[MDTJK]

Thanks a lot for the pointer — I actually chased this one down, and here’s what
I found in case it’s useful to you or anyone else thinking the same.

I packet-captured the Encore while triggering its network “Update Software”
option. The good news: it’s very reachable. It does an HTTP POST (plain port 80,
server still alive on Azure) to:

beoportal.bang-olufsen.com
/SoftwareUpdate/v2.0/…SoftwareUpdateGPHProxyService.asmx
User-Agent: gSOAP/2.7, SOAPAction “…/GetUpdate”

So the transport is unencrypted — which looked very promising for exactly the
unsigned-image idea you described.

The catch: the SOAP messages themselves are locked down with WS-Security. The
request body is encrypted (RSA-OAEP key exchange to B&O’s server key, thumbprint
hkS7fq6iS0hBk7nTKfJLYnsCMTc=, then AES-256-CBC), and the server’s response is
both encrypted and XML-signed (WS-SecureConversation, HMAC-SHA1). So even though
it’s plain HTTP, I can’t read the update details or forge a “here’s your
firmware” reply the Encore would accept — that would need B&O’s private key.

So unless someone has those keys (or finds a flaw in the client’s validation),
the modified/unsigned-image-over-the-update-path route looks closed. B&O
apparently secured this part properly, even on hardware this old.

Still, thanks — it was a genuinely good lead and worth ruling out with evidence.
If you ever come across the update image format or any weakness in that gSOAP
client, I’d love to hear it. Cheers!

[MDTJK]

Thanks — that’s decisive. I’ve decided against opening to the core PCB, so I’m limited to what I can reach over the network. Two questions that would make or break this for me: 1. Is the root password — or any SSH access method — for this platform known? With a shell I can read the wheel/CAN events in Linux and forward them. 2. My Encore has ports 8888 and 9999 open but silent to plain connections. Do you know what those speak, and whether the platform emits key/control events on the network (the way the BLGW does)? Either one would let me do this without touching the hardware. Much appreciated!

[MDTJK]

Hi all — hoping to tap the collective knowledge here. I’m repurposing a
BeoSound 5 Encore (type 22264308) and have it partly apart.

What I’ve found so far:
– Controller/interface board: B&O 6143798 Ver C
– Platform (on-screen INFO page): Cyotec-1.0.0-b0-mpc5121-wr2.0.3-release
→ Freescale MPC5121e (PowerPC), Wind River Linux 2.0.3
– Open ports: 909 = Dropbear 0.49 SSH (root login enabled, password unknown),
9020 = TwonkyMedia UPnP, plus 8888 and 9999 (both silent)

Two things I’d love help with — either would unblock me:
1. The wheel/pointer controller’s USB + power pinout, so I can drive it from a
Raspberry Pi (like Beolyd5 / neomaster do on the standard BS5), OR
2. The root password, or the UART serial-console pinout on board 6143798.

Any schematic, pinout, or known credentials would be massively appreciated.
Happy to share photos of the internals. Thanks!

[Author]

Posts