Motorola SmartZone/SmartNet/Type 2 trunked radios can be bricked

[ChrisSmolinski]

"Motorola SmartZone/SmartNet/Type 2 trunked radios can be bricked (need a reflash that can only be done by Motorola themselves, not in the field or at customer sites), targeted to individual radios by radio ID, by one 4-byte command sent over the air with no authentication."

https://twitter.com/XMPPwocky/status/1269543285422346240

[NJQA]

I wonder if it really is this easy?

It would seem to me that you have to have a properly formatted and addressed command to even get the system to repeat your transmission on the control channel.  If you had your own transmitter, it has to be stronger than the control channel.  Is it possible to disable all radios enmass, or must this be done on a radio by radio basis?  If it is radio by radio, then you need to collect radio IDs first.

Perhaps something that is possible in theory but far more difficult to implement in practice....

[Josh]

Don't the chicom barfing rigs have a similar built in brick command?

[redhat]

Many of the XTS series radios have what's known as tactical inhibit, a feature to destroy the encryption keys and other programmed data in the radio and prevent unwanted surveillance from a captured radio.  It can be defeated in the codeplug, i believe.

+-RH