Keep orbic-usb installer alive

[ideologysec]

Prerequisites

• I have read CONTRIBUTING.md

What problem does this feature solve or what does it enhance?

Currently orbic-shell is on the path to deprecation.

In the past, we have organized parties locally where we bought and flashed several hundred orbics at a time to give out to people (or at least at cost for the hardware), which was really only possible due to the adb connection. Even with reflash failures we had a great hit rate.

Currently, manually connecting to each wifi hospot would terminate or at least cripple that workflow, as described in #599 (comment)

Are there any plans for maintaining the capability for batch flashing? It seems like a webUI RCE would need to be found, or more work put into rootshell, which I realize would be more overhead and maintenance.

Proposed Solution

Offer a batch-flashing capability for Orbic.

Alternatives Considered

No response

[untitaker]

there's no plan to actually get rid of the usb installer right now, but i would like to find ways to make it less needed, to reduce support workload

what's the main issue, connecting to wifi or the different passwords?

I've been able to use USB tethering instead of wifi on TP-Link, I wonder if it can work the same on orbic

alternatively I wonder if one could programmatically connect to different wifi networks and run the installer, which I have also done in the past for TP-Link

[ideologysec]

The biggest issue is actually that since the admin password is the wifi password, and it's unique per device, it requires manual intervention (lots of button pressing on each device), and it can't be copied, only typed.

Connecting to different wifi networks could be done programmatically on Linux fairly easily, but USB tethering is probably more reliable.

if there's a way to automate the extraction of the wifi password via USB, that could work.

[untitaker]

fwiw if you buy the Kajeet Rc400l from ebay, that's pretty much the same device except the password on all of them is the same.

extracting the password automatically would be ideal but from what I can tell it would require a completely separate exploit