{"id":6240,"date":"2013-08-03T06:05:05","date_gmt":"2013-08-03T13:05:05","guid":{"rendered":"http:\/\/www.infosecurity.pro\/?p=6240"},"modified":"2019-04-20T16:24:37","modified_gmt":"2019-04-20T16:24:37","slug":"chromecast-exploit-package-spawns-a-root-shell-on-port-23","status":"publish","type":"post","link":"https:\/\/www.infosecurity.pro\/?p=6240","title":{"rendered":"Chromecast exploit package spawns a root shell on port 23"},"content":{"rendered":"

\t\t\t\tGTVHacker has stated<\/a>:<\/span><\/p>\n\n\n\n\n

\n\n\n

How does the exploit work?<\/span><\/p>\n\n\n\n\n

Lucky for us, Google was kind enough to GPL the bootloader source code for the device. So we can identify the exact flaw that allows us to boot the unsigned kernel. By holding down the single button, while powering the device, the Chromecast boots into USB boot mode. USB boot mode looks for a signed image at 0×1000 on the USB drive. When found, the image is passed to the internal crypto hardware to be verified, but after this process the return code is never checked! Therefore, we can execute any code at will.<\/span><\/p>\n\n\n\n\n

ret = VerifyImage((unsigned int)k_buff, cpu_img_siz, (unsigned int)k_buff);<\/span><\/p>\n\n\n<\/blockquote>\n\n\n\n\n

\n\n\n

The example above shows the call made to verify the image, the value stored in ret is never actually verified to ensure that the call to “VerifyImage” succeeded. From that, we are able to execute our own kernel.<\/span><\/p>\n\n\n<\/blockquote>\n\n\n\n\n

If you are in Vegas for DEF CON 21, check out – “<\/a><\/span>Google TV: Or How I Learned to Stop Worrying and Exploit Secure Boot<\/span><\/a>”<\/a> by GTVHacker this Friday, August 2nd, at 3PM in the Penn and Teller Theater!<\/span><\/p>\n\n\n\n\n

\n