Maybe I’ve still got the old PS3/PSP-exploit mentality, but reporting an arbitrary code execution vuln to the OEM is kind of sad… that deliberately closes a door for people to use their devices as they see fit.
Of course, the “don’t update after this firmware version” bit would always be the case (since any widely-distributed such vuln will be patched eventually), but deliberately moving the timeline to the left is sad.
This is a very neat and approachable write-up, but is the final result really a hack? If I understand correctly, you're getting an unprivileged shell on a device you own and have paired with your smartphone; more or less equivalent to installing a terminal emulator on your smartphone, except it's smart glasses in this case.
Should the ability to own one's devices really be treated as a vulnerability and reported to security teams?
"hack" on hackernews essentially means "I used my computer to do something". The overwhelming population of people here aren't security engineers, but rather developers.
How is it not a hack to do something on a device that doesn't let you do it? Yes, the device should let you do whatever you want, but it doesn't, therefore this is a hack.
I'm going to try it on my glasses, and disable autoupdating ASAP.
I understand having a locked-down version of mass-produced tech that is for the general consumer. However, I also firmly believe that anyone who wants to should be able to bypass that. Make it void the warranty, don't allow customer support, whatever you want. But make it a free option to have complete control. If I buy a piece of hardware, I should own it.
(I say this as I am currently charging a cheap doorbell camera I bought, so that I can start dumping data from it and reverse engineer its protocol, solely so that I can lock it down to my local network...We needed something at the time, or I would have bought something more expensive that had an open protocol...)
> Make it void the warranty, don't allow customer support, whatever you want.
That would be a regression in terms of consumer rights, in my opinion. I don’t see why the EU shouldn’t legislate such that the right to control owned hardware becomes fundamental.
I am a proponent of giving users an option to root their devices through a one-way process that would surrender warranty coverage and print a big safety warning at every boot.
The problem with allowing easy shell access is that any arbitrary command execution would be used by exploits, too. There are also a lot of social engineering schemes that bait users into running commands on devices. We don’t think about these risks as engineers, but you wouldn’t believe how many people will follow instructions to open something like the Chrome developer console and paste code blocks into it because some website told them to.
So a secure device is also a locked down device. Getting a shell is a vulnerability because it’s the avenue that exploits would use.
That’s why I’d be in favor of a one-way developer mode, which provided shell access but printed a big unavoidable warning screen in the boot loader.
Unfortunately, it’s not that simple. Asking people to give up their warrant isn’t legal, generally, so outside of very specific circumstances you have to cover warranty claims on the device, too. I have worked at companies that tried to offer some developer access like this, and the number of people abusing customer service because they got in over their heads with modifications and wanted a fresh unit or want CS to support their mods would make you face palm. So the compromises end up being things like only allowing ephemeral mods that get wiped at each reboot and other default-safe behaviors, but that doesn’t make people happy either.
Of course, the “don’t update after this firmware version” bit would always be the case (since any widely-distributed such vuln will be patched eventually), but deliberately moving the timeline to the left is sad.
Should the ability to own one's devices really be treated as a vulnerability and reported to security teams?
https://en.wiktionary.org/wiki/hack
I'm going to try it on my glasses, and disable autoupdating ASAP.
(I say this as I am currently charging a cheap doorbell camera I bought, so that I can start dumping data from it and reverse engineer its protocol, solely so that I can lock it down to my local network...We needed something at the time, or I would have bought something more expensive that had an open protocol...)
That would be a regression in terms of consumer rights, in my opinion. I don’t see why the EU shouldn’t legislate such that the right to control owned hardware becomes fundamental.
The problem with allowing easy shell access is that any arbitrary command execution would be used by exploits, too. There are also a lot of social engineering schemes that bait users into running commands on devices. We don’t think about these risks as engineers, but you wouldn’t believe how many people will follow instructions to open something like the Chrome developer console and paste code blocks into it because some website told them to.
So a secure device is also a locked down device. Getting a shell is a vulnerability because it’s the avenue that exploits would use.
That’s why I’d be in favor of a one-way developer mode, which provided shell access but printed a big unavoidable warning screen in the boot loader.
Unfortunately, it’s not that simple. Asking people to give up their warrant isn’t legal, generally, so outside of very specific circumstances you have to cover warranty claims on the device, too. I have worked at companies that tried to offer some developer access like this, and the number of people abusing customer service because they got in over their heads with modifications and wanted a fresh unit or want CS to support their mods would make you face palm. So the compromises end up being things like only allowing ephemeral mods that get wiped at each reboot and other default-safe behaviors, but that doesn’t make people happy either.