5.6.5 Jailbreak (closed-kindle) -- released! - Page 11

knc1 · 10-19-2015, 06:26 PM

Quote:

Originally Posted by Branch Delay

Contacted Amazon trying to see if they have any sort of estimated date on if/when they are targeting a patch. Guessing they won't tell me anything, but I'll keep everyone up to date.

since it affects millions of consumer devices -
perhaps its time to notify CVE:
https://cve.mitre.org/
Hmm...
What seems to be the HowTo page:
https://cve.mitre.org/cve/request_id.html

that would wake up Amazon/Lab126

Barty · 10-19-2015, 11:43 PM

Congrats to Branch Delay and many many many thanks.

I almost wish you'd kept this secret until the end of the year -- just in case Amazon releases a Voyage 2 in '15

latepaul · 10-20-2015, 03:37 AM

Quote:

Originally Posted by Barty

Congrats to Branch Delay and many many many thanks.

I almost wish you'd kept this secret until the end of the year -- just in case Amazon releases a Voyage 2 in '15

That's a good point. If they are working on a new model Kindle - and it's the right time of year for it - then they usually make software improvements at the same time. Which could mean that their software team is very busy. And whilst they should prioritize security bugs they may be more focussed on new features for the next firmware.

Noexpert · 10-20-2015, 03:52 AM

Dear Sir/Madam,
I am writing to you to let you know that we now believe that the importance of this exploit has been over-estimated*. To correct an over-site on our part, and for your records, the CVE have now been informed of this potential issue. As circumstances have now changed, this information will have a limited public release on 31st October 2015. Kind regards

* Over-estimated; as in, no fix hour/days/weeks. So, can't be serious surely

- Receive a quick informative reply ... OK.
- No reply ... 31st October it is.

thatworkshop · 10-20-2015, 12:16 PM

Quote:

Originally Posted by Barty

Congrats to Branch Delay and many many many thanks.

I almost wish you'd kept this secret until the end of the year -- just in case Amazon releases a Voyage 2 in '15

Well, come on! In this way, you have to wait forever and forever... As every few months new shiny gadgets and ereaders come out, this becomes and endless wish. Next year, another vulnerability comes and someone might say oh I wish you could have waited till Voyage 3 has been produced and marketed.

Just Do It. Just Read, Hack etc. and Enjoy.

stupidhaiku · 10-20-2015, 02:20 PM

Quote:

Originally Posted by Branch Delay

Contacted Amazon trying to see if they have any sort of estimated date on if/when they are targeting a patch. Guessing they won't tell me anything, but I'll keep everyone up to date.

We appreciate your efforts!

knc1 · 10-20-2015, 02:25 PM

Quote:

Originally Posted by Barty

Congrats to Branch Delay and many many many thanks.

I almost wish you'd kept this secret until the end of the year -- just in case Amazon releases a Voyage 2 in '15

If they do - it is already too late to make changes in the firmware that is being installed at the factory.

Trivia, for the non-technicians here - -
The firmware is loaded into the flash device **before** it is soldered to the board.
(At least the u-boot and diags system is.)

eschwartz · 10-20-2015, 02:52 PM

Moderator Notice

Snarkitude by non-Kindle users about the ethics of proper disclosure of 0day exploits is not constructive, and has been deleted per my previous warning.

Slusho64 · 10-21-2015, 01:49 PM

Sorry if this has been stated (I tried searching), but what is the maximum amount of time you'll give them to issue an update before releasing the jailbreak?

Branch Delay · 10-21-2015, 02:23 PM

Honestly, no idea. Currently waiting on a response from them then hopefully I'll generate some sort of timeline.

Natesroom · 10-21-2015, 03:09 PM

I'm still Mile High waiting for the ability to land this puppy!

Slusho64 · 10-21-2015, 11:53 PM

Okay. The reason I ask is that it seems that without a date set, they have less of an incentive to work quickly on it, and we could be waiting forever.

knc1 · 10-22-2015, 04:04 AM

Quote:

Originally Posted by Slusho64

Okay. The reason I ask is that it seems that without a date set, they have less of an incentive to work quickly on it, and we could be waiting forever.

Individuals threatening a billion dollar corporation is usually a poor strategy.
Your more likely to stay dry, pissing into the wind, than sway a large corporation with threats.

We are not waiting until they issue a fix,
we are waiting a "reasonable length of time" (in the author's judgement as to what is "reasonable").

thatworkshop · 10-22-2015, 10:49 AM

Quote:

Originally Posted by knc1

Your more likely to stay dry, pissing into the wind, than sway a large corporation with threats.

I normally don't post just to appraise, but couldn't help this time:

This is priceless, M. Well said, well said.

In all seriousness, has anyone actually tried this? It's so much fun.

[Just to change the focus from people posting and increasing burden on OP.]

shalym · 10-22-2015, 10:53 AM

Quote:

Originally Posted by idoit

I normally don't post just to appraise, but couldn't help this time:

This is priceless, M. Well said, well said.

In all seriousness, has anyone actually tried this? It's so much fun.

[Just to change the focus from people posting and increasing burden on OP.]

Tried what? Pissing into the wind? I think you have a much different definition of "fun" than I do...

Shari

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
KINDLE DEAL: Released: A Story of God’s Power Released in Pro Baseball ($	gospelebooks	Deals and Resources (No Self-Promotion or Affiliate Links)	0	07-14-2011 09:12 PM
iPad iPad jailbreak released	scottjl	Apple Devices	25	05-08-2010 02:20 PM

10-19-2015, 11:43 PM	#152
Barty doofus Posts: 2,551 Karma: 13089041 Join Date: Sep 2010 Device: Kobo Libra 2, Kindle Voyage	Congrats to Branch Delay and many many many thanks. I almost wish you'd kept this secret until the end of the year -- just in case Amazon releases a Voyage 2 in '15

10-20-2015, 03:52 AM	#154
Noexpert As Above Posts: 10 Karma: 10 Join Date: Mar 2014 Location: Britannia Device: PW2 & PW3	Dear Sir/Madam, I am writing to you to let you know that we now believe that the importance of this exploit has been over-estimated. To correct an over-site on our part, and for your records, the CVE have now been informed of this potential issue. As circumstances have now changed, this information will have a limited public release on 31st October 2015. Kind regards Over-estimated; as in, no fix hour/days/weeks. So, can't be serious surely - Receive a quick informative reply ... OK. - No reply ... 31st October it is.

10-20-2015, 02:52 PM	#158
eschwartz Ex-Helpdesk Junkie Posts: 19,421 Karma: 85400180 Join Date: Nov 2012 Location: The Beaten Path, USA, Roundworld, This Side of Infinity Device: Kindle Touch fw5.3.7 (Wifi only)	Moderator Notice Snarkitude by non-Kindle users about the ethics of proper disclosure of 0day exploits is not constructive, and has been deleted per my previous warning.

10-21-2015, 01:49 PM	#159
Slusho64 Member Posts: 17 Karma: 10 Join Date: Oct 2010 Device: Kindle 3 3G	Sorry if this has been stated (I tried searching), but what is the maximum amount of time you'll give them to issue an update before releasing the jailbreak?

10-21-2015, 02:23 PM	#160
Branch Delay Connoisseur Posts: 95 Karma: 1699999 Join Date: Aug 2015 Device: Voyage	Honestly, no idea. Currently waiting on a response from them then hopefully I'll generate some sort of timeline.

10-21-2015, 03:09 PM	#161
Natesroom Junior Member Posts: 2 Karma: 10 Join Date: Oct 2015 Device: PW2 9017 2201	I'm still Mile High waiting for the ability to land this puppy!

10-21-2015, 11:53 PM	#162
Slusho64 Member Posts: 17 Karma: 10 Join Date: Oct 2010 Device: Kindle 3 3G	Okay. The reason I ask is that it seems that without a date set, they have less of an incentive to work quickly on it, and we could be waiting forever.