day, whereby it is already EXPIRED. What about weekends? What about holidays?

Should I just sell the customer a new 4550 because his dumb f--- client locked his radio? What about the customer who comes to us from a competitor because they are tired of the locking of their radios that THEY PURCHASED from the competitor. ALL THE CUSTOMER WANTS IS THE RADIO TO WORK. THEY DON'T CARE ABOUT ANYTHING ELSE.

Should I just stock a bunch of radios for exchange, and send the unprogrammable radio to JSC under warranty? Someone didn't think this through enough.
I rent nearly 2000 radios at once for a large event. All Trbo.
In the last three years, there were perhaps two dozen radios per year that required programming, and not even the rental company knew they were password protected, NOR DID THEY KNOW THE PASSWORD and THEY OWN THEM. At the event site, I don't have access to cellular coverage, internet, or land lines. That's not going to play well, especially if any of this folderol with MOL has to be done online, with the software talking to the server at Motorola.

Vertex is going to get a lot more business from frustrated dealers, I can guarantee it.

The person who writes the hack (like every other hack that has come out for Trbo in the last few years, including the AES256 provisioning) will be joyfully greeted.

KitN1MCC · Post by **KitN1MCC** » Sun Jun 15, 2014 4:30 pm

dont you get to choose the password in the CPS.

com501 · Post by **com501** » Sun Jun 15, 2014 5:57 pm

KitN1MCC wrote:dont you get to choose the password in the CPS.

Yes, you do, IF you are the person programming the radio. Even if I forget the password to my own damn radio, I am going to have to pay Motorola whatever they ask for to get it unlocked.

You can read an unlocked radio ALL DAY, and never deduce the encryption or RAS keys. Those two protections schemes are native and built in. This is mostly why nobody really bothers to password protect a radio unless they are extremely paranoid.

MTS2000des · Post by **MTS2000des** » Sun Jun 15, 2014 7:34 pm

escomm wrote:
MTS2000des wrote:I think the main reason is to de-value used radios, which we all know Motorola has been doing for decades. It's simple, your radio is locked? Aww..too bad for you. Buy a new one. They are merely taking a page from the cellular industry on this one.
Yes, Motorola really cares about your secondhand radio that you purchased for a fraction of its original price, so much that they invested engineering resources for the rare instance in which a password was programmed into it. For a self proclaimed expert in Motorola you really don't know how they operate. Motorola doesn't spend money on anything if they don't have to, especially if it's not something they can't make money hand over fist for.

Perhaps a very large customer, like one that has theme parks that charge tens of thousands of people per day a hundred dollars or more for admission, complained to Motorola. Maybe it was a hotel with a few hundred rooms they get a thousand a dollars a night for. Or maybe someone at Motorola realized that hobbyists were mouthing off at every opportunity about how "easy" it was to compromise a codeplug password and realized they had a little problem on their hands and fixed it on their own volition.

Hopefully you can appreciate how Mother M is going to care more about these organization's perceptions, that have invested hundreds of thousands of dollars into their equipment, than that of a hobbyist that resells a couple of radios per month and rarely purchases new product, if ever. Shame on Motorola for not catering to to very important customers such as yourself. They will obviously be bankrupt before we know it

The problem with that logic is that a large organization, who hire and fire people all the time (especially in today's economy) will have folks who will assign a password to hardware, sometimes with good (or ill) intent. They leave, are canned, retire, etc. and now they are stuck with paying a fee and going through a huge hassle to unlock THEIR radios? This isn't a hobbyist perspective. It's a vendor who is making selling their product difficult for the vendors, and customers.

But continue to hurl insults at users here if it makes you feel better. That always goes a LONG way to demonstrate what a big guy you are and how you are this bigtime Motorola dealer who pulls in 8 figures a quarter in sales revenue. I've dealt with a local MSS for 20 years for both personal and professional needs (I'll give you a hint: they have offices in 3 states and got their start putting radios in race cars) who actually do that much business and they don't act like you come off on this and other boards. They take care of their customer whether he/she is a volly with some po-dunk VFD wanting a battery cover for a Minitor V, or a county manager of "IMAWASTINYOURMONEYCOUNTY" with a golden ticket for a new 14 site simulcast Astro 25 7.14 network with 3200 subscriber units. They don't come across condescending and full of themselves nor spend time taking cheap shots at their customers (Kenwood NexEDGE radios Jeff?) on public forums. Maybe that's because they don't have time and are actually out closing those sales. IJS.

BTW you notice how well that KPG-111DN works in dealer mode? you should, some "hobbyist" and "expert" stepped up to help you out with that.

We all get that Motorola is a business, a business dedicated to making as much profit as possible, even if it meets alienating both vendors and customers large and small. I can't think of a better example of the scenario than the one COM501 gave about event radio rentals. Having managed both communications and logistics for one of the largest road races in Atlanta for 14 years, I had my share of dealing with radio rentals, programming, etc. I could easily see that scenario playing out and becoming a huge hassle, especially when some at these event staffs wait until the last minute and you are sitting there with dozens of portables you cannot make a quick change to because some putz put a password on them and even the vendor support can't resolve on a phone call. Let alone having to deal with MOL and it's great reputation for being offline for maintenance or the entitlement server not responding. Nights and weekends? Oh well, better keep a stock of those cheap FRS bubble packs from Wal-Mart just in case.

Post by **escomm** » Sun Jun 15, 2014 8:22 pm

com501 wrote:The person who writes the hack (like every other hack that has come out for Trbo in the last few years, including the AES256 provisioning) will be joyfully greeted.

Yes, keep running your mouth. It is people like you that led to this password encryption happening in the first place. Keep that in mind.

Post by **escomm** » Sun Jun 15, 2014 8:27 pm

Erik, I have hurled no insults and I am sorry you feel the need to make the disparaging comments that you have. It is obvious you have a chip on your shoulder about more than one thing, and your passive aggressive behavior is appalling and disingenuous. I would have expected a more mature response from you, but it seems times have changed. To each their own.

com501 · Post by **com501** » Sun Jun 15, 2014 10:59 pm

I am done with this thread. It is obvious that some here have their minds set, and do not want or entertain any discussion whatsoever, and are more content with insulting everyone that disagrees with them.

Let's just lump everyone into one classification, US, and 'people like me'.

I hope you have a good explanation for any of your customers that run afoul of this most recent lunacy. And no, you can't blame me, I didn't publicize it.

-/rest of comments truncated out of politeness to the other readers.

KitN1MCC · Post by **KitN1MCC** » Mon Jun 16, 2014 4:22 pm

on thing this will effect is maybe the real new radios. if its the old ones with the old firm ware should be good for a while. thats why i have an older version on my XP machine.

d119 · Post by **d119** » Mon Jun 16, 2014 4:35 pm

Escomm / Com501 - enough guys. You're both right, and you're both wrong. Take it to PM if you need to keep it up - we're all professionals here.

com501 · Post by **com501** » Mon Jun 16, 2014 4:44 pm

KitN1MCC wrote:on thing this will effect is maybe the real new radios. if its the old ones with the old firm ware should be good for a while. thats why i have an older version on my XP machine.

Only radios coming after after the next few days will have the new firmware loaded. Any older radios, unless someone loads the newest firmware in the radio will not be affected, you are correct. It doesn't matter what software you are using.

com501 · Post by **com501** » Mon Jul 07, 2014 11:10 am

Just revisiting this thread...

Somebody posted that they have a hack. Haven't seen it yet.

Forts · Post by **Forts** » Thu Jul 24, 2014 8:16 am

If there is a hack, I would expect it to be fairly tightly held at this point.

com501 · Post by **com501** » Thu Jul 24, 2014 11:14 am

You are correct. It is tightly held and it works. I know this from first hand experience. Silly that Motorola would introduce a password scheme and then CHARGE you for unbreaking a radio. Makes you almost want to go to Vertex.