Who's the Bose?

Who's the Bose?

Speakers: Adam Parsonz, IT Solutions Consultant

Conference: Kawaiicon

YouTube: https://www.youtube.com/watch?v=BFZeR1HhwaY

Overview

In his Kawaiicon talk, "Who's the Bose?", IT Solutions Consultant Adam Parsonz shared a compelling personal journey that seamlessly blended enterprise-grade security principles with the often-overlooked vulnerabilities of consumer Internet of Things (IoT) devices. Inspired by his pursuit of a security architect role and a real-world frustration with his Bose smart soundbar, Parsonz tackled the absurd yet critical challenge of putting a household appliance "behind MFA" – a metaphor for robust network segmentation and access control. This talk is a testament to the idea that sophisticated security practices are not exclusive to corporate environments but are increasingly vital for individuals, particularly those with high-privilege access in their professional lives.

Parsonz's presentation illuminates the tension between vendor design choices, which can prioritize business models over user control, and the paramount need for a strong personal security posture. He meticulously details how he diagnosed and circumvented a deliberate functional limitation imposed by Bose, using open-source tools to restore expected functionality without compromising his meticulously segmented home network. The talk serves as a powerful reminder that "trust, but verify" extends beyond the workplace, urging attendees to scrutinize the code and behavior of devices they invite into their homes and networks.

The implications of Parsonz's work extend far beyond a single smart soundbar. It underscores the broader challenge of securing an increasingly connected world, where consumer devices often lack transparency and robust security features. By demonstrating a practical, technical solution grounded in Zero Trust principles, Parsonz empowers both seasoned security professionals and home users to take ownership of their digital environments, highlighting the critical role of individual responsibility in the evolving threat landscape.

Background

▶ Watch: Introduction: putting a soundbar behind MFA (0:00)

Adam Parsonz’s journey into securing his home network is deeply rooted in his extensive professional experience and a profound understanding of risk. With over 13 years in the IT industry, Parsonz has held high-privilege access since his intern days, working as a consultant and tech lead across a diverse range of large organizations in New Zealand, including banking, insurance, aviation, construction, energy, central government, and the health sector, as well as numerous small businesses. This background has instilled in him a keen awareness of the responsibilities that accompany such access, emphasizing that "great power comes with great responsibility," and consequently, "great responsibility confers great risk."

Parsonz views risk as part of an evolving ecosystem, noting how the rise of remote working has expanded the attack surface to include personal networks. He highlights the critical importance of individuals with high-privilege professional access ensuring their home environments are secure against sophisticated threats, even if the likelihood seems low. He cites the LastPass compromise, which originated from a privileged administrator's personal network, as a stark example of how a breach in a home setting can have devastating corporate consequences, stressing that "insurance can't rebuild trust."

To articulate his security philosophy, Parsonz introduces his interpretation of Zero Trust principles, distilled into the mantra: "All code runs somewhere on something as someone to do business." This framework maps directly to the five pillars of Zero Trust: Software (all code), Network (somewhere), Endpoint (on something), Identities (as someone), and Data (to do business). He stresses ultimate accountability for the outcomes of any code running against one's assets, regardless of whether it's provided by a third party. Parsonz challenges the implicit trust often placed in large vendors like Microsoft, referencing recent concerns about foreign nationals working on their source code. He advocates passionately for open source software and SBOMs (Software Bill of Materials) as foundational elements for building verifiable trust, aligning with the idea that transparency is key to assurance.

Applying these principles to his home environment, Parsonz maintains a highly segmented network architecture, comprising a "baker's dozen" (13) VLANs. Crucially, all IoT devices are relegated to an untrusted zone, a strict rule designed to contain potential compromises. This rigorous setup, however, encountered a significant hurdle: his Bose smart soundbar. The Bose app, contrary to every other smart device in his home, refused to function across network segments. This meant that to control the soundbar, Parsonz had to switch his phone from his trusted main network to the untrusted IoT network, violating his established security rules. This wasn't merely an inconvenience; it led to frustrating scenarios where the soundbar would inexplicably lose audio, requiring manual intervention via the app, often amidst a crying child.

Initial troubleshooting efforts proved fruitless. Parsonz meticulously checked firewall logs, contacted Bose support, thoroughly reviewed their documentation (RTFM), and scoured online forums, all to no avail. The breakthrough came when he remembered a piece of advice he often gave: "you will always find answers at the source of truth." This led him to perform packet captures of the soundbar's network traffic. The discovery was surprisingly simple yet profoundly frustrating: the soundbar simply did not reply to any network requests originating from outside its immediate local network segment. This confirmed that the issue was not a configuration error on his part, but a deliberate, hard-coded behavior of the device itself.

Key Findings

▶ Watch: Practical explanation of Zero Trust principles (5:50)

The core discovery from Adam Parsonz's investigation was the Bose soundbar's deliberate and unwavering refusal to respond to network requests originating from outside its immediate local network segment. This wasn't a bug or a misconfiguration; it was an intentional design choice. Recognizing that "no engineer just woke up one day and decided to do this," Parsonz sought to understand the underlying business incentive behind this peculiar behavior.

His deeper technical exploration began by querying the soundbar's SSDP (Simple Service Discovery Protocol) endpoint. This protocol is commonly used by network devices to announce their services on a local network. Through this query, Parsonz identified a specific ecosystem property labeled eco2. This seemingly innocuous identifier proved to be the key to uncovering Bose's strategic motivation.

Further research into eco2 led Parsonz to Janis Technology, a UK-based software company specializing in IoT integrations. Janis Technology explicitly advertises software solutions that include a "driver for the Control4 smart home controllers for Bose sound systems, the Eco2 systems in this case." Control4 is a prominent platform for high-end smart home automation, designed for seamless integration and centralized management of various smart devices. This revelation suggested that the eco2 designation was tied to a sophisticated, professionally integrated smart home ecosystem.

Connecting these dots, Parsonz hypothesized that Bose's deliberate network segmentation enforcement on its consumer soundbars was a strategic, anti-competitive measure. Bose offers a line of professional audio products, complete with dedicated device management software, targeting commercial and corporate environments such as retail stores, cafes, and offices. By preventing their consumer-grade products from functioning across multiple VLANs or subnets, Bose effectively prevents businesses from deploying cheaper consumer soundbars in a centrally managed, multi-zone setup. This forces commercial clients to invest in Bose's more expensive professional equipment, which is designed for such distributed and managed environments. The restriction, therefore, serves to segment Bose's market, protecting the revenue streams from their professional product lines by preventing consumer devices from encroaching on that territory. This finding highlights a critical aspect of consumer IoT: devices are not always designed with the user's ultimate control or security best practices in mind, but rather to align with the vendor's broader business objectives.

Technical Deep Dive

▶ Watch: The Bose soundbar's cross-VLAN app issue (9:00)

Having pinpointed the Bose soundbar's deliberate network restriction and its likely business motivation, Adam Parsonz outlined his stringent requirements for a solution: the ability to control the soundbar from a separate, trusted VLAN, coupled with utmost convenience and speed. This ruled out cumbersome workarounds like manually switching Wi-Fi networks or initiating VPN connections on his phone every time he needed to adjust the sound.

His chosen solution was Netbird, an open-source, peer-to-peer VPN networking tool. Parsonz highlighted several features of Netbird that made it ideal for his scenario:

1. Peer-to-peer VPN networking: Netbird establishes direct, encrypted connections between devices, creating a secure overlay network.
2. Always-on connection experience: This ensures seamless connectivity without manual intervention, crucial for the "convenient and fast" requirement.
3. Open source: Aligning with Parsonz's deep-seated trust philosophy, the open-source nature of Netbird allowed for inspection and assurance of the code, a stark contrast to the opaque proprietary code of the Bose device.

However, the truly critical feature of Netbird for this particular problem was its robust support for NAT (Network Address Translation). NAT, a fundamental internet hack, allows for the modification of network address information in packet headers while in transit. In this specific context, Netbird's NAT capabilities enabled Parsonz to spoof the origin IP of his network requests.

The logical architecture of his solution involved three key components:

1. Main Network: This is Parsonz's trusted VLAN where his phone, running the Bose app, resides.
2. IoT Network: This is the untrusted VLAN where the Bose smart soundbar is isolated.
3. Netbird Integration: Parsonz deployed Netbird on existing infrastructure within his network, likely a dedicated device or a Docker container. This Netbird instance acted as a strategic intermediary.

The technical mechanism unfolded as follows:

• When Parsonz's phone, on the main network, attempted to control the Bose soundbar on the IoT network, the Bose app would send network requests destined for the soundbar's IP address.
• These requests were intercepted by the Netbird instance.
• Leveraging its NAT capabilities, Netbird would then rewrite the source IP address of these incoming requests. Instead of appearing to originate from the main network's IP range, the requests were translated to appear as if they were originating from within the IoT network's IP range.
• Crucially, the Netbird instance then forwarded these NAT-translated requests to the Bose soundbar.

From the soundbar's perspective, the incoming control requests appeared to be local, originating from a device within its own network segment. This successfully bypassed the deliberate restriction imposed by Bose, which only responded to requests from its immediate local network. The result was instantaneous and seamless: the Bose app on the trusted network could now fully control the soundbar on the untrusted IoT network, achieving the desired functionality without compromising the security posture of Parsonz's highly segmented home network. This elegant solution effectively leveraged an open-source tool and a core networking concept to reclaim control from a restrictive proprietary device.

Demo / Proof of Concept

▶ Watch: Introducing Netbird: Peer-to-peer VPN for the solution (14:30)

While Adam Parsonz's talk did not feature a live, real-time demonstration of the Netbird solution in action, he clearly outlined the conceptual Proof of Concept (PoC) and the successful outcome of his implementation. The presentation included a logical diagram illustrating the network flow, which served as a blueprint for understanding the practical application of his strategy.

The core of the PoC involved configuring Netbird on existing infrastructure within his home network, which he alluded to as "Netberg sort of docking containers on in sorry existing infrastructure that I have in my network." This Netbird deployment was strategically positioned to bridge the communication gap between his trusted main network and the untrusted IoT network. Leveraging Netbird's NAT capabilities, the setup functioned as a transparent proxy. When the Bose app on his phone (located on the main VLAN) sent control commands targeting the soundbar (on the IoT VLAN), the Netbird instance intercepted these packets. It then performed Network Address Translation, rewriting the source IP address of the packets to make them appear as if they originated from a device within the IoT network itself.

This clever manipulation of network packets effectively "tricked" the Bose soundbar. Because the incoming requests now appeared to be local to its network segment, the soundbar’s firmware, which was hard-coded to ignore external requests, responded as expected. The outcome, as Parsonz succinctly stated, was that "it just works." This demonstrated that a sophisticated network solution could effectively circumvent vendor-imposed limitations, restoring full functionality without sacrificing the stringent security boundaries of his home network. The PoC proved that with the right tools and understanding, users can regain control over their IoT devices despite restrictive design choices.

Defensive Implications

▶ Watch: Solution demonstrated: Netbird and NAT make it work (15:30)

Adam Parsonz's "Who's the Bose?" talk offers several critical defensive implications for both individual users and security professionals grappling with the complexities of modern network environments, particularly concerning IoT.

1. Mandatory Network Segmentation for IoT: The most immediate takeaway is the absolute necessity of network segmentation, specifically through VLANs, for IoT devices. Parsonz's setup, with IoT devices isolated in an untrusted zone, vividly illustrates how this practice limits the blast radius of a potential compromise. If the Bose soundbar (or any other smart device) were to be exploited, the attack would be contained within the untrusted VLAN, preventing lateral movement to more sensitive parts of the home network, such as those containing personal data or devices used for professional work. This principle is directly transferable to enterprise environments where dedicated IoT networks are crucial.

1. Extending Zero Trust to the Edge (and Home): Parsonz's application of Zero Trust principles to his home network underscores that "never trust, always verify" is not just for corporate perimeters. Implicit trust in vendor-supplied software or default configurations, even for consumer devices, is a significant risk. Defenders must question the provenance and behavior of all code running on their assets, advocating for open source solutions and SBOMs where possible, as these offer greater transparency and auditability.

1. Awareness of Vendor Lock-in and Anti-Competitive Design: The discovery of Bose's deliberate network restriction highlights how business incentives can lead to design choices that negatively impact user control and potentially security. Defenders should be aware that vendors may intentionally limit functionality to push users towards more expensive professional products or lock them into specific ecosystems. This can force users into insecure workarounds or necessitate complex technical solutions like the one Parsonz developed. Understanding these motivations can inform purchasing decisions and drive demand for more open, user-centric device designs.

1. The Power of Packet Analysis: Parsonz's inability to find answers through traditional support channels or documentation, coupled with his breakthrough via packet capture, reinforces the fundamental value of low-level network diagnostics. When devices behave unexpectedly, or when documentation is lacking, Wireshark (or similar tools) and packet analysis remain indispensable tools for understanding actual network behavior and pinpointing the root cause of issues. This skill is crucial for any network defender.

1. Proactive Threat Modeling for Personal Networks: For individuals with high-privilege access in their professional lives, securing their home network is not merely a personal preference but a professional imperative. The LastPass breach serves as a stark reminder that a compromised home network can serve as a pivot point for attacks against corporate resources, eroding "trust" – an asset that "insurance can't rebuild." Defenders in such roles must apply enterprise-level threat modeling and security practices to their personal environments.

1. Leveraging Open-Source Solutions for Control: The successful deployment of Netbird demonstrates how open-source software can empower users to overcome the limitations of proprietary systems. Open-source tools often provide the flexibility and control needed to implement custom solutions, enhance security, and regain ownership over one's digital infrastructure when commercial offerings fall short or impose unwanted restrictions. Defenders should actively explore and integrate open-source projects into their security toolkits.

Key Takeaways

• Network Segmentation is Paramount: Isolate IoT devices on dedicated, untrusted VLANs to contain potential security breaches and prevent lateral movement to sensitive network segments.
• Zero Trust Extends to Home: Apply Zero Trust principles ("never trust, always verify") to all devices, including consumer IoT, questioning implicit trust in vendor-supplied code and default behaviors.
• Vendor Business Models Impact Security: Be aware that device manufacturers may intentionally restrict functionality for commercial or anti-competitive reasons, potentially forcing users into less secure configurations or complex workarounds.
• Packet Analysis is Indispensable: When documentation or support fails, fundamental tools like packet capture are critical for diagnosing unexpected device behavior and uncovering the "source of truth."
• Open Source Empowers Control: Open-source solutions like Netbird provide the flexibility and transparency needed to overcome proprietary limitations and restore user control over network interactions and device functionality.
• Personal Network Security is Professional Responsibility: For individuals with high-privilege access in their professional roles, securing their home network is a critical component of their overall security posture, protecting both personal assets and corporate trust.

About the Speaker(s)

Adam Parsonz is an experienced IT Solutions Consultant currently serving as an architect in the public sector. With over 13 years in the industry, he has held high-privilege access throughout his career, beginning as an intern. His professional journey includes roles as a consultant and tech lead at various organizations across New Zealand's largest sectors, including banking, insurance, aviation, construction, energy, central government, and health, as well as numerous small organizations. Parsonz is a passionate advocate for open source software and SBOMs (Software Bill of Materials), believing they are crucial for building trust and transparency in the digital world. He is also known for his insights shared on social media, including discussions on niche CVEs and security topics.