Dragon863

This is great! I haven't come across much in terms of reverse engineering flutter apps specifically, it's good to see something like this can be done with relative ease. Nice work!

Hi! Author here. Yes, whilst it is possible, you would have to boot the device using a computer every time, which renders it a pretty useless spy bug. It also wouldn't function as expected, whilst it would appear to be muted, pressing the button again would not work and it would only function normally after a reboot with a computer. Having said this, I guess it would be possible to have the script wipe itself and reflash the modified partitions when mute is pressed so it works as normal again after a reboot.

Thanks! I had a go at using beercss, as material design 3 has no official web version yet

I agree that physical access is a major limitation, yet it is something that could easily be resolved with an OTA firmware upgrade or by simply informing users how their password is stored. I personally think that physical access should still be considered when designing products like these, even if it is a more remote possibility.

Two reasons: 1. Mediatek processors have a preloader, essentially a bootloader, which checks the emmc for a bootable partition, and if it cannot find one (or the emmc is not functioning correctly) it will load bootrom mode. This is what amonet exploits. 2. When using amonet on kindle devices, a similar method was used to force the device into bootrom mode as Amazon didn't provide a hardware key to do this

As others have pointed out, even hashed passwords can be used to connect to a network. However, storing the password in plain text is an embarrassment for a company as big as Amazon, and they should at least be stored in a non readable format if not encrypted. The physical access necessary does make the exploit less dangerous, though. You asked what the point of the article was, I think this could also be a starting point for running our own software on these devices, especially as there is a kernel for the mt8163 available on github from the postmarketos project

I'd have to say free time is also a huge factor! I have exams coming up, but for now in free to hack stuff in my spare time. I was also looking into newer echo models, according to hackaday they have a hidden debug port but still use mediatek processors, maybe I'll buy one on ebay in the future and have a look...

Hi! Thanks, when I write this I didn't realise that android used wpa_supplicant by default to manage wifi connections

Sorry, but I'm definitely 14! I created a separate profile because I didn't want anybody (i.e. Amazon) to be able to trace it back to my main account and find my full name. I usually do more web development in my spare time, so this was a completely different experience for me, hence the misunderstanding with hashing passwords. Also, I didn't write this from scratch, as you'll see on the GitHub page it's a fork of a project to jailbreak kindles, but thanks for the positive feedback!

Thanks for the feedback! It's the first time I've written anything like this, and I'm currently studying computer science so I appreciate the corrections as they help me improve my knowledge of the field :)

Sorry about that! I misunderstood how hashing works, and I've updated the page with a correction at the bottom

Just me, I'm currently studying computer science. Sorry for the misunderstanding of hashing, I've updated the page with a correction

Hi there! I wish I could claim that I wrote the Makefiles, but my knowledge of C is very limited and all the credit for that goes to xyzz, who created the original exploit intended for Amazon kindles. I simply created a fork that would work with the echo using the same CPU, the original code is here: https://github.com/xyzz/amonet