Firmware extraction problems - binwalk is blank

Question

I'm trying to extract the firmware from my set-top box (STB) because I realized its port 22 is open and running dropbear, and I'd like to login to it. Well, because it's there. I've tried binwalk, but that's coming up blank:

$ binwalk apollo_fw4_full_p_1.1.32_nand.bin 

DECIMAL     HEX         DESCRIPTION
-------------------------------------------------------------------------------------------------------

$ 

Likewise Firmware Mod Kit fails:

$ ./extract-firmware.sh ../apollo_fw4_full_p_1.1.32_nand.bin 
Firmware Mod Kit (extract) 0.99, (c)2011-2013 Craig Heffner, Jeremy Collake

Preparing tools ...
Scanning firmware...

Scan Time:     2016-03-21 15:05:55
Signatures:    193
Target File:   /home/ob1/apollo_fw4_full_p_1.1.32_nand.bin
MD5 Checksum:  b100590cbe030628d97e6d39c6f7fde8

DECIMAL     HEX         DESCRIPTION
-------------------------------------------------------------------------------------------------------

Extracting 0 bytes of  header image at offset 0
ERROR: No supported file system found! Aborting...

Does the "nand" in the filename mean anything? Is it encrypted possibly?

Here is a link to the file for those interested: https://docs.google.com/uc?id=0B9QI-CmVjKHdekdOOU5EWk9rbTQ&export=download

I've scoured for answers and have found none, so I appreciate your input.

Answer 1

The firmware image is likely to be encrypted.

Entropy scan reveals that it is mostly comprised of random bytes which happens if the firmware is compressed and/or encrypted. Since the binary lacks common compression magic signatures, it is most likely to be encrypted.

To decrypt the firmware you need to obtain more information about the product that uses this firmware. You can refer to this blog post for some ideas.

As you say port 22 is open running a FTP service you can try connecting to it with default user/pass combos. You can try finding other open ports via nmap.