Slashdot Mirror
Archos 605 WiFi Hacked
Nathan Ramella writes "The ARCwelder project has released a technique dubbed 'Go Fighting Tabby!' which exploits an unquoted system() call through the Archos UI, providing the ability to execute arbitrary code with root access on the Archos 605 WiFi. In doing so, opening the platform up for further hacking. The Archos 605 WiFi runs embedded Linux on an ARM processor, but employs a variety of anti-hack techniques to keep users from modifying its firmware and operating system. Included is a cross-compiled sshd with configuration files to allow for passwordless ssh access to the Archos when it is connected to a WiFi connection. Bricks ahoy!"
Not trying to be flippant here, but I've never heard of this Archos gadget and don't, after a cursory examination, understand why I'd prefer this thing to, say, a Nokia Maemo-based doodad like the N800 or N810? Same screen resolution, wifi, etc - ok, no internal hard drive - and I don't have to jailbreak it to load custom apps.
Why wouldn't I want to support the company not going out of its way to make my life difficult if custom apps were what I were after?
-Isaac
I am not a lawyer, and this is not legal advice. For Entertainment Purposes Only.
Pure speculation here: that could be a requirement from some other company which makes drivers for some of its parts. They could want hackers kept out of the device in order to minimize the risk of having their drivers reverse engineered through sniffing or other methods.
Unfortunately, in the embedded market there's a still enormous load of companies that can't make money if they can't be the only one entity on this planet to be able to sell a driver for some piece of hardware.
These devices are mini COMPUTERS! If your MP3 player has screen or WiFi then it's obvious it can do more. It's more common that embedded devices just use a processing chip to do all their functions - no more paying for an MP3 decoder chip, MPEG decoder chip, etc. This makes it "easy" to do so much more with them. SO LET US DAMN IT.
Example: The DS. It should have come with a browser from day one. It's freaking obvious with the two screens. Top screen is for reading and the bottom is to move the magnifying glass around the page.
If someone who you don't have to pay wants to expand the market for your device why the hell would you stop them?
The only reason I bought an Xbox 1 was to play videos over my LAN. Of course, I can also play pirated games on it. This is a legit reason a company would want to lock down their hardward. However that is of no concern to Archos -
they don't SHOULDN'T care what the heck people do with their products as long as they buy them.
> a vain attempt at slashdoting the minicities which encourages them even more
I would think that it would be possible to try to DDoS the servers themselves by accessing URLs which seem OK but actually don't exist (e.g., take a link to a real myminicity and change the name of the city to a different random string each time). Of course, if the company running the servers is unscrupulous, it could always return ads for what should be 404's. But at the very least, attacking in this way doesn't encourage link spamming from people running the cities. And eventually one could hope that the people paying them for serving the ads would rebel.
This is of course just academic speculation, actually making such an application, or even encouraging people to access such URLs, might be against the law in the jurisdiction where you live, and I am not recommending that anyone break the law..... of course!
I'd ask that someone should work up an application like that (anonymously, of course) and post a link to it here, but then a clever myminicity geek could just spoof us with an application that actually accesses his real myminicity. Actually I'd guess it could be worked up in a few lines in Python which most knowledgeable Slashdot users could verify for themselves...
A totally different way to try to combat would be to choose a random city, access it to obtain the ads, and then click on each ad to find out who is paying for this c**p and then send them email explaining that they are financing link spammers and you are adding them to a list of companies to boycott for financing link spamming by advertising at myminicity.com. To be effective, the list should actually exist and be as widely published as possible.
IIRC, they have previously announced plans to sell added codec support (for instance, I have one of their earlier models and I can play almost any divx/xvid file I download off the internet -- provided they have mp3 audio -- those with AAC audio give me no sound) and that sort of thing. If people start implementing new codecs and making this thing compatabile with more types of media files than it already is, that's one less revenue stream for archos.
While I don't like this approach, it is understandable and I love my archos quite a bit so I'm willing to overlook it. Heck, if they'd give me the option of playing AAC on *my* model I'd shell out the extra cash for it.
How many closed-source routers and similar devices have similar vulnerabilities?
How many of these vulnerabilities are known only to black-hats?
The nice thing about open source is that both black- and white-hats will find the bugs sooner, and the time interval that the bug is exploitable and unpatched is likely to be shorter.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Ditto.
... September 3rd. In November, I bought one at the local store because I was fed up with the whole thing. Funny thing, the first replacement and the one I got from the store had dead pixels. Luckily, its replacement and the exchange I did in store were dead pixel free.
I have an AV420, which I bought after work bought the AV300. That was a really nice unit.
I bought a 704Wifi, which is nice because of its large screen, but I had to take it back twice because the LCD screen had dead pixels on it. Irritating ones, at that. Good thing I bought the damn thing on sale - when they were at their original price, a defect like that would be inexcusable. Spend half a grand, get a screen with dots all over it. And Archos RMA won't touch it because you need at least *4* pixels. 2 sub-pixels don't count, they have to be 4 discrete pixels. Granted, it's an 800x480 screen, but still.
I bought a 605, and that thing has been a disaster. The first unit was Dead on Arrival, and because local stores didn't have it, I bought it online. It took a month to arrive! (Dead). It took two more months to get it exchanged. And the replacement unit died after two days (I sorta expected it - the replacement unit's hard drive buzzed ever so horribly). I did the RMA and its replacement arrived just before Christmas, when I placed the order
Awful, just awful quality. And it looks like you have to "baby" the unit just to avoid breaking the hard disk. And the LCD isn't as vibrant or rich as even the iPod. Or Zune. The touchscreen doesn't help but as we see from the iPod Touch, iPhone, Samsung's touchscreen ones, it's possible to have a nice display with a touchscreen. And yes, you still need 4 pixels nonfunctional to get an RMA based on the screen.
Archos also managed to put in a bunch of ads in the 605. First time you plug in USB, if you click "Charge only", it prompts you to buy the DVR Dock where it can charge faster. If you access the Web icon, it says you need to buy the Web plug-in. Ditto with videos or audio encoded with MPEG2, H.264 (MPEG-4 AVC), AAC, or AC-3. It'll bug you to buy another plug in. (Total cost for plugins - $70). Click "Recorder", and you get another ad for either the DVR dock, or portable dock (with necessary "buy" links). To their credit, they include a "Never bug me about this again". But still... rather than disable the functionality, they just use to to eke a few more dollars from you.
And yes, I have two of those things. The one I bought retail, and the RMA'd one. Only thing I can say, is the RMA was a brand new unit. Maybe I'll have some fun with this hack.
Also, the hard drive is locked by the bootloader - unless you can JTAG it, there's no way to fix it.
Recommendations - buy it retail - not online. Or you'll regret it as there's a very good chance your expensive purchase has defects that you can't exchange or RMA. Also, buy the extended warranty - if you so much as move it when it's spinning, it may start clicking and die spontaneously. Treating it like an iPod, you won't - jerk it around and your hard disk will die from bad sectors. (Unlike