Consumed Consumer . org

Hacking Sony WH-CH720N Headphones

2026-07-04T15:00:00.000-04:00

It has recently transpired that a large number of Bluetooth headphones are vulnerable to a particularly nasty attack and among them, Apple and Sony products, so I look at the ones I have as well.

My very first travel set of headphones, having both ANC (active noise cancelling), Bluetooth, wire and even one of those old airplane adapters was the venerable mdr-ex750na - they’re not sold anymore, but you can probably find the support page and manual (sny-old-pdf). The closest model in appearance and some features is Sony MDRAS800AD. I liked them precisely because the small form factor made it less likely that they will break in my backpack (a fate that many expensive, over the ear models typically met), and they were perfectly useable through the wire.

When pods in a charging case became popular (around the time Apple decided that it’s a good way to squeeze more money out of their cult by doing away with the jack, and every one else followed), I decided to try Jabra’s version (I think I got the first version that’s not sold anymore), and I would’ve liked them more, were it not for the short battery life and the token (weak) ANC.

I haven’t used either in a long time and I’m too lazy to check if they still work. I have long tried to avoid using headphones for as long as I’ve known that they’re not hearing friendly, and studies show that loss of hearing may soon bring about dementia (nih-hrdmnt). Yet you may occasionally find yourself in a noisy environment, and then you don’t have much of a choice in using them.

So when I came about another pair of over the ear headphones, I was quite impressed with the quality and battery life and I kept them: Sony WH-CH720N. They’re also so flexible that they are less likely to break. They even allow you to use them in wired mode, though I don’t often use them in that manner.

When I recently learned that the widely used Airoha chipset (better called cheapset) has a significant vulnerability that allows connection and even FOTA (firmware over the air) updates without authentication (yt-suths), I had to look up my own headphones and sure enough, mine is there and was even possibly the first they tested (ins-aroha).

I’m guessing all Sony and Apple BT headphones and pods suffer from this (thn-aplptchsb), but to be sure, the researchers provide a way to test it (gh-rctk).

Given how long this was known (thn-airoha), it’s remarkable that most guides published as late as 2026 fail to mention this issue and continue to recommend models known to suffer from this very serious issue.

*(*This article is unfinished – it was scheduled to appear in the hope that it will be finished before, but since this message is here and until it is removed, the article is to be considered work in progress*)*.

Sources / More info

sny-old-pdf,
nih-hrdmnt,
tr-bth,
thn-aplptchsb,
thn-airoha,
ins-airoha,
gh-rctk,
FRBS Best Wireless Headphones 2026. Forbes Vetted Tech Team. April 15, 2026.
SNDG Best headphones for travel - SoundGuys. Adam Birney. April 17, 2026.
CNTE Best Travel Headphones for 2026 - CNET. David Carnoy. May 01, 2026.
CNTR 7 Travel Headphones Our Editors Recommend for Long-Haul Flights | Conde Nast Traveler. Paris Wilson. July 02, 2026.
THBR 8 BEST Travel Headphones (for Adventuring). Ralph Cope. May 19, 2026.
NYTM The 4 Best Noise-Cancelling Headphones of 2026. Wirecutter Staff. June 15, 2026.
CNNC cnnu-bth-ef CNN Underscored Editors Favorite Headphones for Flying in 2026. CNN. June 20, 2026.

Thus Consumed Consumer (.org): #headphones, #sony, #vulnerability, #bluetooth, #bt, #sdk, #fota, #airbuds, #apple, #airpods, #earbuds, #anc, #noise-cancelling, #active noise cancelling (Tags)

Solving NO_PUBKEY error

2025-09-21T12:00:00.003-04:00

I have bunch of old, dusty laptops running around, and, obviously, I've been working to install linux onto them. Whenever I turn them on, I have to solve the same problems, so rather than repeatedly looking for the solutions I cannot memorize, I'd rather add them here.

The first thing to do when turning on the machine is updating linux, but no sooner that I do that and I’m hit with the NO_PUBKEY error, which means that the machine cannot update.

The first solution I find involves the following command (replace # with the key ID from the error message):

sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys #

Alas, that is specific to Ubuntu, while Debian is moving away from it.

So the commands to use are instead (again, replace # with the key ID from the error message)

gpg --keyserver pgpkeys.mit.edu --recv-key  #      
gpg -a –export # | sudo apt-key add -

It is also possible to use a command to automate this for you if you’re on Ubuntu, and below Debian:

sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys #

sudo apt update 2>&1 1>/dev/null | sed -ne 's/.*NO_PUBKEY //p' | while read key; do if ! [[ ${keys[*]} =~ "$key" ]]; then sudo apt-key adv --keyserver hkp://pool.sks-keyservers.net:80 --recv-keys "$key"; keys+=("$key"); fi; done

However, I had some difficulties with the command above and even the one that worked had some warnings. Nonetheless, I’ll consider the issue resolved.

On a newer machine, I discovered

alias kupd8='sudo wget https://archive.kali.org/archive-keyring.gpg -O /usr/share/keyrings/kali-archive-keyring.gpg'

On the old machine I’ll just set up the command to work as an alias under the root account; the user account I setup for SSH probably has its own such alias.

Moving on, the machine no longer showed the Windows partition in the GRUB boot menu. This is a problem I thought I had fixed before, but let me look into it again.

Edit /etc/default/grub and ensure this line is present and not commented out: GRUB_DISABLE_OS_PROBER=false (in my case it was commented out, so I deleted the #).
Regenerate grub config: sudo update-grub
Reboot and check the GRUB menu for a Windows entry.

~~And that’s it. Everything else seems to be working fine. So far~~.

LE: I’ve discovered that my other, regular, non-root accounts have become inaccessible, most likely because the distro doesn’t like that and wants to force root-only; that should be interesting to fix. Another problem was caused by the actual maintainers but it can easily be fixed:

$ sudo wget https://archive.kali.org/archive-keyring.gpg -O /usr/share/keyrings/kali-archive-keyring.gpg

..or use curl with –o instead of wget and its switch. Finally, one of my WSL installs of Kali is missing gpg which makes it impossible to use any of the above. I might have to kill it entirely and reinstall, rather than mess with fixing it.

To avoid these in the future I’ll create aliases in the root account.

Sources / More info: debian-webb, mo-users, kali-gpg, kali-new

Thus Consumed Consumer (.org): #kali, #linux, #debian, #apt, #aptitude, #gpg, #keyring, #key, #no_pubkey, #pubkey, #apt-get (Tags)

Flipper Zero with WiFi board and Video Module Raspberry Pico

2025-03-30T12:30:00.001-04:00

Having recently purchased a new Flipper Zero together with a Wi-Fi Dev module and a Video Game (Raspberry Pi) module, I'm writing an updated guide on how to make the best use of these devices.

Let’s be clear on one thing: depending on what do you want to achieve, there is generally better hardware for a lower price that can help you on your “hacking” (by which I mean learning the intricacies of hardware) path. The Video Game Module is a Raspberry Pi Pico (with the RP2040 microcontroller) and a “TDK ICM-42688-P motion-tracking sensor”, which has little use otherwise. The Wi-Fi Dev module is a ESP32 S2 WROVER which can run the Marauder firmware.

To update and / or modify the above I used a Windows laptop and a browser. I looked briefly at a few instruction videos and found them all to be quite outdated.

For the Flipper Zero (the main unit), I first inserted a micro-SD card (which can be as small as 32 GB, anything more is probably wasted), then I connected the main unit to the laptop, then navigated to lab.flipper.net where I updated the firmware to the latest, then installed the Marauder ESP32 app.

One could probably use the app for their respective OS but the web connection is the easiest first step, since you can update the firmware and install additional apps all from the same “lab” official website.

The Wi-Fi Dev board can also be connected directly to the laptop and updated over the Internet. One can use fzeeflasher in either the .com (fzfc) or .io (fzfi) incarnations. This means:

disconnect the main unit and connect the ESP32 Wi-Fi module alone to the laptop using the USB-C cable
navigate with your browser to either “flasher” website
click connect
choose your board from the drop-down list (mine was “S2”)
choose the latest firmware (mine was Marauder v1.3.0, though others are also available)
click “program” and wait for the flashing to proceed

The log was:

ESP Web Flasher loaded.
Connecting...
Connected successfully.
Try hard reset.
Chip type ESP32-S2
Connected to ESP32-S2 @ 115200bps
MAC Address: 68:B6:B3:0B:4B:20
Uploading stub...
Running stub...
Stub is now running...
Detecting Flash Size
FlashId: 0x16405E
Flash Manufacturer: 5e
Flash Device: 4016
Auto-detected Flash size: 4MB
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!! FLASHING STARTED! DO NOT UNPLUG !!!
!!! UNTIL FLASHING IS COMPLETE!! !!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
Image header, Magic=0xE9, FlashMode=0x02, FlashSizeFreq=0x2F
Writing data with filesize: 14496
Erase size 14496, blocks 1, block size 0x4000, offset 0x1000, encrypted no
Took 149ms to write 14496 bytes
Erase size 0, blocks 0, block size 0x4000, offset 0x0000, encrypted no
---> Finished flashing bootloader.
Image header, Magic=0xAA, FlashMode=0x01, FlashSizeFreq=0x02
Writing data with filesize: 3072
Erase size 3072, blocks 1, block size 0x4000, offset 0x8000, encrypted no
Took 129ms to write 3072 bytes
Erase size 0, blocks 0, block size 0x4000, offset 0x0000, encrypted no
---> Finished flashing partitions.
Image header, Magic=0x01, FlashMode=0x00, FlashSizeFreq=0x00
Writing data with filesize: 8192
Erase size 8192, blocks 1, block size 0x4000, offset 0xE000, encrypted no
Took 127ms to write 8192 bytes
Erase size 0, blocks 0, block size 0x4000, offset 0x0000, encrypted no
---> Finished flashing boot_app0.
Image header, Magic=0xE9, FlashMode=0x02, FlashSizeFreq=0x2F
Writing data with filesize: 980288
Erase size 980288, blocks 60, block size 0x4000, offset 0x10000, encrypted no
Took 12773ms to write 980288 bytes
Erase size 0, blocks 0, block size 0x4000, offset 0x0000, encrypted no
---> Finished flashing firmware.
---> FLASHING PROCESS COMPLETED!
Restart the board or disconnect to use the device.
[Object.debug:223] Finished read loop

Once the Dev board has this firmware, turn off the Flipper, connect the Wi-Fi board, turn on the Flipper and the app can communicate with the board. See below for some of “hacks” that can be done.

On first use, you might be asked if you want to save packets to the card, which you might want to answer with yes, but you might want to consider answering “no” to saving all the logs as that can eat up your space with junk.

Finally, while the Wi-Fi Dev board from Flipper Zero is useful, you could get an expansion board with more functionality (NRF Mousejacker and a High Gain CC1101) for only a few bucks more: antenna+.

I purchased the Video module without spending much time researching it first; it turns out that the Raspberry Pico it’s based on is too underpowered to use it for much else, so that’s pretty much a write off, given that I don’t play that many games.

Sources / More info: f0-1, buy, apps, fzfc, fsfi, ocw-attck

Thus Consumed Consumer (.org): #hardware, #flipper, #flipper zero, #hack, #hacking, #wifi, #wi-fi, #wireless, #firmware, #marauder, #exploitation, #module (Tags)