It's an exploit and it will get fixed, but I'd like to see what people can do with root access. Will we see vanilla Android ports?
On the e-ink screen? I don't think that will turn out too well.
Kindle Touch jail broken via ID3 Tag
21–30 of 36 posts
Re: Kindle Touch jail broken via ID3 Tag
#22It's an exploit and it will get fixed, but I'd like to see what people can do with root access. Will we see vanilla Android ports?
Kindle Touch doesn't run Android. You are thinking of the Fire.
Re: Kindle Touch jail broken via ID3 Tag
#23Earlier quoted context omitted.
Have you ever used a Kindle? You can put any book on it that is either PDF, mobi and a few other formats.
Yes, I do use a Kindle. All content I read on it was from Amazon. I know I can get content from somewhere else, but it will never be as convenient as getting it from Amazon.
Erm. I have a Kindle DX, and if I download a PDF or Mobi, I can copy and paste it into the Kindle when it's connected.
It's only a few more seconds than an Amazon buy.
Re: Kindle Touch jail broken via ID3 Tag
#24Re: Kindle Touch jail broken via ID3 Tag
#25FWIW, I noticed some images loading in the description overlay in a podcast I was listening to on my iPhone. So, it looks like iOS devices render HTML content in ID3 tags.
I've been meaning to explore whether they run JavaScript too but haven't gotten around to it yet.
Re: Kindle Touch jail broken via ID3 Tag
#26tl;dr: Don't play MP3s from untrusted sources until Amazon has a fix. (this is remote code execution, don't let the term "jailbreaking" candy coat it)
I believe this is technically local code execution, not remote. It's not like you can do this unless you have access to the device (the browser apparently doesn't allow it, and I can't imagine you can remotely make the device play an MP3).
Re: Kindle Touch jail broken via ID3 Tag
#27It's an exploit and it will get fixed, but I'd like to see what people can do with root access. Will we see vanilla Android ports?
Kindle Touch doesn't run Android. You are thinking of the Fire.
Oh boy, you're right. I replaced the word "Touch" with "Fire" in my mind while reading the article and didn't notice even once. My apologies.
Re: Kindle Touch jail broken via ID3 Tag
#28tl;dr: Don't play MP3s from untrusted sources until Amazon has a fix. (this is remote code execution, don't let the term "jailbreaking" candy coat it)
I believe this is technically local code execution, not remote. It's not like you can do this unless you have access to the device (the browser apparently doesn't allow it, and I can't imagine you can remotely make the device play an MP3).
From what I understood you can download a song thinking its new hottest club hit and have your Kindle bricked.
Re: Kindle Touch jail broken via ID3 Tag
#29Earlier quoted context omitted.
I believe this is technically local code execution, not remote. It's not like you can do this unless you have access to the device (the browser apparently doesn't allow it, and I can't imagine you can remotely make the device play an MP3).
From what I understood you can download a song thinking its new hottest club hit and have your Kindle bricked.
Assuming arbitrary code can brick it, yes. That is my impression. That's still not "remote" though.
Re: Kindle Touch jail broken via ID3 Tag
#30That's great. As a summary: This guy found out that most of the GUI is HTML and Javascript. Some of the JS functions are mapped to OS calls, including one that will run any script as root (nativeBridge.dbgCmd();). This function is disabled in the browser, so it needs to be called from somewhere else. So he injects the function call into the ID3 tag of an MP3 file and plays the file on the native mp3 player which has…
What a great, simple (not to diminish in any way), hack.
Why did Amazon allow a call that always runs as root?
Is it necessity, oversight, or something else?