APX 6000 Password

rustyjw · Aug 11, 2018

I recently picked up an APX6000 VHF radio. When Imtry to read the radio it asks for a password. The person Ingot the radio from said that it has been so long since he programmed the radio that he forgot what the password is. I tried to clone another APX6000 to it but got some type of compability message.

Any ideas how I can get this radio programmed?

Thanks

Project25_MASTR · Aug 11, 2018

If it's an old firmware, the APX line was vulnerable to the same bug as the TRBO line in which the codeplug password was sent via clear text to the CPS for the CPS to validate the password. This could be seen in Wireshark. Newer revisions keep that encrypted.

So if you have a newer revision, your options are get the password or depot the radio.

TampaTyron · Aug 11, 2018

Does Recovery work the same in APX as it does TRBO? If so, you will need same or newer version of firmware and be good to wipe. TT

mancow · Aug 11, 2018

Project25_MASTR · Aug 11, 2018

TampaTyron said:
Does Recovery work the same in APX as it does TRBO? If so, you will need same or newer version of firmware and be good to wipe. TT

There isn’t a recovery option.

Sent from my iPhone using Tapatalk

mikewazowski · Aug 12, 2018

Easier to return it to the seller.

N1GTL · Aug 12, 2018

Mancow..... Now THAT'S funny!

If I am not mistaken, Motorola has something called a "password of the day" to get into locked radios. Since the APX series is an MR sale, they can look up the original owner. If the original owner gives permission, you can get that password from Motorola. I work at at Moto shop and have gone through this. How they will handle a private party buying a used radio is another issue.

There is no "recovery" on APX radios like a TRBO series radio so this is pretty much your only option. A Moto shop may be needed to get this done for you and they can unlock it. Only other option is ship it to the depot and pay a lot more money for them to do it. And, you'll have to hope it is not a radio that was reported to them as stolen or you won't even get it back.

mmckenna · Aug 12, 2018

I agree, return it.

There seems to be a lot of this happening. Password protected radio and the seller just happened to "forget" the password. Seems to be a lot of forgetful people selling locked radios on e-Bay. Funny that they rarely mention it on the e-Bay posting…

I'd get your money back. If the seller balks, take it to E-bay or PayPal. The seller knew it was locked and sold it without disclosing that.

N4KVE · Aug 12, 2018

Once happened to me. I called the seller who instantly gave me the password, & apologized. But it was his password, so he knew it. Return the radio if he “forgot”.

MTS2000des · Aug 12, 2018

N1GTL said:
If I am not mistaken, Motorola has something called a "password of the day" to get into locked radios. Since the APX series is an MR sale, they can look up the original owner. If the original owner gives permission, you can get that password from Motorola. I work at at Moto shop and have gone through this. How they will handle a private party buying a used radio is another issue.

How does MSI know what password I put on my APX codeplugs? I've deployed just shy of 2,000 APX portables. All C/Ps are password protected. The radio were shipped direct to a warehouse. MSI didn't do any factory programming. I don't use RM, so only those who know the password are the ones who created the codeplugs and the programmers. None of the workstations that wrote the radios even had a network connection of any kind. So Motorola knowing a CPS password is about as much as the Fraudbay fencing sellers knowing it.

mmckenna said:
I'd get your money back. If the seller balks, take it to E-bay or PayPal. The seller knew it was locked and sold it without disclosing that.

This. The thieving sellers on SCAMBAY always seem to have radios that have passwords no one can "remember" or "they don't know this type of radio has a password". Open a claim and escalate it, you'll get your money back. Be sure to leave them a negative for not disclosing a material fact to buyers so the next guy/gal won't get hosed once the turd seller relists it with the "not known but working" nonsense.

Citywide173 · Aug 12, 2018

MTS2000des said:
How does MSI know what password I put on my APX codeplugs? I've deployed just shy of 2,000 APX portables. All C/Ps are password protected. The radio were shipped direct to a warehouse. MSI didn't do any factory programming. I don't use RM, so only those who know the password are the ones who created the codeplugs and the programmers. None of the workstations that wrote the radios even had a network connection of any kind. So Motorola knowing a CPS password is about as much as the Fraudbay fencing sellers knowing it.

I believe the poster was referring to a backdoor that Motorola may have in place. Remember that Apple said they wouldn't decrypt the password of an iphone for investigators, not that they couldn't. Probably the same thing-according to the post, permission from the original owner is required.

SCPD · Aug 12, 2018

If I recall they only will do that for contract entities. They do charge also for the back door tools they use. It is same tool used they have which they can read a lot data telling them about what cps was used, depot version if ever, etc.

The astro 25 had same restricted controlled item they used.

It requires a round trip to the depot also not a phone in. Meaning a contract owned radio by said agency must send it in, pay the fees and it'll come back without it with respective updates or hardware.

Next problem is if it is a AN 6000 it is eol with them I believe.

I'd return it. Other than one thing mentioned there isn't much you'd be able to do and even in that case it's 50/50 but tainted by garage work.

It's possible some older equipment in small areas gets auctioned off without any basic plug thrown back into it. Look at youtube where them guys put old units back together in patrol cars. I've seen about ten so far old sfpd cars with heads removed and brick still in trunk. Out of luck they plug a head in and it pops on working. Whether the system kills it later I wouldn't know. But this mismanagement or poor accountability in equipment happens a lot. It's old get rid of it we don't need it.

Little does one know just unplugging it, removing head, throwing it all in a box in trunk at vehicle auction isn't good enough. I did ask one youtube owner about his restoration of a old San Mateo unit which he made a unmarked security car for some reason if his portable he found worked, and xtl5000 in car he reinstalled they left in a box in back seat he said yes both work still. The system probably is showing a valid ID and never removed. Very poor accountability in that depts comm dept.

mmckenna · Aug 12, 2018

Serious disconnect between the radio shop and the fleet guys.

On the other hand, I've had a hell of a time getting old radios back from people when they no longer need them. Often they don't even think about it, to them it's just a "thing" and it goes in e-waste or surplus like all the other things.
Sometimes they are afraid I'll charge them…
I take the radios back and put a blanked out program in them. Then they go off to their fate.

I do keep a read/write password on all the radios, and no one gets it. On the newer Kenwood's theres a field where you can put in a couple of lines of information about the radio that can be read even without the password. I always put our agency name and my phone number, that way if someone does end up with one legitimately, there's a way they can contact us.

If the OP did find out who the radio originally belonged to, it's probable that the agency would not give the password out to some random dude over the phone. Best you could hope for is that they'd let them bring it by their shop to be blanked out.

In other words, unlikely.

N1GTL · Aug 13, 2018

MTS2000des said:
How does MSI know what password I put on my APX codeplugs?

They don't. I'm sure it is an algorithm that is based on some parameters. Perhaps the serial number and the date? The password will only work for that day on that radio. The next day the algorithm would generate a different password?

I'm not sure what criteria they use but it is an option. As I mentioned, they may only provide this to a Moto shop, not an individual and permission had to given by the ORIGINAL PURCHASER of the radio. If that radio was shipped to Chief Smith of ABC Fire Department, Motorola will need permission from him.

mancow · Aug 13, 2018

It's probably like a CBI function where it goes in and just blanks out that field leaving the rest of the data intact.

com501 · Aug 14, 2018

The depot tools don't care about the password and ignore it. There is an APX password hack out in the wild.

EncryptedTech · Feb 26, 2019

Does anyone know what firmware the wireshark trick stopped working? I had some free time and I have been trying to hack my own radios, I have a few as old as 09.05.00 I'm not sure if I'm missing it or if it is to new and I need to find a older radio in my fleet.

radioman2001 · Feb 26, 2019

Quote"
Serious disconnect between the radio shop and the fleet guys.

Defintely, when I first started to run our shop all the radios went with the vehicles. Not disconnected, not removed, not deprogrammed just left in the vehicle for auction. Head of motor services said they were disposable items and he didn't care. We then pulled out over 60 radios that summer before the next auction, talk about security risk.

APX password hack, never even heard of it anywhere only Astro 25.

Some time ago I bought a microprocessor board that the designer used the date of manufacture as a password to the OS located inside. So if you knew when the radio was built that is a possibility.

allend · Feb 26, 2019

Just Depot the radio and be done with it. There are people that can handle this for you and create you a fresh codeplug with some nice features as long as the firmware is not past like 17 or 18

mmckenna · Feb 26, 2019

radioman2001 said:
Defintely, when I first started to run our shop all the radios went with the vehicles. Not disconnected, not removed, not deprogrammed just left in the vehicle for auction. Head of motor services said they were disposable items and he didn't care. We then pulled out over 60 radios that summer before the next auction, talk about security risk.

I'm really starting to like the idea of a small explosive charge in the radio that can be set off remotely. Sort of like Mission: Impossible. Not hurt anyone, but something to totally wipe the codeplug. AKA: "Death Ping" the radio.

I guess I shouldn't be giving Mother M any ideas, lest they work that into their next firmware release.

APX 6000 Password

Member

Millennial Graying OBT Guy

Beep Boop, Beep Boop

Member

Millennial Graying OBT Guy

Forums Manager/Global DB Admin

Member

I ♥ Ø

Member

5B2_BEE00 Czar

Member

QRT

I ♥ Ø

Member

Member

Member

Member

Member

Member

I ♥ Ø

Similar threads