solokeys / solo1-cli

Solo 1 library and CLI in Python
https://pypi.org/project/solo-python
Apache License 2.0
183 stars 69 forks source link

firmware update *without* pressing button (may be security) #88

Open sale2000 opened 4 years ago

sale2000 commented 4 years ago

I have 3 keys - and updated one from 3.0.0. to 4.0.0 (Worked on with the first key -> see my other ubuntu issue)

For the next key, I followed same but forgot to 'press and hold'

plug in your key, keeping the button pressed until the LED flashes yellow

just typed ./solo key update and it went to bootloader mode. Is this expected behaviour? I was actually worried if I somehow killed the device. (It works OK)

user@ubuntu : ~/.local/bin $ ./solo  key verify
Please press the button on your Solo key
Register valid
Valid Solo (<=3.0.0) firmware from SoloKeys.

user@ubuntu : ~/.local/bin $ ./solo  key update
Wrote temporary copy of firmware-4.0.0.json to /tmp/tmpnp42c43l.json
sha256sums coincide: b1822355eb1151f004cd7886ba338deee8c84488299ec3a8e5448a1057cd8455
Switching into bootloader mode...
error:
problem flashing firmware!
[Errno 19] No such device

(NOW IT WAS BLINKING continuously)

user@ubuntu : ~/.local/bin $ ./solo  version
0.0.24
user@ubuntu : ~/.local/bin $ ./solo  ls
Not using FIDO2 interface.
:: Solos
redacted: SoloKeys Solo Bootloader 3.0.0
user@ubuntu : ~/.local/bin $ ./solo  ls
Not using FIDO2 interface.
:: Solos
redacted: SoloKeys Solo Bootloader 3.0.0
user@ubuntu : ~/.local/bin $ ./solo  key update
Not using FIDO2 interface.
Wrote temporary copy of firmware-4.0.0.json to /tmp/tmp9w_cp__9.json
sha256sums coincide: b1822355eb1151f004cd7886ba338deee8c84488299ec3a8e5448a1057cd8455
using signature version >2.5.3
erasing firmware...
updated firmware 100%             
time: 7.68 s
bootloader is verifying signature...
...pass!

Congratulations, your key was updated to the latest firmware version: 4.0.0