Hacks for iRex iLiad and Sony Reader round-up

[Alexander Turcic]

Aside the obvious E Ink technology, what makes the iLiad and the Reader similar is the fact that both devices run on Linux. While we are still waiting for iRex and Sony to release SDKs, clever MobileReaders have found their own ways to gain shell access to both devices.

Here is a current round-up of all hacking attempts:

Sony Reader

• Remote read/write access via USB
  Igorsk reverse-engineered the USB communication to the Sony Reader to enable remote read/write access to the device, including making full dumps of flash partitions.
  
  Discussion:
  https://www.mobileread.com/forums/showthread.php?t=8051
  
  
• Executing arbitary shell scripts
  Igorsk (he is our man!) wrote a tool to reflash the Sony Reader with a modified firmware that allows you to run arbitary shell scripts stored on external media.
  
  Discussion:
  https://www.mobileread.com/forums/sho...?threadid=8179

iRex iLiad

• WEP configuration input validation vulnerability (Firmware 2.7)
  Arivero discovered how you can execute arbitrary script code on the iLiad leading to full shell access (I leave the rest to your imagination).
  
  Discussion:
  https://www.mobileread.com/forums/showthread.php?t=8144
  
  
• Open X server port vulnerability (Firmware 2.7)
  Design256 discovered how you can remotely access the X server on the iLiad and do all kinds of interesting things (such as running KDE's Kicker panel).
  
  Discussion:
  https://www.mobileread.com/forums/showthread.php?t=8125
  
  Screenshots:
  Running KDE's Kicker panel
  Browsing the Web
  
  
• Undocumented access to the iRex Delivery Server
  TadW reverse-engineered some of the XML commands to communicate with the iRex Delivery Server (iDS), and I wrote a small PHP script as proof of concept.
  
  Discussion:
  https://www.mobileread.com/forums/showthread.php?t=7812
  
  Screenshot:
  Accessing iDS with PHP

[TadW]

Addition:

Gseryakov began putting down the internals of the Sony Reader in the Wiki: https://wiki.mobileread.com/wiki/Sony_Reader_hack

[CommanderROR]

I guess iRex and Sony will both start working very hard at fixing these "holes" tomorrow...:-)

Maybe it's time the both (but especially iRex) see the light and offer a full-fledged SDK because otherwise the hacking will continue and possibly reveal a lot more than they ever intenede the public to see...

[b_k]

At least the pressure is getting higher to make them actually do something. Other than empty promises.

[tcv]

All these hacks bring up a question for me...

Has anyone ever tried to use the Pepperpad 3 as an ebook reader?

[ath]

Originally Posted by Alexander Turcic

Here is a current round-up of all hacking attempts:

I would like to urge anyone coming up with security hacks on these (and other platforms) to get them 'officially' reported and logged. Most people wanting to find out if there are known security problems with, say, the Sony Reader, would use the main vulnerability databases at www.securityfocus.com, www.secunia.com, nvd.nist.gov or www.osvdb.org, or just the bugtraq mailing list which serves as one of the inputs to securityfocus.

That makes the problems more obvious to the security community at large, and helps increase that pressure to get things right.

[arivero]

Originally Posted by ath

I would like to urge anyone coming up with security hacks on these (and other platforms) to get them 'officially' reported and logged. Most people wanting to find out if there are known security problems with, say, the Sony Reader, would use the main vulnerability databases at www.securityfocus.com, www.secunia.com, nvd.nist.gov or www.osvdb.org, or just the bugtraq mailing list which serves as one of the inputs to securityfocus.

That makes the problems more obvious to the security community at large, and helps increase that pressure to get things right.

The only security-involved hack is the existence of a open Xserver, and even this does not qualify as a security problem if a way to write to the disk is not found, at this moment it is only a partial privacy problem. Moreover, in standard mode, the Xserver display is not showing any text while it is opened.

As for the other hacks, you can not tell that accesing a device from its main console is a security hole, can you?

[design256]

Originally Posted by arivero

The only security-involved hack is the existence of a open Xserver, and even this does not qualify as a security problem if a way to write to the disk is not found, at this moment it is only a partial privacy problem. Moreover, in standard mode, the Xserver display is not showing any text while it is opened.

This could be a serious exploit - in my office, all computers are on the same LAN. Easy to popup a dialog on the manager's Iliad asking for his master username and password, then log the response.

[ath]

Originally Posted by arivero

The only security-involved hack is the existence of a open Xserver, and even this does not qualify as a security problem if a way to write to the disk is not found,

An open X server is always a security problem. It's an oversight in configuration, and where there is one mistake, there are probably more. The severity of it may be high or low -- and also tends to alter over time, and depending on who is affected by it. To the bog-standard iLiad it is probably fairly small right now, but is that true also for that flight-chart reading iLiad, or any other special iLiads in the works?

My concern was, however, more with the Sony Reader - it occurred to me that the ability to read and write files via USB just might make it easier to get round DRM protection.

[igorsk]

Originally Posted by ath

My concern was, however, more with the Sony Reader - it occurred to me that the ability to read and write files via USB just might make it easier to get round DRM protection.

That doesn't matter since it's much simpler to hack the PC software.

[TadW]

Originally Posted by ath

...just might make it easier to get round DRM protection.

Not something we might necessarily want to do. Right?