BackDoorLock hack - prevents silent updates - Page 17

guerrilla · 02-10-2016, 09:46 AM

I'm sorry knc1 I'm not a native english speaker so I'm not sure I get what you're suggesting.
When you say it's advisable to update to 5.7.2 because it disables the JB vector in 5.6.5, you mean that it patches a security issue that may be maliciously exploited?
In fact I'm still using 5.4.5.1 'cause I'm reluctant to give up the opportunity to downgrade, which was the case with 5.6.5 even if the jb survived the upgrade.
I take the case is the same with 5.7.2, so is there anything wrong if I stay with 5.4.5.1?
I read all my ebooks in koreader and, as long as the native reader won't be equally flexible, I don't see the point of making irreversible changes. Could I go back if needed I would give it a try.

knc1 · 02-10-2016, 09:49 AM

Quote:

Originally Posted by guerrilla

I'm sorry knc1 I'm not a native english speaker so I'm not sure I get what you're suggesting.
When you say it's advisable to update to 5.7.2 because it disables the JB vector in 5.6.5, you mean that it patches a security issue that may be maliciously exploited?

In fact I'm still using 5.4.5.1 'cause I'm reluctant to give up the opportunity to downgrade, which was the case with 5.6.5 even if the jb survived the upgrade.
I take the case is the same with 5.7.2, so is there anything wrong if I stay with 5.4.5.1?

I read all my ebooks in koreader and, as long as the native reader won't be equally flexible, I don't see the point of making irreversible changes. Could I go back if needed I would give it a try.

Yes.

Stay with 5.4.5.1 if you wish.

Stay tuned (subscribed) to my 'downgrade from 5.7.2' thread.
We may have news on that subject in the near future.

guerrilla · 02-10-2016, 09:53 AM

Quote:

Originally Posted by knc1

Yes.

Stay with 5.4.5.1 if you wish.

Stay tuned (subscribed) to my 'downgrade from 5.7.2' thread.
We may have news on that subject in the near future.

That's great news, thanks!

nixkalo · 02-10-2016, 05:19 PM

@knc1: Are we positively sure that the security hole is closed 5.7.2?
Or did they just remove ;fc-cache so that the security hole couldn't be used in a Jailbreak?

As a side note: I already created the file mentioned in my previous post (and did a chmod 000 for extra security). If someone who doesn't mind going to 5.7.2 (or has serial interface and can go easily go back to 5.6.5) wants to test it, I'd prefer it. Otherwise, please PM me when OTA is hitting and I'll test the effectiveness and report it here

BR,
Nix

knc1 · 02-10-2016, 06:18 PM

Quote:

Originally Posted by nixkalo

@knc1: Are we positively sure that the security hole is closed 5.7.2?
Or did they just remove ;fc-cache so that the security hole couldn't be used in a Jailbreak?
- - - -

You have been reading my day #1 posts.

When I have a chance to get away from this keyboard, I'll let every know what I find.
(Although just looking at the 5.7.2 source code bundle vs an earlier firmware source code bundle would be the quick and easy place to start - expect to find a much newer version of webkit in 5.7.2 if anything is 'fixed' rather than just 'hidden again'.)

nixkalo · 02-10-2016, 06:56 PM

Quote:

Originally Posted by knc1

You have been reading my day #1 posts.

(Although just looking at the 5.7.2 source code bundle vs an earlier firmware source code bundle would be the quick and easy place to start - expect to find a much newer version of webkit in 5.7.2 if anything is 'fixed' rather than just 'hidden again'.)

I checked by myself and I guess that they probably closed the hole for real (RenderArena).

Nix

odamizu · 02-10-2016, 08:08 PM

Quote:

Originally Posted by odamizu

Is it at all useful to you developers for me to continue this experiment [seeing if update.bin.tmp.partial folder blocks OTA updates]?

Quote:

Originally Posted by knc1

Yes.
A lot of people would like to know if this method works on 5.6.5 ...

Okay, I will continue the experiment for now, though I may be tempted to update manually once this next update rolls out

knc1 · 02-11-2016, 08:17 AM

Quote:

Originally Posted by odamizu

Okay, I will continue the experiment for now, though I may be tempted to update manually once this next update rolls out

Let us hope that they (Amazon/Lab126) changes the firmware version when they fix that font.

On at least one occasion in the past, they updated the firmware but did not change the version number (just the build identifier).

odamizu · 02-12-2016, 12:22 PM

Seriously? That is so wrong

Fortunately, the new update is 5.7.2.1

I do want to update, but I can hold off to see if an OTA update gets past the update.bin.tmp.partial folder.

How long do you think I should give it before we can call update.bin.tmp.partial a success?

knc1 · 02-12-2016, 12:28 PM

Quote:

Originally Posted by odamizu

Seriously? That is so wrong

Fortunately, the new update is 5.7.2.1

I do want to update, but I can hold off to see if an OTA update gets past the update.bin.tmp.partial folder.

How long do you think I should give it before we can call update.bin.tmp.partial a success?

We almost always hear when people start getting an OTA update (it usually either breaks things or takes them by surprise).

Meanwhile, I will see if I can find out anything by looking into the OTA updater firmware myself.
(I did, finally, after nearly 7 months, get my PW-3 put back together. But my KT-2 is still a pile of parts on the workbench.

)

more · 02-12-2016, 01:54 PM

Hi, is now there a crack or something else, that makes OTA impossible? I have PW2 (5.6.5) with jailbreak and I would like that it stays like it is.

Thanks.

knc1 · 02-12-2016, 02:33 PM

What do you mean by: 'a crack' ?

Keep it in airplane mode until another way is confirmed to work.

more · 02-12-2016, 05:39 PM

OK, that is what I wanted to know. A confirmed way

more · 02-23-2016, 02:30 PM

Quote:

Originally Posted by knc1

What do you mean by: 'a crack' ?

Keep it in airplane mode until another way is confirmed to work.

The last time I asked is about 10 days. Is at the moment a possbility to block OTA Updates from Amazon?

I still have 5.6.5 with jailbreak and other nice things, and dont want a upgrade to 5.7... So at the moment I cant go online, because Amazon will force this update, that I dont want.

odamizu · 02-24-2016, 12:15 PM

I have had "update.bin.tmp.partial" folder in root directory with WiFi continuously on for over 12 days, and no OTA update. I even left it plugged into a/c with WiFi on for 48 hours.

Don't know if "update.bin.tmp.partial" folder is blocking updates or if Amazon just hasn't gotten to my Voyage yet since it can take weeks (months?) for an OTA update to roll-out. YMMV

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Prevents ZIPs from becoming CBZs	wladdy	Calibre	3	03-01-2014 02:38 PM
BackDoorLock	slantybard	Kindle Developer's Corner	6	12-08-2013 02:50 PM
Kual y backdoorlock	adegir1952	Amazon Kindle	3	06-14-2013 09:44 AM
Updates Provider hack	dsmid	Kindle Developer's Corner	51	05-08-2012 11:51 PM
Request: Silent updates.	fabian	Calibre	5	03-15-2011 11:34 AM

02-10-2016, 09:46 AM	#241
guerrilla Connoisseur Posts: 68 Karma: 10 Join Date: Dec 2014 Device: Kindle Paperwhite	I'm sorry knc1 I'm not a native english speaker so I'm not sure I get what you're suggesting. When you say it's advisable to update to 5.7.2 because it disables the JB vector in 5.6.5, you mean that it patches a security issue that may be maliciously exploited? In fact I'm still using 5.4.5.1 'cause I'm reluctant to give up the opportunity to downgrade, which was the case with 5.6.5 even if the jb survived the upgrade. I take the case is the same with 5.7.2, so is there anything wrong if I stay with 5.4.5.1? I read all my ebooks in koreader and, as long as the native reader won't be equally flexible, I don't see the point of making irreversible changes. Could I go back if needed I would give it a try.

02-10-2016, 05:19 PM	#244
nixkalo Member Posts: 21 Karma: 10052 Join Date: Aug 2009 Device: hanlin V3, K4NT, PW3	@knc1: Are we positively sure that the security hole is closed 5.7.2? Or did they just remove ;fc-cache so that the security hole couldn't be used in a Jailbreak? As a side note: I already created the file mentioned in my previous post (and did a chmod 000 for extra security). If someone who doesn't mind going to 5.7.2 (or has serial interface and can go easily go back to 5.6.5) wants to test it, I'd prefer it. Otherwise, please PM me when OTA is hitting and I'll test the effectiveness and report it here BR, Nix

02-12-2016, 12:22 PM	#249
odamizu just an egg Posts: 1,597 Karma: 4798866 Join Date: Mar 2015 Device: Kindle, iOS	Seriously? That is so wrong Fortunately, the new update is 5.7.2.1 I do want to update, but I can hold off to see if an OTA update gets past the update.bin.tmp.partial folder. How long do you think I should give it before we can call update.bin.tmp.partial a success?

02-12-2016, 01:54 PM	#251
more Member Posts: 18 Karma: 10 Join Date: Mar 2014 Device: Kobo forma	Hi, is now there a crack or something else, that makes OTA impossible? I have PW2 (5.6.5) with jailbreak and I would like that it stays like it is. Thanks.

02-12-2016, 02:33 PM	#252
knc1 Going Viral Posts: 17,212 Karma: 18210809 Join Date: Feb 2012 Location: Central Texas Device: No K1, PW2, KV, KOA	What do you mean by: 'a crack' ? Keep it in airplane mode until another way is confirmed to work.

02-12-2016, 05:39 PM	#253
more Member Posts: 18 Karma: 10 Join Date: Mar 2014 Device: Kobo forma	OK, that is what I wanted to know. A confirmed way

02-24-2016, 12:15 PM	#255
odamizu just an egg Posts: 1,597 Karma: 4798866 Join Date: Mar 2015 Device: Kindle, iOS	I have had "update.bin.tmp.partial" folder in root directory with WiFi continuously on for over 12 days, and no OTA update. I even left it plugged into a/c with WiFi on for 48 hours. Don't know if "update.bin.tmp.partial" folder is blocking updates or if Amazon just hasn't gotten to my Voyage yet since it can take weeks (months?) for an OTA update to roll-out. YMMV

Advert

Advert