Kindle Touch jail broken via ID3 Tag
1–10 of 36 posts
Re: Kindle Touch jail broken via ID3 Tag
#2Are you kidding me? They found a XSS hole?! How can you create anything based on HTML and not think about XSS?
Re: Kindle Touch jail broken via ID3 Tag
#3Are you kidding me? They found a XSS hole?! How can you create anything based on HTML and not think about XSS?
It's clear that Amazon did think about XSS -- in the context of the browser. The debugCmd isn't available there.
It's also clear that tney didn't think about all the other potential interactions with the system. It's not the things you don't know that bite you -- it's the thing you know that isn't so.
Re: Kindle Touch jail broken via ID3 Tag
#4That's great.
As a summary:
This guy found out that most of the GUI is HTML and Javascript. Some of the JS functions are mapped to OS calls, including one that will run any script as root (nativeBridge.dbgCmd();). This function is disabled in the browser, so it needs to be called from somewhere else.
So he injects the function call into the ID3 tag of an MP3 file and plays the file on the native mp3 player which has a html gui for displaying the id3 tag info :)
Finally he uses this exploit to enable ssh and install a certificate so he can connect to it.
Re: Kindle Touch jail broken via ID3 Tag
#5Are you kidding me? They found a XSS hole?! How can you create anything based on HTML and not think about XSS?
It's clear that Amazon did think about XSS -- in the context of the browser. The debugCmd isn't available there. It's also clear that tney didn't think about all the other potential interactions with the system. It's not the things you don't know that bite you -- it's the thing you know that isn't so.
I don't think Amazon has that much of a problem with the jailbreaks. I can't see how they would loose any money with it, and who uses them, knows that he can potentially brick the device.
Re: Kindle Touch jail broken via ID3 Tag
#6tl;dr: Don't play MP3s from untrusted sources until Amazon has a fix. (this is remote code execution, don't let the term "jailbreaking" candy coat it)
Re: Kindle Touch jail broken via ID3 Tag
#7Earlier quoted context omitted.
It's clear that Amazon did think about XSS -- in the context of the browser. The debugCmd isn't available there. It's also clear that tney didn't think about all the other potential interactions with the system. It's not the things you don't know that bite you -- it's the thing you know that isn't so.
I don't think Amazon has that much of a problem with the jailbreaks. I can't see how they would loose any money with it, and who uses them, knows that he can potentially brick the device.
As I see it, Amazon does have an interest in users not jailbreaking or bricking devices. They sell the devices at around cost to sell content. If a user jailbreaks a device, Amazon loses the tight control on where the content comes from, and if a user bricks a device, Amazon sells no content for that device at all.
Re: Kindle Touch jail broken via ID3 Tag
#8Earlier quoted context omitted.
I don't think Amazon has that much of a problem with the jailbreaks. I can't see how they would loose any money with it, and who uses them, knows that he can potentially brick the device.
As I see it, Amazon does have an interest in users not jailbreaking or bricking devices. They sell the devices at around cost to sell content. If a user jailbreaks a device, Amazon loses the tight control on where the content comes from, and if a user bricks a device, Amazon sells no content for that device at all.
In what way have they tight control over the content? You can load whatever you want over usb or wlan on the device.
Re: Kindle Touch jail broken via ID3 Tag
#9Are you kidding me? They found a XSS hole?! How can you create anything based on HTML and not think about XSS?
It's more like XMS really, cross media scripting
Re: Kindle Touch jail broken via ID3 Tag
#10Earlier quoted context omitted.
I don't think Amazon has that much of a problem with the jailbreaks. I can't see how they would loose any money with it, and who uses them, knows that he can potentially brick the device.
As I see it, Amazon does have an interest in users not jailbreaking or bricking devices. They sell the devices at around cost to sell content. If a user jailbreaks a device, Amazon loses the tight control on where the content comes from, and if a user bricks a device, Amazon sells no content for that device at all.
Have you ever used a Kindle? You can put any book on it that is either PDF, mobi and a few other formats.