Examination of YAMAHA MusicCast devices - Revision history

NKirnbauer: gendering

2024-09-11T16:19:26Z

gendering

← Older revision		Revision as of 16:19, 11 September 2024
Line 12:		Line 12:

	<h1>Introduction</h1>		<h1>Introduction</h1>
	<p style="text-align: justify">The Japanese [https://www.yamaha.com/ Yamaha Cooperation] is not only known for its motorcycles, but also for its love of music. Its history dates back to 1887 when the company founder Torakusu Yamaha successfully builds his first reed organ.<sup>[https://www.yamaha.com/en/about/pdf/corporate_profile_2018_en.pdf]</sup> Over the years, the company has become the world's largest manufacturer of high quality pianos, but also holds a strong market position in other areas of the music industry. Since the company is also active in the digital sector, this article will focus on the [https://europe.yamaha.com/en/products/contents/audio_visual/musiccast/index.html MusicCast] product line. These products promise an exceptional sound experience in your own home cinema, so that everyone can enjoy ~~his~~ favourite Elvis songs in best sound quality.</p>		<p style="text-align: justify">The Japanese [https://www.yamaha.com/ Yamaha Cooperation] is not only known for its motorcycles, but also for its love of music. Its history dates back to 1887 when the company founder Torakusu Yamaha successfully builds his first reed organ.<sup>[https://www.yamaha.com/en/about/pdf/corporate_profile_2018_en.pdf]</sup> Over the years, the company has become the world's largest manufacturer of high quality pianos, but also holds a strong market position in other areas of the music industry. Since the company is also active in the digital sector, this article will focus on the [https://europe.yamaha.com/en/products/contents/audio_visual/musiccast/index.html MusicCast] product line. These products promise an exceptional sound experience in your own home cinema, so that everyone can enjoy their favourite Elvis songs in best sound quality.</p>

	<h2>YAMAHA MusicCast</h2>		<h2>YAMAHA MusicCast</h2>

NKirnbauer: link that doesnt exist

2024-09-10T18:39:51Z

link that doesnt exist

← Older revision		Revision as of 18:39, 10 September 2024
Line 395:		Line 395:

	<h1>Used Hardware</h1>		<h1>Used Hardware</h1>
	* [[YAMAHA MusicCast YSP-2700: Soundbar]]		* YAMAHA MusicCast YSP-2700: Soundbar

	<h1>References</h1>		<h1>References</h1>

Ikramer at 17:42, 12 March 2024

2024-03-12T17:42:12Z

← Older revision		Revision as of 17:42, 12 March 2024
Line 408:		Line 408:

	</div>		</div>


			[[Category:Documentation]]
			[[Category:Pentesting]]

JPDoe: Minor: Bug fixes.

2020-06-19T13:43:10Z

Minor: Bug fixes.

← Older revision		Revision as of 13:43, 19 June 2020
Line 1:		Line 1:
			<div style="max-width: 970px">

	<div class="toccolours mw-collapsible mw-collapsed" style="border-color: lightgrey; background-color: white; overflow:auto;">		<div class="toccolours mw-collapsible mw-collapsed" style="border-color: lightgrey; background-color: white; overflow:auto;">
	<div style="font-weight: normal;line-height:1.6;">ⓘ Table of Contents</div>		<div style="font-weight: normal;line-height:1.6;">ⓘ Table of Contents</div>
	<div class="mw-collapsible-content">		<div class="mw-collapsible-content">
	__TOC__		__TOC__
	~~</div>~~
	</div>		</div>
	</div>		</div>
Line 39:		Line 40:
	<h2>Network Mapper</h2>		<h2>Network Mapper</h2>

	<div class="toccolours mw-collapsible mw-collapsed" style="~~border-color: #a7d7f9;~~ background-color: white; calc(100% - 12px); overflow:auto;">		<div class="toccolours mw-collapsible mw-collapsed" style="background-color: white; calc(100% - 12px); overflow:auto;">
	<div style="font-weight: bold;line-height:1.6;">ⓘ YAMAHA MusicCast YSP-2700: Soundbar</div>		<div style="font-weight: bold;line-height:1.6;">ⓘ YAMAHA MusicCast YSP-2700: Soundbar</div>
	<div class="mw-collapsible-content">		<div class="mw-collapsible-content">
Line 89:		Line 90:
	</div>--><!--		</div>--><!--

	<div class="toccolours mw-collapsible mw-collapsed" style="~~border-color: #a7d7f9;~~ background-color: white; calc(100% - 12px); overflow:auto;">		<div class="toccolours mw-collapsible mw-collapsed" style="background-color: white; calc(100% - 12px); overflow:auto;">
	<div style="font-weight: bold;line-height:1.6;">ⓘ Real Time Streaming Protocol (RTSP): Notes</div>		<div style="font-weight: bold;line-height:1.6;">ⓘ Real Time Streaming Protocol (RTSP): Notes</div>
	<div class="mw-collapsible-content">		<div class="mw-collapsible-content">
Line 139:		Line 140:
	</div>		</div>

	<div class="toccolours mw-collapsible mw-collapsed" style="~~border-color: #a7d7f9;~~ background-color: white; calc(100% - 12px); overflow:auto;">		<div class="toccolours mw-collapsible mw-collapsed" style="background-color: white; calc(100% - 12px); overflow:auto;">
	<div style="font-weight: bold;line-height:1.6;">ⓘ IBM Db2: Notes</div>		<div style="font-weight: bold;line-height:1.6;">ⓘ IBM Db2: Notes</div>
	<div class="mw-collapsible-content">		<div class="mw-collapsible-content">
Line 185:		Line 186:
	</div>		</div>

	<div class="toccolours mw-collapsible mw-collapsed" style="~~border-color: #a7d7f9;~~ background-color: white; calc(100% - 12px); overflow:auto;">		<div class="toccolours mw-collapsible mw-collapsed" style="background-color: white; calc(100% - 12px); overflow:auto;">
	<div style="font-weight: bold;line-height:1.6;">ⓘ Multipurpose Internet Mail Extensions (MIME) type: Octet Stream</div>		<div style="font-weight: bold;line-height:1.6;">ⓘ Multipurpose Internet Mail Extensions (MIME) type: Octet Stream</div>
	<div class="mw-collapsible-content">		<div class="mw-collapsible-content">
Line 195:		Line 196:
	</div>		</div>

	--~~></div~~>		-->
	</div>		</div>
	</div>		</div>
Line 224:		Line 225:
	# Get Network Settings		# Get Network Settings
	http://$MusicCast/YamahaExtendedControl/v1/system/getNetworkStatus		http://$MusicCast/YamahaExtendedControl/v1/system/getNetworkStatus
	{"response_code":0,"network_name":"LivingRoom","connection":"wired_lan","dhcp":true,"ip_address":"192.168.86.248","subnet_mask":"255.255.255.0","default_gateway":"192.168.86.1","dns_server_1":"192.168.86.1","dns_server_2":"0.0.0.0","wireless_lan":{"ssid":"Wifi","type":"wpa2-psk(aes)","key":"","ch":0,"strength":0},"wireless_direct":{"ssid":"YSP-2700 44079A","type":"none","key":""},"musiccast_network":{"ready":true,"device_type":"standard","child_num":0,"ch":0,"initial_join_running":false},"mac_address":{"wired_lan":"AC44F244079A","wireless_lan":"0CB2B764EB4F","wireless_direct":"0CB2B764EB50"},"airplay_pin":""}		{"response_code":0, "network_name":"LivingRoom", "connection":"wired_lan", "dhcp":true,"ip_address":"192.168.86.248", "subnet_mask":"255.255.255.0", "default_gateway":"192.168.86.1", "dns_server_1":"192.168.86.1", "dns_server_2":"0.0.0.0", "wireless_lan":{"ssid":"Wifi", "type":"wpa2-psk(aes)", "key":"", "ch":0,"strength":0},"wireless_direct":{"ssid":"YSP-2700 44079A", "type":"none", "key":""},"musiccast_network":{"ready":true,"device_type":"standard", "child_num":0,"ch":0,"initial_join_running":false}, "mac_address":{"wired_lan":"AC44F244079A", "wireless_lan":"0CB2B764EB4F", "wireless_direct":"0CB2B764EB50"},"airplay_pin":""}

	# Inject a Bluetooth device		# Inject a Bluetooth device
Line 239:		Line 240:

	<h2>Web Interface</h2>		<h2>Web Interface</h2>
	A compressed copy of the Yamaha YSP-2700 client-side webpage can be found [[Media:Webpage YSP-2700.zip\|here]]. The website does not have any authentication options, so it is possible for any user on the network to perform some basic configurations. By analysing the ~~<code>~~scr1.js~~</code>~~ file used, it was first possible to conclude that the YamahaExtendedControl (YXC) API was being employed. YXC is used by all devices of the MusicCast product line and allows the control by a suitable smartphone app or any HTTP client.		<!--A compressed copy of the Yamaha YSP-2700 client-side webpage can be found [[Media:Webpage YSP-2700.zip\|here]]. -->The website does not have any authentication options, so it is possible for any user on the network to perform some basic configurations. By analysing the scr1.js file used, it was first possible to conclude that the YamahaExtendedControl (YXC) API was being employed. YXC is used by all devices of the MusicCast product line and allows the control by a suitable smartphone app or any HTTP client. This API and app will be discussed in the following section.

	<div class="toccolours mw-collapsible mw-collapsed" style="~~border-color: #a7d7f9;~~ background-color: white; calc(100% - 12px); overflow:auto;">		<div class="toccolours mw-collapsible mw-collapsed" style="background-color: white; calc(100% - 12px); overflow:auto;">
	<div style="font-weight: normal; line-height:1.6;">ⓘ YAMAHA YSP-2700: Soundbar</div>		<div style="font-weight: normal; line-height:1.6;">ⓘ YAMAHA YSP-2700: Soundbar</div>
	<div class="mw-collapsible-content">		<div class="mw-collapsible-content">
Line 254:		Line 255:
	</gallery>		</gallery>

	~~</div>~~
	</div>		</div>
	</div>		</div>
Line 260:		Line 260:
	<h3>Third-party software licenses</h3>		<h3>Third-party software licenses</h3>

	<div class="toccolours mw-collapsible mw-collapsed" style="~~border-color: #a7d7f9; background-color: #a7d7f925;~~ calc(100% - 12px); overflow:auto;">		<div class="toccolours mw-collapsible mw-collapsed" style="calc(100% - 12px); overflow:auto;">
	<div style="font-weight: normal; line-height:1.6;">ⓘ This page gives a quick insight into employed software.</div>		<div style="font-weight: normal; line-height:1.6;">ⓘ This page gives a quick insight into employed software.</div>
	<div class="mw-collapsible-content">		<div class="mw-collapsible-content">
Line 269:		Line 269:
	-webkit-column-count: 6;		-webkit-column-count: 6;
	color: #000;		color: #000;
	~~border-color: #a7d7f9;~~
	background-color: white		background-color: white
	padding: 1em;">		padding: 1em;">
Line 309:		Line 308:

	<p style="text-align: justify"><span id="License_footnote"></span><b>License footnote</b>: "This product incorporates and bundles computer programs and contents in which Yamaha owns copyrights or with respect to which it has license to use others' copyrights. Any unauthorized use of such programs and contents outside of personal use is not permitted under relevant laws. Any violation of copyright has legal consequences. DON'T MAKE, DISTRIBUTE OR USE ILLEGAL COPIES. DON'T DISASSEMBLE, DECOMPILE, OR <span style="color: blue">REVER<u>C</u>E ENGINEER</span> SUCH COMPUTER PROGRAMS AND CONTENTS."</p>		<p style="text-align: justify"><span id="License_footnote"></span><b>License footnote</b>: "This product incorporates and bundles computer programs and contents in which Yamaha owns copyrights or with respect to which it has license to use others' copyrights. Any unauthorized use of such programs and contents outside of personal use is not permitted under relevant laws. Any violation of copyright has legal consequences. DON'T MAKE, DISTRIBUTE OR USE ILLEGAL COPIES. DON'T DISASSEMBLE, DECOMPILE, OR <span style="color: blue">REVER<u>C</u>E ENGINEER</span> SUCH COMPUTER PROGRAMS AND CONTENTS."</p>
	~~</div>~~
	~~</div>~~

	</div>		</div>
	</div>		</div>
Line 336:		Line 332:
	*<b>You may not</b> initiate services based on the use of the SOFTWARE without permission by Yamaha Corporation.		*<b>You may not</b> initiate services based on the use of the SOFTWARE without permission by Yamaha Corporation.

	<div class="toccolours mw-collapsible mw-collapsed" style="~~border-color: #a7d7f9; background-color: #a7d7f925;~~ calc(100% - 12px); overflow:auto; margin-top: 10px">		<div class="toccolours mw-collapsible mw-collapsed" style="calc(100% - 12px); overflow:auto; margin-top: 10px">
	<div style="font-weight: normal; line-height:1.6;">ⓘ Full License Agreement</div>		<div style="font-weight: normal; line-height:1.6;">ⓘ Full License Agreement</div>
	<div class="mw-collapsible-content">		<div class="mw-collapsible-content">
Line 410:		Line 406:
	* https://www.npmjs.com/package/yamaha-yxc-nodejs		* https://www.npmjs.com/package/yamaha-yxc-nodejs
	* https://github.com/rsc-dev/pyamaha		* https://github.com/rsc-dev/pyamaha

			</div>

JPDoe at 12:13, 18 May 2020

2020-05-18T12:13:58Z

← Older revision		Revision as of 12:13, 18 May 2020
Line 410:		Line 410:
	* https://www.npmjs.com/package/yamaha-yxc-nodejs		* https://www.npmjs.com/package/yamaha-yxc-nodejs
	* https://github.com/rsc-dev/pyamaha		* https://github.com/rsc-dev/pyamaha

	~~[[Category:Documentation]]~~

JPDoe: Minor fix after reordering contents

2020-04-26T09:43:12Z

Minor fix after reordering contents

← Older revision		Revision as of 09:43, 26 April 2020
Line 239:		Line 239:

	<h2>Web Interface</h2>		<h2>Web Interface</h2>
	~~<!--~~A compressed copy of the Yamaha YSP-2700 client-side webpage can be found [[Media:Webpage YSP-2700.zip\|here]]. ~~-->~~The website does not have any authentication options, so it is possible for any user on the network to perform some basic configurations. By analysing the scr1.js file used, it was first possible to conclude that the YamahaExtendedControl (YXC) API was being employed. YXC is used by all devices of the MusicCast product line and allows the control by a suitable smartphone app or any HTTP client~~. This API and app will be discussed in the following section~~.		A compressed copy of the Yamaha YSP-2700 client-side webpage can be found [[Media:Webpage YSP-2700.zip\|here]]. The website does not have any authentication options, so it is possible for any user on the network to perform some basic configurations. By analysing the <code>scr1.js</code> file used, it was first possible to conclude that the YamahaExtendedControl (YXC) API was being employed. YXC is used by all devices of the MusicCast product line and allows the control by a suitable smartphone app or any HTTP client.

	<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #a7d7f9; background-color: white; calc(100% - 12px); overflow:auto;">		<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #a7d7f9; background-color: white; calc(100% - 12px); overflow:auto;">

JPDoe at 09:41, 26 April 2020

2020-04-26T09:41:26Z

Show changes

JPDoe: Removed placeholder for Other Devices and further Application investigations

2020-04-11T18:47:31Z

Removed placeholder for Other Devices and further Application investigations

← Older revision		Revision as of 18:47, 11 April 2020
Line 23:		Line 23:
	[https://europe.yamaha.com/en/products/audio_visual/sound_bar/ysp-2700/specs.html#product-tabs Specs]		[https://europe.yamaha.com/en/products/audio_visual/sound_bar/ysp-2700/specs.html#product-tabs Specs]
	[https://europe.yamaha.com/en/products/audio_visual/sound_bar/ysp-2700/downloads.html#product-tabs Downloads]		[https://europe.yamaha.com/en/products/audio_visual/sound_bar/ysp-2700/downloads.html#product-tabs Downloads]

	~~<h2>YAMAHA YYY-0000: Other Devices</h2>~~
	~~<span style="font-size: 50px; line-height: 30px; padding-left: 10px">⚒</span>~~

	<h2>YAMAHA Extended Control (YXC) API</h2>		<h2>YAMAHA Extended Control (YXC) API</h2>
Line 284:		Line 281:
	* AppStore (Outside US): https://itunes.apple.com/jp/app/musiccast-controller/id1012248381		* AppStore (Outside US): https://itunes.apple.com/jp/app/musiccast-controller/id1012248381
	* GooglePlay: https://play.google.com/store/apps/details?id=com.yamaha.av.musiccastcontroller		* GooglePlay: https://play.google.com/store/apps/details?id=com.yamaha.av.musiccastcontroller

	~~<span style="font-size: 50px; line-height: 30px; padding-left: 10px">⚒</span>~~

	<h2>Application programming interface (API)</h2>		<h2>Application programming interface (API)</h2>

JPDoe at 16:42, 29 February 2020

2020-02-29T16:42:07Z

Show changes

JPDoe at 12:06, 16 February 2020

2020-02-16T12:06:28Z

← Older revision		Revision as of 12:06, 16 February 2020
Line 1:		Line 1:
	<~~!---------------------------------------------------------~~--------		<div class="toccolours mw-collapsible mw-collapsed" style="border-color: lightgrey; background-color: white; overflow:auto;">
	~~TODO~~		<div style="font-weight: normal;line-height:1.6;">ⓘ Table of Contents</div>
	~~-------------------------------------------------------------------~~		<div class="mw-collapsible-content">
	*		__TOC__
	~~------------------------------------------------------------------~~>		</div>
			</div>
			</div>

	<h1>Summary</h1>		<h1>Summary</h1>
	<p style="text-align: justify">The Yamaha Cooperation is known for its music and not for its digital security for good reason. The vulnerabilities discovered here are based on the use of an unauthenticated API over HTTP. Although this API is sold as a feature and does not necessarily pose a great security risk, it does allow you to have a lot of fun and full control over the functions of the device, as long as you are on the same network.</p>		<p style="text-align: justify">The Yamaha Cooperation is known for its music and not for its digital security for good reason. The vulnerabilities discovered here are based on the use of an unauthenticated API over HTTP. Although this API is sold as a feature and does not necessarily pose a great security risk, it does allow you to have a lot of fun and full control over the functions of the device, as long as you are on the same network.</p>