Intercepting traffic of SoundTouch - bmx returned 403

[mdelissen]

Hi all,

while intercepting all traffic of the speaker by using a mitmproxy the endpoint for bmx ( https://content.api.bose.io/bmx/registry/v1/services ) returned a 403 - "invalid client id". Has this changed since the first analysis? Or am I doing something wrong here? I wanted to record all traffic for all interactions possible with the device but I guess there are some follow-up problems after that failing request.

Additionally, I've stumbled upon a call to an endpoint https://streamingoauth.bose.com/.... Do you know the usage of this one? Could be related to authentication for e.g. Spotify (response contains information about scopes which looks just like the ones used by Spotify).

Thanks in advance!

[krahl]

Hi @mdelissen,

this is obfuscated by Bose. But was figured out in #62.

tl;dr: Make a backup of /usr/lib/libBmxAccountHsm.so and patch it afterwards with

sed "s#\^https:....bose.\+apigee..net..#http[aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa]*#g" \
<libBmxAccountHsm.so.orig >libBmxAccountHsm.so.patched

Switch to the patched file instead.

Background from #62

I ran into the same problem. Turns out that if you access the SoundTouch device using remote_services then you can also enable logging by using enablecaplogs (and enabletcpdumps which has also been helpful). The log file reveals that there is an 'IsItBose' check programmed in where they check the configured URL against a hard-coded value, and then only send the necessary x-bmx-api-key if the values match.

Fortunately that value is hard-coded in plain text in /usr/lib/libBmxAccountHsm.so. A quick run of sed to replace it with a proxy URL of the same length allowed access to the key and visibility into the behavior of the bmx server.

This bit below worked for me too and you can switch to MITM Bose and direct Bose servers without having to change the /usr/lib/libBmxAccountHsm.so file ever again.

Concerning 'IsItBose' and reverse engineering (not running soundcork):

Replacing the hardcoded bose.io urls also affects other use cases. For apigee there is a regex which helps to match more urls.

% nslookup content.api.bose.io
Non-authoritative answer:
content.api.bose.io canonical name = bose-prod.apigee.net.
bose-prod.apigee.net canonical name = rea1rt250-0-routers.dn.apigee.net.
Name: rea1rt250-0-routers.dn.apigee.net
Address: 54.165.104.4

% strings libBmxAccountHsm.so|grep -i bose
IsItBose
^https://bose-[a-zA-Z0-9._-$%]+.apigee.net/
https://content.api.bose.io/ - matched hardcoded string https://content.api.bose.io/ - returning true
https://test.content.api.bose.io/ - matched hardcoded string https://test.content.api.bose.io/ - returning true
I patched the lib to match any http url like this:

sed "s#\^https:....bose.\+apigee..net..#http[aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa]*#g" \
<libBmxAccountHsm.so.orig >libBmxAccountHsm.so.patched

[mdelissen]

Thank you very much for the explanation! I didn't find the issue, probably used wrong keywords :)