Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
You might expect the power state to be a bit field, but it isn't - each combination is assigned an independent value:
Main zone | Zone 2 | Zone 3 | Value | Notes |
---|---|---|---|---|
On | On | On | 1 | All on |
On | On | Off | 4 | |
On | Off | On | 5 | |
On | Off | Off | 2 | |
Off | On | On | 3 | |
Off | On | Off | 6 | |
Off | Off | On | 7 | |
Off | Off | Off | 0 | All off |
In order for the receiver to respond, the RTS bit must be set on the wire. Setting this bit requires a 5-wire cable. I have some RS232 to 3.5 mm cables which aren't usable with Yamahas.
Linux appears to automatically set the RTS bit upon opening the serial port, thus setting it explicitly may not be needed.
To monitor serial communications under Linux, I used slsnif which I found via this summary of serial port monitoring tools.
The receiver is very frequently not responding to the "ready" command. The documentation mentions retrying this command but in my experience the first time this command is sent to a RX-V1500 which is in standby it is always igored.
I have RX-V1500 and RX-V2500, however I couldn't locate RS232 protocol manuals for these receivers. I am primarily using RX-V1700/RX-V2700 manual with some references to RX-V1000/RX-V3000 manual. The commands are mostly or completely identical, with RX-V1700/RX-V2700 manual describing most or all of what RX-V1500/RX-V2500 support, but the status responses are very different. For my RX-V1500/RX-V2500 I had to reverse-engineer the status responses, and because of this they only have a limited number of fields decoded.
Volume level is set and reported as follows: 0 means muting is active, otherwise the minimum level for the zone is 39 and each step in the level is the next integer value up. For the main zone on RX-V1500/RX-V2500, the volume is adjusted in 0.5 dB increments from -80 dB to 14.5 dB, giving the integer values the range of 39-228. For zones 2 and 3 the volume is adjusted in whole dB increments from -33 dB to 0 dB, giving the integer range of 39-72.
While testing with Python, I ran into this issue - to open a TTY in Python, buffering must be disabled.
See here for more Yamaha-related software.
Yamaha RS232/serial protocol:
Serial port communication in Ruby:
FAQs
Unknown package
We found that yamaha demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.