Kindle Touch jail broken via ID3 Tag

http://yifan.lu/2011/12/10/kindle-touch-5-0-jailbreakroot-and-ssh/

by eof • 15 years ago

187 35 15 years ago

yifan.lu

judofyr• 15 years ago

Are you kidding me? They found a XSS hole?! How can you create anything based on HTML and not think about XSS?

dsr_• 15 years ago

It's clear that Amazon did think about XSS -- in the context of the browser. The debugCmd isn't available there.

It's also clear that tney didn't think about all the other potential interactions with the system. It's not the things you don't know that bite you -- it's the thing you know that isn't so.

Genmutant2• 15 years ago

I don't think Amazon has that much of a problem with the jailbreaks. I can't see how they would loose any money with it, and who uses them, knows that he can potentially brick the device.

bvdbijl• 15 years ago

It's more like XMS really, cross media scripting

hmottestad• 15 years ago

That's great.

As a summary:

This guy found out that most of the GUI is HTML and Javascript. Some of the JS functions are mapped to OS calls, including one that will run any script as root (nativeBridge.dbgCmd();). This function is disabled in the browser, so it needs to be called from somewhere else.

So he injects the function call into the ID3 tag of an MP3 file and plays the file on the native mp3 player which has a html gui for displaying the id3 tag info :)

Finally he uses this exploit to enable ssh and install a certificate so he can connect to it.

djb_hackernews• 15 years ago

And this is the "payload":

<button type="button" style="width:100%;height:100%" onclick="javascript:nativeBridge.dbgCmd('dd if=/mnt/us/music/jailbreak.mp3 of=/tmp/payload.sh bs=1 skip=25');nativeBridge.dbgCmd('chmod +x /tmp/payload.sh');nativeBridge.dbgCmd('sh /tmp/payload.sh');">Press to Jailbreak!</button>

malnourish• 15 years ago

What a great, simple (not to diminish in any way), hack.

Why did Amazon allow a call that always runs as root?

Is it necessity, oversight, or something else?

lmm• 15 years ago

dbgCmd() suggests it was originally there for debugging. It runs as root because the UI runs as root, AIUI.

dsl• 15 years ago

tl;dr: Don't play MP3s from untrusted sources until Amazon has a fix. (this is remote code execution, don't let the term "jailbreaking" candy coat it)

burgerbrain4• 15 years ago

I believe this is technically local code execution, not remote. It's not like you can do this unless you have access to the device (the browser apparently doesn't allow it, and I can't imagine you can remotely make the device play an MP3).

vasco• 15 years ago

From what I understood you can download a song thinking its new hottest club hit and have your Kindle bricked.

SquareWheel2• 15 years ago

It's an exploit and it will get fixed, but I'd like to see what people can do with root access. Will we see vanilla Android ports?

sumukh1• 15 years ago

On the e-ink screen? I don't think that will turn out too well.

icebraining• 15 years ago

That's exactly what the Nook Touch is, though: Android 2.1 on an e-ink screen.

teilo• 15 years ago

Kindle Touch doesn't run Android. You are thinking of the Fire.

SquareWheel2• 15 years ago

Oh boy, you're right. I replaced the word "Touch" with "Fire" in my mind while reading the article and didn't notice even once. My apologies.

est• 15 years ago

> but I'd like to see what people can do with root access.

epub support!

esrauch2• 15 years ago

All of the previous kindles have been rooted and I don't know of any homebrew to support epub on Kindle 3.

Sidnicious• 15 years ago

FWIW, I noticed some images loading in the description overlay in a podcast I was listening to on my iPhone. So, it looks like iOS devices render HTML content in ID3 tags.

I've been meaning to explore whether they run JavaScript too but haven't gotten around to it yet.

Kindle Touch jail broken via ID3 Tag

Related Stories