Kindle Touch jail broken via ID3 Tag

Re:Kindle Touch jail broken via ID3 Tag by hmottestad on Sunday December 11, 2011 @07:19AM (#3339921)

That's great.

As a summary:

This guy found out that most of the GUI is HTML and Javascript. Some of the JS functions are mapped to OS calls, including one that will run any script as root (nativeBridge.dbgCmd();). This function is disabled in the browser, so it needs to be called from somewhere else.

So he injects the function call into the ID3 tag of an MP3 file and plays the file on the native mp3 player which has a html gui for displaying the id3 tag info :)

Finally he uses this exploit to enable ssh and install a certificate so he can connect to it.

[ Parent | on HN ]

Re:Kindle Touch jail broken via ID3 Tag by djb_hackernews on Sunday December 11, 2011 @11:09AM (#3340262)

And this is the "payload":

<button type="button" style="width:100%;height:100%" onclick="javascript:nativeBridge.dbgCmd('dd if=/mnt/us/music/jailbreak.mp3 of=/tmp/payload.sh bs=1 skip=25');nativeBridge.dbgCmd('chmod +x /tmp/payload.sh');nativeBridge.dbgCmd('sh /tmp/payload.sh');">Press to Jailbreak!</button>

[ Parent | on HN ]

Re:Kindle Touch jail broken via ID3 Tag by malnourish on Sunday December 11, 2011 @04:52PM (#3341216)

What a great, simple (not to diminish in any way), hack.

Why did Amazon allow a call that always runs as root?

Is it necessity, oversight, or something else?

[ Parent | on HN ]

Re:Kindle Touch jail broken via ID3 Tag by lmm on Monday December 12, 2011 @08:26AM (#3343458)

dbgCmd() suggests it was originally there for debugging. It runs as root because the UI runs as root, AIUI.

[ Parent | on HN ]