“Alexa, what’s my wifi password?”
Amazon is well-known for its “echo” gadgets. Launched in 2014, these voice assistants have been used to work together with amazon’s companies, reply questions and stream music. As time went on the gadgets grew in reputation; as of 2023 they account for 21.7% of worldwide sensible speaker purchases. There have been a number of notable makes an attempt to run customized software program on echo gadgets, resembling this undertaking, nevertheless they’ve confirmed to be comparatively safe. With so many gadgets in use, a weaponised echo system might be a really harmful instrument, permitting eavesdropping on delicate dialog and giving false resonses, or on this case, extracting delicate data resembling wifi passwords. Extra trendy gadgets from the corporate run fireOS, Amazon’s modified model of Android, on a MediaTek CPU. That is attention-grabbing, because it means each the {hardware} and software program are just like that discovered on Amazon Fireplace tablets. I’ve been experimenting with an echo dot 2nd technology, which makes use of a MT8163 processor discovered within the HD 8 from 2018. This fireplace pill was rooted utilizing an exploit often called amonet, which implies it was doable to port this exploit to the echo.
Exploiting the processor: you possibly can too!
After a number of minor modifications, I managed to make the principle amonet script dump the contents of the storage(eMMC flash reminiscence). The modified model could be discovered here, and a graphical model is offered here. The reminiscence could be dumped when the system is in bootrom mode, which could be compelled by inserting a chunk of tin foil to brief the capacitor proven beneath to the RF defend, which briefly prevents it from having the ability to boot. For an in depth disassembly information please examine ifixit.
As soon as I had the filesystem, I started to analyse its contents, and what I discovered was very attention-grabbing. It appeared to make use of a instrument known as wpa_supplicant to handle its wi-fi connections, which isn’t unusual on older android variations. When utilizing this instrument, it’s good apply to hash the password for the wi-fi community earlier than storing it within the configuration file (encrypt it in a means that can not be reversed). This may be achieved with one easy command (wpa_passphrase), nevertheless, amazon’s inside group lab126 (who develops their shopper {hardware}), selected to not use this. It might not appear to be a major determination, nevertheless when you think about that anybody with bodily entry to an amazon system utilizing this weak processor (it’s also utilized by a number of echo present gadgets) can extract community passwords with relative ease.
What does this imply?
Storing passwords in plain textual content is a significant safety danger in motels or companies utilizing the gadgets on their inside or non-public wi-fi networks, giving any potential attackers entry to another gear on this community or permitting them to create a rogue community and redirect site visitors or conduct a MITM (man-in-the-middle) assault. It might additionally breach the Data Protection Act which states buyer knowledge have to be ‘dealt with in a means that ensures acceptable safety’. Hashing passwords is an business commonplace, and for an organization that has bought their {hardware} to thousands and thousands, it’s utterly unacceptable to not encrypt this knowledge. Nevertheless it will get even worse. A plain-text configuration file positioned in /system/and so on contains API keys for spotify zeroconf and eSDK APIs, if accessed these might permit anyone to play audio from the system and doubtlessly ship audio to faux a notification or alert.
Modifications
As for booting modified software program, it’s tough however not unattainable. Sadly, I bricked my echo by carelessly flashing the fallacious file, however not earlier than discovering some helpful data. All mediatek gadgets use one thing known as a preloader. It’s primarily a loader for the bootloader, a really low degree piece of software program that runs on the cpu every boot. If anyone efficiently patches the preloader to bypass checks of the mediatek ‘little kernel’ (lk) and ‘unlock_code’, we will write zeros to the beginning of the preloader and boot from the patched model. Nevertheless, this might imply utilizing a pc each time you boot your echo. Because the system runs fireOS, the command fastboot oem flags fos_flags:0x80 ought to work to disable dm-verity, which is used to confirm the integrity of android photos and permit us to run unsigned code. This could be very critical as it might permit gadgets to be modified to ship knowledge to an attacker as an alternative of amazon.
Conclusion
In abstract, while some features of the echo dot are very safe they don’t seem to be proof against tampering and modification, and show an excessive lack of safety with regards to password storage. When designing embedded {hardware}, it’s important to contemplate bodily safety, and I hope that we will deliver this subject to Amazon’s consideration and discover a permenant answer to stop any safety breaches.
EDIT
(1.4.2023): Above, I said that hashing passwords was an business commonplace. As others have identified, while it’s good apply, not all gadgets implement it. Additionally, the hashes can be utilized to hook up with a community similar to a plain textual content password, so hashing the wpa key just isn’t an answer. Maybe encrypting the passwords in a proprietary format can be acceptable, however even then it’s decryptable.