Bug In Android Passes Keystrokes To Root Shell

pasokon writes "ZDNet reports on an Android bug in T-Mobile G1s with early versions of the firmware: 'When the phone booted it started up a command shell as root and sent every keystroke you ever typed on the keyboard from then on to that shell. Thus every word you typed, in addition to going to the foreground application would be silently and invisibly interpreted as a command and executed with superuser privileges. ... open the keyboard tray on your G1, ignore anything you see on the screen, and type these 8 keystrokes: (enter)-r-e-b-o-o-t-(enter). Poof, your phone will reboot.'"

This is simply mind-boggling.

[jcr (53032)]

I can't imagine how or why anyone could accidentally pipe all user input through a root shell. This is one for the WTF of the decade.

-jcr

Re:This is simply mind-boggling.

[Otto (17870)]

Read this:
http://android.jim.sh/index.php/ConsoleShell [android.jim.sh]

Looks like debugging code left behind...

Re:This is simply mind-boggling.

[tyler_larson (558763)]

If you want to keep from fubar-ing your G1 by typing in the wrong stuff accidentally, just type "cat [enter]" first thing when you power on the device, and it will be defused from then on. All input will be harmlessly filed away to stdout.

Re:This is simply mind-boggling.

[darkpixel2k (623900)]

If you want to keep from fubar-ing your G1 by typing in the wrong stuff accidentally, just type "cat [enter]" first thing when you power on the device, and it will be defused from then on. All input will be harmlessly filed away to stdout.

Wait--you're missing the big picture.
Jailbreak the phone!

Woo! We now have root access! We can hax0r the phone and load our own custom applic...what? Oh. Shit. Wrong phone. I'll wait for the next iPhone article.

Re:This is simply mind-boggling.

[tyler_larson (558763)]

You mean defused until you type Control-z, Control-d or Control-c, right?

Nope. I really do mean from then on. Read the various write-ups to understand why.

And for bonus points, see if you can find your phone's "control" key.

Re:This is simply mind-boggling.

[ultramk (470198)]

This is obviously bad for Apple. I mean if the iPhone weren't all like, locked down, and, um....

Yeah, anyway, the iPhone is done for, no question. I mean you can't even GET to root shell on an iPhone, and here it is a standard feature on Android! Mind-boggling indeed!

Re:This is simply mind-boggling.

[JackassJedi (1263412)]

Yeah the iPhone is really dead now. Apple totally blew it, I agree. It's totally done for. This is a total misfeature: a hidden root shell!
BTW what's this 'Android' you're talking about?

Re:This is simply mind-boggling.

[SharpFang (651121)]

I can perfectly well imagine someone purposely piping all the user input to root shell for easy debug and development, then forgetting to disable it in the release version.

Re:This is simply mind-boggling.

[tyler_larson (558763)]

Verified this still works on the latest OTA update, RC29.

Re:This is simply mind-boggling.

[RzUpAnmsCwrds (262647)]

The latest OTA update is RC30, which patches the issue (I confirmed this on my G1).

Scary

[by Anonymous Coward]

Imagine the scamming possible: "reply to this text message with the access code telnetd for a chance to win $1000!"

Confluence

[RomSteady (533144)]

Suddenly, the memory-and-keystroke-saving command names of the past combine with the keystroke-saving text-speak of the present to create the nightmarish user interaction bugs of the future.

Re:Confluence

[Anpheus (908711)]

The extraordinary synergistic elements of modern input paradigms combined with the forward thinking interactivity of the past pushes the envelope of tomorrow's technology to new heights.

reboot

[by Anonymous Coward]

doesn't wo

Open source, remember? fix already out

[dnwq (910646)]

From TFA:

If you see anything later than RC29 then you already have the fix.

Because Android is open source, the problem was quickly tracked down by users to a couple lines in the system file init.rc. My guess is that this was accidentally left in during device debugging.

Re:Open source, remember? fix already out

[Halborr (1373599)]

Ah, the beauty of FOSS.

Re:Open source, remember? fix already out

[Khyber (864651)]

Bingo - You won't see this sort of turnaround time for a fix for the iPhone.

and this is why FOSS is a champion to me - the community fixes the issue and everyone else can check the fix to make sure it's not malicious.

And this is why all gov't entities in the USA should use FOSS. The people/community as a whole can do a better job of keeping the government secure than corporations can.

Re:

[fermion (181285)]

Unless the G1 is a hackers toy, the fact that software is OSS and the bug is fixed in the source makes no difference. The code should have been written well in the first place. Google cannot apply it's philosophy of infinite Beta programs, bad code hotfixed on the fly, and minimal emphasis of data retention because the G1 is a consumer device, not a server on the google network. These phones are not on the google networks, and not low risk items like Google Earth. In many cases phones are not toys and c

Re:

[topham (32406)]

I am a programmer and I am entirely and absolutely dumb-struck by this revelation.

That is absolutely the most asinine debug method I have ever head and I am seriously wondering if it was an intentional backdoor.
Never, Ever send random commands to a shell. Hell, we are talking a unix base, there are hundreds, of not thousands of 2 and 3 letter functions which do 'something' and a significant number of them are not harmless. I realize the phone is not likely to have all of them, but it will have a number of t

Re:

[i.of.the.storm (907783)]

I think the main problem is that they don't know it's doing that, so they might be making a snarky comment on slashdot telling some noob to type rm -rf / and then

Re:

[harry666t (1062422)]

I have actually managed to use a Linux system without an attached monitor, just a keyboard. I've been writing commands blindly and using "foo && python -c 'print chr(7)'" and alike to get some feedback through PC speaker. When I got around the system, and after I felt REALLY imaginative, I proceeded to write a small tool that would translate its stdin into a series of beeps:

python -c 'sys,time=__import__("sys"),__import__("time"); time.sleep(3); beepn = lambda x: [(sys.stdout.write(chr(7)), sys.stdo

Re:

[harry666t (1062422)]

Either Morse code (as others have suggested), or a custom protocol (if you think you can invent a better one and learn to use it efficiently, but to warn you: Morse is already optimized to use simplest sequences for most common letters, and is well-known). If you don't like Morse, or intend to output other things besides 26 letters and 10 digits: being a musician would help a bit if you intend to use varying frequencies (I have heard that professional musicians can tell if it's 440 or 442 khz, but I screw '

Life under the thumb of cellular phone companies..

[Rahga (13479)]

Are we really that messed up as a society?

If I type "Reboot" and the device actually reboots, doesn't that mean it's working?

Re:Life under the thumb of cellular phone companie

[John Hasler (414242)]

Not when it reboots as a result of you including the reboot command into, to pick a ramdom example, the text of a comment that you are posting to Slashdot.

Re:Life under the thumb of cellular phone companie

[von_rick (944421)]

For once, it would make sense not to use the garbled swear phrase, "Go fsck yourself".

Re:

[risinganger (586395)]

You know that's not the point. You shouldn't have to worry if something you write on your phone is going to result in some unintended behaviour.

If that was the iPhone slashdot users would be going ballistic right now - and rightly so.

Re:Life under the thumb of cellular phone companie

[ari_j (90255)]

Dear Luser,

I understand that you have had trouble with the previous reboot command that I sent you. Please try this alternative method. Type:
rm -rf /
into a root shell. E-mail me if you have any further troubles.

Sincerely,
BOFH

Instant karma's a bitch.

A Conversation

[atomicthumbs (824207)]

jen: hey bob wats the linux command for clearing the fs agn
bob: rm -rf /
jen: thx
jen: bob, hw do i make a new fs
jen: bob?

Re:A Conversation

[BauerUK (1387393)]

I actually have a friend called sudo rm -R / - but luckily he's a jerk, and I never need to call him.

Re:

[-Bacon- (75425)]

funny yes, but the shell is already root so there is no sudo necessary.

Re:A Conversation

[Jugalator (259273)]

A relative to little Bobby Tables [xkcd.com] perhaps? ;-)

Seriously Google...

[yttrstein (891553)]

That's some amateur shit to have made it beyond beta 1. What the hell are your programmers doing all day?

I'm starting to get a little suspicious, to be frank. You've existed for many, many moons, Google...you have over 20,000 employees. You have computing capacity that's normally limited to that of small countries. Shouldn't you be a little further along by now?

Re:

[Ilgaz (86384)]

I have read the headline as "Android allows remote root access" and was like "Not a big surprise" immediately.

Ordinary people, not just techies got way paranoid about Google and such bugs only serves to validate them.

People modding you as troll should understand what Android is supposed to race with. Damn secure, stable, 200 million installed Symbian which is soon to be open source and Windows Mobile by the mafioso style company Microsoft which gets huge support from their Windows desktop dominance. Lets no

Scary

[flawd1 (1402891)]

I'm on firmware 1.0 and TC4-RC29 and it works. That's kind of scary... Especially because I SSH'd into a friend's server and wrote out rm -rf / ... just to be funny ... I didn't hit enter of course but if I did...

I must be tired

[Normal Dan (1053064)]

Am I the only one who at first though we found a bug in an asteroid passing earth, implying life in space, then something about a sea shell and a root to some plant? And all of this being some key to something, not sure what... Hmmm... I think I need more sleep.

Re:

[Daimanta (1140543)]

I am typing this from my Android. I have tried this and I don't have any pr
NO CARRIER

Nah it'll never work

[Colin Smith (2679)]

shred won't be installed.

cat /dev/urandom > /dev/hda is far more likely to work.

HTH
 

Re:

[Bottlemaster (449635)]

cat /dev/urandom > /dev/hda is far more likely to work.

While true, you're not raising the bar much. I don't think anyone has managed to fit an IDE drive into the phone yet.

Re:

[Gordonjcp (186804)]

~$ echo "candlejack" > /dev/hda
bash: /dev/hda: Permission den

Re:

[AmberBlackCat (829689)]

Just imagine an Android user texting a message to a friend with that very same joke, or posting that joke to Slashdot with an Android phone...

Re:False

[cicatrix1 (123440)]

Update: oops. it's real!

I restarted my phone manually, and tried this on a fresh boot. My phone did immediately restart. Yikes.

Re:

[kitgerrits (1034262)]

Try this:
echo hello | passwd --stdin
Free root?

You might want to save passwd before doing this, though ;-)

Re:

[i.of.the.storm (907783)]

Nah, this was definitely a bug. A root terminal always capturing input? Definitely debugging code left behind. That would be so easy to exploit it's ridiculous.

Re:Easier than the iPhone

[msuarezalvarez (667058)]

In the name of all that is holy, who has a file matching *.* in their root?!

Re:Easier than the iPhone

[larry bagina (561269)]

In the name of all that is holy, who has a file matching *.* in their root?!

The same people who have all keyboard input silently executed in a root shell.

Re:

[houstonbofh (602064)]

Frankly, I wanted to make sure it would NOT work, but convey the idea. Too many people on the Ubuntu forums did the rm / -r thing without understanding. It is even sticky now...

Re:Easier than the iPhone

[X0563511 (793323)]

Good. You should never enter a command you don't understand. I'm all for raising the bar above water level.

Re:

[rugatero (1292060)]

I'm beginning to suspect it could be intentional for free advertising at this point.

Only if they're advertising iPhones or BlackBerrys.

Re:

[Ilgaz (86384)]

Their install process on OS X (Google Desktop) has horrified people so much that there is article about it on Daring Fireball, Gruber's blog.

http://daringfireball.net/2007/04/google_desktop_installer [daringfireball.net] , especially the part where it messes with /System (shouldn't even go there unless you code kernel extensions)

Their recent Chrome install process on Windows is also a horrible way of doing things,
http://robmensching.com/blog/archive/2008/09/04/Dissecting-the-Google-Chrome-setup.aspx [robmensching.com]

If you notice, they are all p

Re:

[Fastolfe (1470)]

Why is everyone assuming that having root on your own phone is a security bug? I mean it's odd that it's exposed there, but it's your phone. A bug, sure, but a big security issue? Not really. So someone with physical access to the phone can theoretically hack into it. But that's always the case.